Edit tour

Windows Analysis Report
PSI-CONF_Setup_v2.76.exe

Overview

General Information

Sample name:	PSI-CONF_Setup_v2.76.exe
Analysis ID:	1528774
MD5:	4bf5ec6ea419625fd7fbc9d7df84b5f4
SHA1:	4f530013dcc3d2393abb006ca66834f558036c89
SHA256:	9162049d459e334a9721e7e770bf2e1e64d60ebccfbf43d727e8975db6c9df00
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Compliance

Score:	47
Range:	0 - 100

Signatures

Installs new ROOT certificates

Sigma detected: Dot net compiler compiles file from suspicious location

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Compiles C# or VB.Net code

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables driver privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sleep loop found (likely to delay execution)

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses 32bit PE files

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

PSI-CONF_Setup_v2.76.exe (PID: 6632 cmdline: "C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe" MD5: 4BF5EC6EA419625FD7FBC9D7DF84B5F4)

irsetup.exe (PID: 6524 cmdline: "C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:666146 "__IRAFN:C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2246122658-3693405117-2476756634-1003" MD5: 3FE7C92DBA5C9240B4AB0D6A87E6166A)

Phoenix Contact VCPInstaller.exe (PID: 4668 cmdline: "C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe" MD5: A6EA5C9B61F3DD92B3833AE2DD3FA72F)

icacls.exe (PID: 6308 cmdline: "C:\Windows\System32\icacls.exe" "C:\ProgramData\Phoenix Contact\PSIConfSoftware" /grant *S-1-1-0:(OI)M /T MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 3808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PSI-CONF.exe (PID: 4432 cmdline: "C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe" MD5: 8F6908A3C2F22EE306CC55D7CFA08320)

csc.exe (PID: 3668 cmdline: "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rqco3gp6.cmdline" MD5: 953344403C93E6FBB8C573273D645242)

conhost.exe (PID: 6056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 5604 cmdline: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF17E.tmp" "c:\Users\user\AppData\Local\Temp\CSCF17D.tmp" MD5: 3FDA06F8AA40293397F58A687EEABC1F)

drvinst.exe (PID: 5340 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\slabvcp.inf" "9" "4f7b0f4b7" "0000000000000148" "WinSta0\Default" "0000000000000168" "208" "C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

rundll32.exe (PID: 2576 cmdline: rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{c7f7ce19-85e2-2b4e-af72-83044df6dea6} Global\{7407c8d9-0d94-0b41-8543-eb54da946896} C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.inf C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.cat MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Telit\Xfp1.9.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe, ProcessId: 4432, TargetFilename: C:\Users\user\AppData\Local\Temp\rqco3gp6.cmdline

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rqco3gp6.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rqco3gp6.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe, ParentCommandLine: "C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe", ParentImage: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe, ParentProcessId: 4432, ParentProcessName: PSI-CONF.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rqco3gp6.cmdline", ProcessId: 3668, ProcessName: csc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

Uses 32bit PE files

Source: PSI-CONF_Setup_v2.76.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

File created: C:\ProgramData\Phoenix Contact\PSIConfSoftware\SetupLog.txt

Jump to behavior

PE / OLE file has a valid certificate

Source: PSI-CONF_Setup_v2.76.exe

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll

Spreading

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Source: irsetup.exe, 00000002.00000002.2847956855.0000000004D09000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2826847095.0000000004CFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.indigorose.com
Source: irsetup.exe, 00000002.00000002.2847956855.0000000004D09000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2826847095.0000000004CFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.indigorose.comERROR:
Source: irsetup.exe, 00000002.00000003.2826640586.00000000044A5000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2826600914.00000000044B9000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2837708313.000000000441E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2840976065.0000000004426000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2826509562.0000000004753000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2842645729.000000000442D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2828366742.0000000004453000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2837620517.0000000004406000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2828456225.0000000004466000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2841318428.0000000004426000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2841359508.0000000004429000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phoenixcontact.com/
Source: irsetup.exe, 00000002.00000003.2841085831.0000000004474000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2828743366.000000000446C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2828671762.0000000004468000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2828415199.000000000445D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2828366742.0000000004453000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2828456225.0000000004466000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phoenixcontact.com/EditField)_0
Source: irsetup.exe, 00000002.00000003.2825182735.00000000052F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://select.phoenixcontact.com/phoenix/dwl/dwl01.jsp?from=psiconf&file=

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\SET152A.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\SET18A5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\slabvcp.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\slabvcp.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\slabvcp.cat	Jump to dropped file

System Summary

Creates driver files

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\silabenm.sys

Jump to behavior

Creates files inside the driver directory

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}

Jump to behavior

Creates files inside the system directory

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Windows\INF\oem0.PNF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Windows\INF\oem1.PNF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Windows\INF\oem3.PNF	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\slabvcp.inf_amd64_d5d1b7de54203434	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\slabvcp.inf_amd64_d5d1b7de54203434\x64	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem4.inf	Jump to behavior
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	File created: C:\Windows\assembly\Desktop.ini

Deletes files inside the Windows folder

Source: C:\Windows\System32\drvinst.exe

File deleted: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET17E6.tmp

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Code function: 0_2_0040525A	0_2_0040525A
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Code function: 0_2_00403FB0	0_2_00403FB0
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ADE22	2_3_006ADE22
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006ABBEA	2_3_006ABBEA
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Code function: 12_2_00007FF848F62825	12_2_00007FF848F62825
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Code function: 12_2_00007FF848F73B3E	12_2_00007FF848F73B3E
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Code function: 12_2_00007FF848F6F35C	12_2_00007FF848F6F35C
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Code function: 12_2_00007FF848F72FBD	12_2_00007FF848F72FBD
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Code function: 12_2_00007FF848F62953	12_2_00007FF848F62953
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Code function: 12_2_00007FF848F6D6E9	12_2_00007FF848F6D6E9

Enables driver privileges

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe

Process token adjusted: Load Driver

Jump to behavior

Found potential string decryption / allocating functions

Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Code function: String function: 00007FF848F65810 appears 39 times
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Code function: String function: 00007FF848F64E70 appears 37 times

PE file contains executable resources (Code or Archives)

Source: irsetup.exe.0.dr	Static PE information: Resource name: RT_CURSOR type: DOS executable (COM, 0x8C-variant)
Source: irsetup.exe.0.dr	Static PE information: Resource name: RT_DIALOG type: COM executable for DOS
Source: irsetup.exe.0.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: Phoenix Contact VCPInstaller.exe.2.dr	Static PE information: Resource name: EXE type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: WdfCoInstaller01009.dll.2.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 1639755 bytes, 2 files, at 0x44 +A "Microsoft Kernel-Mode Driver Framework Install-v1.9-Win2k-WinXP-Win2k3.exe" +A "Microsoft Kernel-Mode Driver Framework Install-v1.9-Vista.msu", flags 0x4, ID 12343, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression

Sample file is different than original file name gathered from version info

Source: PSI-CONF_Setup_v2.76.exe, 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesuf80_launch.exe2 vs PSI-CONF_Setup_v2.76.exe
Source: PSI-CONF_Setup_v2.76.exe, 00000000.00000002.2849863551.00000000006F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesuf80_rt.exeT vs PSI-CONF_Setup_v2.76.exe
Source: PSI-CONF_Setup_v2.76.exe, 00000000.00000002.2849935303.0000000002130000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesuf80_launch.exe2 vs PSI-CONF_Setup_v2.76.exe
Source: PSI-CONF_Setup_v2.76.exe, 00000000.00000003.2848630429.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesuf80_rt.exeT vs PSI-CONF_Setup_v2.76.exe

Uses 32bit PE files

Source: PSI-CONF_Setup_v2.76.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: irsetup.exe.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9887366134129213
Source: WdfCoInstaller01009.dll.2.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9985629322738576

Source: ICSharpCode.SharpZipLib.dll.2.dr, InflaterInputBuffer.cs	Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.2.dr, DeflaterOutputStream.cs	Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.2.dr, ZipAESTransform.cs	Cryptographic APIs: 'TransformBlock'

Source: classification engine

Classification label: sus24.expl.evad.winEXE@18/192@0/0

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

Code function: 0_2_004018EE lstrlenA,GetCurrentDirectoryA,_memset,GetTempPathA,lstrlenA,lstrlenA,lstrcpyA,lstrlenA,lstrcatA,wsprintfA,wsprintfA,wsprintfA,DeleteFileA,DeleteFileA,RemoveDirectoryA,wsprintfA,wsprintfA,DeleteFileA,RemoveDirectoryA,GetFileAttributesA,CreateDirectoryA,CreateDirectoryA,lstrcpyA,lstrcpyA,SetCurrentDirectoryA,SetCurrentDirectoryA,lstrcpyA,CreateDirectoryA,SetCurrentDirectoryA,lstrcpyA,lstrlenA,lstrcatA,lstrcpyA,lstrcpyA,lstrcatA,GetDiskFreeSpaceA,lstrcpyA,SetCurrentDirectoryA,

0_2_004018EE

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

File created: C:\Users\Public\Desktop\PSI-CONF.lnk

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3808:120:WilError_03
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Mutant created: NULL
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Mutant created: \Sessions\1\BaseNamedObjects\PSI-CONF
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6056:120:WilError_03

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0

Jump to behavior

Source: Yara match

File source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Telit\Xfp1.9.exe, type: DROPPED

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

Command line argument: /~DBG

0_2_0040121E

Source: PSI-CONF_Setup_v2.76.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\drvinst.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{c7f7ce19-85e2-2b4e-af72-83044df6dea6} Global\{7407c8d9-0d94-0b41-8543-eb54da946896} C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.inf C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.cat

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

File read: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe "C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe"
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Process created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe "C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:666146 "__IRAFN:C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2246122658-3693405117-2476756634-1003"
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe "C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe"
Source: unknown	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\slabvcp.inf" "9" "4f7b0f4b7" "0000000000000148" "WinSta0\Default" "0000000000000168" "208" "C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0"
Source: C:\Windows\System32\drvinst.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{c7f7ce19-85e2-2b4e-af72-83044df6dea6} Global\{7407c8d9-0d94-0b41-8543-eb54da946896} C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.inf C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.cat
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\System32\icacls.exe" "C:\ProgramData\Phoenix Contact\PSIConfSoftware" /grant *S-1-1-0:(OI)M /T
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe "C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe"
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rqco3gp6.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF17E.tmp" "c:\Users\user\AppData\Local\Temp\CSCF17D.tmp"
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Process created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe "C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:666146 "__IRAFN:C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2246122658-3693405117-2476756634-1003"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe "C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\System32\icacls.exe" "C:\ProgramData\Phoenix Contact\PSIConfSoftware" /grant *S-1-1-0:(OI)M /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe "C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe"	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{c7f7ce19-85e2-2b4e-af72-83044df6dea6} Global\{7407c8d9-0d94-0b41-8543-eb54da946896} C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.inf C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.cat	Jump to behavior
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rqco3gp6.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF17E.tmp" "c:\Users\user\AppData\Local\Temp\CSCF17D.tmp"

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: spinf.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: pnpui.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: riched20.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: usp10.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: msls31.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: cryptnet.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: dwrite.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: riched20.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: usp10.dll
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Section loaded: msls31.dll
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Section loaded: cscomp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe	Section loaded: cryptbase.dll

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

File written: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\setup.ini

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: Install
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Automated click: I accept the terms in the license agreement
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Automated click: Next
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Automated click: I accept the terms in the license agreement
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Automated click: Next
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Automated click: I accept the terms in the license agreement
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Automated click: Next
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Automated click: I accept the terms in the license agreement
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Automated click: Next
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Automated click: I accept the terms in the license agreement
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Automated click: Next
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Automated click: I accept the terms in the license agreement
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Automated click: Next
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Automated click: I accept the terms in the license agreement
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Automated click: Next
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Automated click: I accept the terms in the license agreement

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found window with many clickable UI elements (buttons, textforms, scrollbars etc)

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Window detected: Number of UI elements: 11

Uses Microsoft Silverlight

Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll

PE / OLE file has a valid certificate

Source: PSI-CONF_Setup_v2.76.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: PSI-CONF_Setup_v2.76.exe

Static file information: File size 46190112 > 1048576

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll

Data Obfuscation

Compiles C# or VB.Net code

Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rqco3gp6.cmdline"
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rqco3gp6.cmdline"

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

Code function: 0_2_00407054 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,__invoke_watson,GetProcAddress,GetProcAddress,__invoke_watson,

0_2_00407054

PE file contains sections with non-standard names

Source: silabenm.sys.2.dr	Static PE information: section name: PAGESENM
Source: silabser.sys.2.dr	Static PE information: section name: PAGESRP0
Source: silabser.sys.2.dr	Static PE information: section name: PAGESER
Source: silabenm.sys0.2.dr	Static PE information: section name: PAGESENM

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Code function: 0_2_00403F99 push ecx; ret	0_2_00403FAC
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 2_3_006AB520 pushad ; ret	2_3_006ABBE9

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\drvinst.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656 Blob

Jump to behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\de\PCID2708517.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\de\PCID2702878.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\ModbusLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\PCID2313669.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\uninstall.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	File created: C:\Users\user\AppData\Local\Temp\rqco3gp6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Telit\Xfp1.9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\PCID2901540.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\zh-CHS\PCID2702863.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabser.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PCID1081818.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\PCID2901541_HG.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabenm.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\WdfCoInstaller01009.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\ru\PCID2901541.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\de\PCID2702184.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\PhoenixResourceManager.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\silabenm.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x86\silabenm.sys	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET17E6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\WdfCoInstaller01009.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\ModbusLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\PCID2313656.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\PCID2313559.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\zh-CHS\PCID2313656.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\zh-CHS\PCID2901541.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\PCID2313449.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\de\PCID2901540.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x86\WdfCoInstaller01009.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x86\silabser.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\zh-CHS\PCID2313449.resources.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\silabser.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\SET14FA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\ModbusLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\zh-CHS\PCID2313669.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\silabser.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\silabenm.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PhoenixResourceManager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\de\PCID2313559.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\de\PCID2901541.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\SET14D9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\de\BugReportCreator.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\PCID2708517.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\ModbusLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\WdfCoInstaller01009.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF AutoUpdate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\de\PSI-CONF.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\SET14EA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\de\PCID2313106.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PhoenixResourceManager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\zh-CHS\PCID2702878.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\PCID2313643.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Device\psiprog-1.57.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\PCID2702863.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET1845.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\zh-CHS\PCID2708517.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\de\PCID2313643.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\zh-CHS\PCID2313643.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\zh-CHS\PCID2313106.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\zh-CHS\PCID2901540.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\ru\PCID2702863.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\zh-CHS\PCID2313559.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\zh-CHS\PCID2702184.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\de\PCID2702863.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\ru\PSI-CONF.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\de\PCID2313449.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\PCID2313106.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabenm.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\ModbusLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Uninstall\IRZip.lmd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabser.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\GetActiveProxy.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\ModbusLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\PCID2904909.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\silabenm.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\PCID2901541.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\zh-CHS\PCID2904909.resources.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET1865.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\de\PCID2313656.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\silabser.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\zh-CHS\PCID2313533.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\de\PCID2313669.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\PCID2702184.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\PCID2313533.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\BugReportCreator.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\PCID2702878.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\de\PCID2313533.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\DriverUninstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\zh-CHS\PSI-CONF.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\WdfCoinstaller01009.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\de\PCID2904909.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\ModbusLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\de\PCID1081818.resources.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\WdfCoinstaller01009.dll (copy)	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET1845.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\silabenm.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET17E6.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET1865.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\silabser.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\WdfCoinstaller01009.dll (copy)	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Uninstall\IRZip.lmd			Jump to dropped file

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

File created: C:\ProgramData\Phoenix Contact\PSIConfSoftware\SetupLog.txt

Jump to behavior

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Phoenix Contact\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Phoenix Contact\PSI-CONF\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Phoenix Contact\PSI-CONF\PSI-CONF.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Phoenix Contact\PSI-CONF\PSI-CONF Update Client.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Phoenix Contact\PSI-CONF\Uninstall PSI-CONF.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Stores large binary data to the registry

Source: C:\Windows\System32\drvinst.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 Blob

Jump to behavior

Uses cacls to modify the permissions of files

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\System32\icacls.exe" "C:\ProgramData\Phoenix Contact\PSIConfSoftware" /grant *S-1-1-0:(OI)M /T

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Memory allocated: 1A10000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Memory allocated: 3A10000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Memory allocated: 1BA10000 memory commit \| memory reserve \| memory write watch

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Window / User API: threadDelayed 1087

Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\de\PCID2708517.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\de\PCID2702878.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\ModbusLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\PCID2313669.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\rqco3gp6.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\zh-CHS\PCID2702863.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Telit\Xfp1.9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\PCID2901540.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabser.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PCID1081818.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\PCID2901541_HG.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabenm.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\WdfCoInstaller01009.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\ru\PCID2901541.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\de\PCID2702184.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\PhoenixResourceManager.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\silabenm.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET17E6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x86\silabenm.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\WdfCoInstaller01009.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\PCID2313656.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\ModbusLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\PCID2313559.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\zh-CHS\PCID2313656.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\zh-CHS\PCID2901541.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\PCID2313449.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\de\PCID2901540.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x86\WdfCoInstaller01009.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x86\silabser.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\zh-CHS\PCID2313449.resources.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\silabser.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\SET14FA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\ModbusLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\zh-CHS\PCID2313669.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\silabser.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\silabenm.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PhoenixResourceManager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\de\PCID2313559.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\de\PCID2901541.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\SET14D9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\de\BugReportCreator.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\PCID2708517.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\ModbusLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF AutoUpdate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\de\PSI-CONF.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\SET14EA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\WdfCoInstaller01009.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\de\PCID2313106.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\zh-CHS\PCID2702878.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PhoenixResourceManager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\PCID2313643.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Device\psiprog-1.57.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\PCID2702863.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET1845.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\zh-CHS\PCID2708517.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\de\PCID2313643.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\zh-CHS\PCID2313643.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\zh-CHS\PCID2313106.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\zh-CHS\PCID2901540.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\zh-CHS\PCID2313559.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\ru\PCID2702863.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\zh-CHS\PCID2702184.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\de\PCID2702863.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\ru\PSI-CONF.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\de\PCID2313449.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\PCID2313106.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabenm.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\ModbusLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Uninstall\IRZip.lmd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabser.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\GetActiveProxy.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\ModbusLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\PCID2904909.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\silabenm.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET1865.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\PCID2901541.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\zh-CHS\PCID2904909.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\de\PCID2313656.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\silabser.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\zh-CHS\PCID2313533.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\de\PCID2313669.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\PCID2702184.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\PCID2313533.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\BugReportCreator.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\PCID2702878.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\de\PCID2313533.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\DriverUninstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\WdfCoinstaller01009.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\zh-CHS\PSI-CONF.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\de\PCID2904909.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\ModbusLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\de\PCID1081818.resources.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\WdfCoinstaller01009.dll (copy)	Jump to dropped file

Found evasive API chain checking for process token information

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-4744

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Sleep loop found (likely to delay execution)

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Thread sleep count: Count: 1087 delay: -10

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2308880687.000000000059C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563ommonProgramFiles = "%CommonProgramFiles
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300308294.00000000029E1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321398589.00000000027C6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322455462.00000000027C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DeviceDesc = "Microsoft Hyper-V SCSI Controller"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2298463203.0000000002781000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Activation.DeviceDesc = "Microsoft Hyper-V Activation Component"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AddReg=VmIcShutdown.HW.AddReg
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVS
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2297697663.000000000059C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563=
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324784219.000000000282D000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2299975086.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323438455.000000000282C000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322273255.000000000282C000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2306767874.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DeviceDesc = "Microsoft Hyper-V Fibre Channel HBA"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2266698107.0000000000565000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ; ConnectX-4 Hyper-V VF
Source: irsetup.exe, 00000002.00000003.2510425719.00000000006A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [VmIcShutdown.NT.HW]
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netvsc_eth.DeviceDesc = "Microsoft Hyper-V Ethernet Network Adapter"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2299975086.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Heartbeat.DeviceDesc = "Microsoft Hyper-V Heartbeat"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2299975086.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301023666.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shutdown.DeviceDesc = "Microsoft Hyper-V Guest Shutdown"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2266698107.0000000000565000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ; ConnectX-4 non Hyper-V VF
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289874462.00000000029B1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324727014.00000000027A0000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2292021624.00000000029DC000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321398589.00000000027C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMBusHid.DeviceDesc = "Microsoft Hyper-V Input"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %VSS.DeviceDesc% = VmIcVss, vmbus\{2450ee40-33bf-4fbd-892e-9fb06e9214cf}
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netvsc_mbb_gsm.DeviceDesc = "Microsoft Hyper-V GSM MBB Network Adapter"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HyperVNetworkAdapterName = "Hyper-V Network Adapter Name"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2290813674.00000000027E2000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2282968382.00000000027DB000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ; Hyper-V Network Adapter Name
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322425727.0000000000507000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [VmIcVss.NT]
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2308880687.000000000059C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563b
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309686444.00000000027F6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300308294.00000000029E1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2316477527.00000000027F5000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2280765136.0000000000525000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322425727.0000000000507000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DynMemVsc.DeviceDesc = "Microsoft Hyper-V Dynamic Memory"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [VmIcHeartbeat.NT]
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323611546.00000000027B2000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301023666.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322455462.00000000027AB000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TimeSync.DeviceDesc = "Microsoft Hyper-V Time Synchronization"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2308880687.000000000059C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563Y
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323611546.00000000027B2000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2298463203.0000000002781000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2306767874.00000000027DA000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2299975086.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301023666.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322455462.00000000027AB000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DiskId1 = "Microsoft Hyper-V Integration Components"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2259785251.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2279239071.0000000002831000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GenericScsiVmLun = "Hyper-V LUN"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2298463203.0000000002781000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VSS.DeviceDesc = "Microsoft Hyper-V Volume Shadow Copy"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [VmIcHeartbeat.NT.HW]
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AddReg=VmIcHeartbeat.HW.AddReg
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300308294.00000000029E1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289874462.00000000029B1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2292021624.00000000029DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ; Hyper-V Synthetic Video driver.
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2308880687.000000000059C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563w
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AddReg=VmIcVss.HW.AddReg
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2320101206.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321656088.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c = "Microsoft Hyper-V Activation Component"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323679118.0000000002802000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301077541.00000000027F6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2271536312.0000000000533000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2280765136.0000000000525000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2302146162.00000000027E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ; INF file for installing the Hyper-V crashdump driver.
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321398589.00000000027C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: id.DeviceDesc = "Microsoft Hyper-V Input"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [VmIcHeartbeat.NT.Services]
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2306767874.00000000027DA000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GuestInterface.DeviceDesc = "Microsoft Hyper-V Guest Service Interface"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [VmIcShutdown.HW.AddReg]
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2320101206.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321656088.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{152fbe4b-c7ad-4f68-bada-a4fcc1464f6c}",,0x0,"Microsoft-Windows-Hyper-V-Netvsc"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2280765136.0000000000525000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: F file for installing the Hyper-V crashdump driver.
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2298463203.0000000002781000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Rdv.DeviceDesc = "Microsoft Hyper-V Remote Desktop Virtualization"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %Heartbeat.DeviceDesc% = VmIcHeartbeat, vmbus\{57164f39-9115-4e78-ab55-382f3bd5422d}
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [VmIcHeartbeat.HW.AddReg]
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [VmIcShutdown.NT.Services]
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [VmIcShutdown.NT]
Source: PSI-CONF_Setup_v2.76.exe, 00000000.00000002.2849725983.00000000006BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _VMware_80n
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300308294.00000000029E1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321398589.00000000027C6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322455462.00000000027C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DiskId = "Microsoft Hyper-V SCSI Controller Installation Disk #1"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289874462.00000000029B1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324727014.00000000027A0000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2292021624.00000000029DC000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321398589.00000000027C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DiskId1 = "Microsoft Hyper-V Input Installation Disk #1"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2290813674.00000000027E2000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2282968382.00000000027DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HyperVNetworkAdapterName = "Hyper-V Network Adapter N%m
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324784219.000000000282D000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2299975086.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323438455.000000000282C000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322273255.000000000282C000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2306767874.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DeviceDesc_NULL = "Microsoft Hyper-V Fibre Channel HBA (not supported)"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [VmIcVss.NT.HW]
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2298463203.0000000002781000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2320101206.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321656088.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RdpD.DeviceDesc = "Microsoft Hyper-V Remote Desktop Data Channel"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2290813674.00000000027E2000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2282968382.00000000027DB000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netvsc_ppp.DeviceDesc = "Microsoft Hyper-V VPN Network Adapter"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2282968382.00000000027DB000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2320101206.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321656088.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{152fbe4b-c7ad-4f68-bada-a4fcc1464f6c}\ChannelReferences\1",,0x0,"Microsoft-Windows-Hyper-V-NETVSC/Diagnostic"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DiskId1 = "Microsoft Hyper-V Network Adapter Installation Disk #1"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2308880687.000000000059C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563x
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323679118.0000000002802000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301077541.00000000027F6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2271536312.0000000000533000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2280765136.0000000000525000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2302146162.00000000027E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvCrash.DeviceDesc = "Microsoft Hyper-V Crashdump Driver"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2298463203.0000000002781000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2320101206.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321656088.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RdpC.DeviceDesc = "Microsoft Hyper-V Remote Desktop Control Channel"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %Shutdown.DeviceDesc% = VmIcShutdown, vmbus\{b6650ff7-33bc-4840-8048-e0676786f393}
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301023666.000000000050B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Desc = "Microsoft Hyper-V Guest Service Interface"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000584000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2305972251.0000000002A70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ; This is the INF file for installing the Hyper-V S3 Cap driver
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [VmIcVss.HW.AddReg]
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [VmIcVss.NT.Services]
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324684756.00000000027E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HyperKbd.DeviceDesc = "Microsoft Hyper-V Virtual Keyboard"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300308294.00000000029E1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289874462.00000000029B1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2292021624.00000000029DC000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321398589.00000000027C6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322455462.00000000027C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SynthVid.DeviceDesc = "Microsoft Hyper-V Video"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netvsc.DeviceDesc = "Microsoft Hyper-V Network Adapter"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic","OwningPublisher",0x0,"{152fbe4b-c7ad-4f68-bada-a4fcc1464f6c}"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2297697663.000000000059C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic","ChannelAccess",0x0,"O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324684756.00000000027E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ; INF file for installing Hyper-V keyboard driver
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2308880687.000000000059C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @SYSTEM:vmci.inf_amd64_68ed49469341f563
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKR, Ndi\Interfaces, FilterMediaTypes,,"ethernet, wlan, ppip, vmnetextension"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic","Isolation",0x00010001,0
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300308294.00000000029E1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289874462.00000000029B1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2292021624.00000000029DC000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321398589.00000000027C6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322455462.00000000027C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DiskId1 = "Microsoft Hyper-V Video Installation Disk #1"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324784219.000000000282D000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2299975086.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323438455.000000000282C000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322273255.000000000282C000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2306767874.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DiskId = "Microsoft Hyper-V Fibre Channel HBA Installation Disk #1"
Source: irsetup.exe, 00000002.00000003.2510425719.00000000006A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323679118.0000000002802000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301077541.00000000027F6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2271536312.0000000000533000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2280765136.0000000000525000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2302146162.00000000027E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DiskId1 = "Microsoft Hyper-V Crash Dump Installation Disk #1"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic","Enabled",0x00010001,0
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2323611546.00000000027B2000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2289335943.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2301023666.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322455462.00000000027AB000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309945969.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2275114474.0000000002780000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2291543255.0000000002B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: KvpExchange.DeviceDesc = "Microsoft Hyper-V Data Exchange"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2320101206.0000000002B86000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2321656088.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NE
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t Hyper-V Virtual Keyboard"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2309686444.00000000027F6000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300308294.00000000029E1000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2316477527.00000000027F5000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2280765136.0000000000525000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2322425727.0000000000507000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DiskId1 = "Microsoft Hyper-V Dynamic Memory Installation Disk #1"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324727014.00000000027A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sc = "Microsoft Hyper-V Input"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000584000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2305972251.0000000002A70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: S3CapDevice.DeviceDesc = "Microsoft Hyper-V S3 Cap"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2295813192.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000584000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2305972251.0000000002A70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DiskId1 = "Microsoft Hyper-V S3 Cap Installation Disk #1"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netvsc_wifi.DeviceDesc = "Microsoft Hyper-V WiFi Network Adapter"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETV
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324684756.00000000027E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DiskId1 = "Microsoft Hyper-V Virtual Keyboard Installation Disk #1"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2300142790.0000000000555000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324403544.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2307830794.0000000002B86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netvsc_mbb_cdma.DeviceDesc = "Microsoft Hyper-V CDMA MBB Network Adapter"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2298463203.0000000002781000.00000004.00000020.00020000.00000000.sdmp, Phoenix Contact VCPInstaller.exe, 00000003.00000003.2324727014.0000000002781000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVS
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2316477527.00000000027F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKR, Ndi\Interfaces,FilterMediaTypes,,"vmnetextension"
Source: Phoenix Contact VCPInstaller.exe, 00000003.00000003.2260352505.000000000050B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic","Type",0x00010001,2

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

Code function: 0_2_00407054 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,__invoke_watson,GetProcAddress,GetProcAddress,__invoke_watson,

0_2_00407054

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

Code function: 0_2_00402E99 GetStartupInfoA,GetProcessHeap,GetProcessHeap,HeapAlloc,_fast_error_exit,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,_fast_error_exit,_fast_error_exit,__RTC_Initialize,__ioinit,__amsg_exit,GetCommandLineA,___crtGetEnvironmentStringsA,__setargv,__amsg_exit,__setenvp,__amsg_exit,__cinit,__amsg_exit,__wincmdln,

0_2_00402E99

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Code function: 0_2_00405859 SetUnhandledExceptionFilter,	0_2_00405859
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Code function: 0_2_00401000 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00401000
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Code function: 0_2_00407303 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00407303
Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Code function: 0_2_0040110A _memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040110A

Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe	Process created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe "C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:666146 "__IRAFN:C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2246122658-3693405117-2476756634-1003"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\System32\icacls.exe" "C:\ProgramData\Phoenix Contact\PSIConfSoftware" /grant *S-1-1-0:(OI)M /T	Jump to behavior
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rqco3gp6.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF17E.tmp" "c:\Users\user\AppData\Local\Temp\CSCF17D.tmp"

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Windows\System32\drvinst.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe c:\windows\system32\pnpui.dll,installsecuritypromptrundllw 20 global\{c7f7ce19-85e2-2b4e-af72-83044df6dea6} global\{7407c8d9-0d94-0b41-8543-eb54da946896} c:\windows\system32\driverstore\temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.inf c:\windows\system32\driverstore\temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.cat
Source: C:\Windows\System32\drvinst.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe c:\windows\system32\pnpui.dll,installsecuritypromptrundllw 20 global\{c7f7ce19-85e2-2b4e-af72-83044df6dea6} global\{7407c8d9-0d94-0b41-8543-eb54da946896} c:\windows\system32\driverstore\temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.inf c:\windows\system32\driverstore\temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.cat			Jump to behavior

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

Code function: 0_2_0040605D cpuid

0_2_0040605D

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

Code function: GetLocaleInfoA,

0_2_0040783D

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

Code function: 0_2_00405F79 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00405F79

Source: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe

0_2_00402E99

Source: C:\Windows\System32\drvinst.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Adds / modifies Windows certificates

Source: C:\Windows\System32\drvinst.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\46B8D8F38741CD4E839F1F6B874F58B0A87C1937 Blob

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 LSASS Driver	1 LSASS Driver	11 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Windows Service	1 Windows Service	21 Obfuscated Files or Information	Security Account Manager	36 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Install Root Certificate	NTDS	11 Security Software Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Services File Permissions Weakness	1 Registry Run Keys / Startup Folder	11 Software Packing	LSA Secrets	2 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Services File Permissions Weakness	1 DLL Side-Loading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	42 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	11 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Services File Permissions Weakness	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Rundll32	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PSI-CONF_Setup_v2.76.exe	0%	ReversingLabs
PSI-CONF_Setup_v2.76.exe	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\DriverUninstaller.exe	0%	ReversingLabs
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\DriverUninstaller.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\WdfCoInstaller01009.dll	0%	ReversingLabs
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\WdfCoInstaller01009.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabenm.sys	0%	ReversingLabs
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabenm.sys	0%	Virustotal	Browse
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabser.sys	0%	ReversingLabs
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabser.sys	0%	Virustotal	Browse
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\WdfCoInstaller01009.dll	0%	ReversingLabs
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\WdfCoInstaller01009.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabenm.sys	0%	ReversingLabs
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabenm.sys	0%	Virustotal	Browse
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabser.sys	2%	ReversingLabs
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabser.sys	0%	Virustotal	Browse
C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\ModbusLib.dll	0%	ReversingLabs
C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\ModbusLib.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Device\psiprog-1.57.exe	2%	ReversingLabs
C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Device\psiprog-1.57.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Telit\Xfp1.9.exe	2%	ReversingLabs
C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Telit\Xfp1.9.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\PCID2313106.dll	0%	ReversingLabs
C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\PCID2313106.dll	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://www.phoenixcontact.com/	0%	Virustotal		Browse
http://www.indigorose.com	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.indigorose.comERROR:	irsetup.exe, 00000002.00000002.2847956855.0000000004D09000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2826847095.0000000004CFA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.phoenixcontact.com/	irsetup.exe, 00000002.00000003.2826640586.00000000044A5000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2826600914.00000000044B9000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2837708313.000000000441E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2840976065.0000000004426000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2826509562.0000000004753000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2842645729.000000000442D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2828366742.0000000004453000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2837620517.0000000004406000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2828456225.0000000004466000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2841318428.0000000004426000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2841359508.0000000004429000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://select.phoenixcontact.com/phoenix/dwl/dwl01.jsp?from=psiconf&file=	irsetup.exe, 00000002.00000003.2825182735.00000000052F0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.indigorose.com	irsetup.exe, 00000002.00000002.2847956855.0000000004D09000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2826847095.0000000004CFA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.phoenixcontact.com/EditField)_0	irsetup.exe, 00000002.00000003.2841085831.0000000004474000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2828743366.000000000446C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2828671762.0000000004468000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2828415199.000000000445D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2828366742.0000000004453000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000002.00000003.2828456225.0000000004466000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528774
Start date and time:	2024-10-08 09:44:43 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PSI-CONF_Setup_v2.76.exe
Detection:	SUS
Classification:	sus24.expl.evad.winEXE@18/192@0/0
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 98% Number of executed functions: 104 Number of non-executed functions: 13
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target PSI-CONF.exe, PID 4432 because it is empty
Execution Graph export aborted for target irsetup.exe, PID 6524 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\WdfCoInstaller01009.dll	SecuriteInfo.com.Program.RemoteAdminNET.1.22990.5900.msi	Get hash	malicious	AteraAgent	Browse
	InstallDriver.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Program.RemoteAdminNET.1.7216.330.msi	Get hash	malicious	AteraAgent	Browse
	SecuriteInfo.com.Program.RemoteAdminNET.1.1711.8851.msi	Get hash	malicious	AteraAgent	Browse
	https://dl.dell.com/FOLDER11489837M/1/DPeM_4M3XN_1.7.4_WN64_A00.exe	Get hash	malicious	Unknown	Browse
	PL23XX-M_LogoDriver_Setup_408_20220725.exe	Get hash	malicious	Unknown	Browse
	PL23XX-M_LogoDriver_Setup_408_20220725.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Trojan.Agent.M47LP3.18905.20801.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Trojan.Agent.M47LP3.18905.20801.exe	Get hash	malicious	Unknown	Browse
	SidecarASICIDESetup.msi	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabenm.sys	tconnect_HCP_Software_v301_Installer.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\DriverUninstaller.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	281736
Entropy (8bit):	6.2508448798744025
Encrypted:	false
SSDEEP:	6144:rBZe7bs9oe7zRJSk2GbGcYXZt0gBsD5xp5:VAULJv2GydXZtzBsDN5
MD5:	BE32437D1739B5538398412C511CE671
SHA1:	202B5F1E6C960F2AC18F5641BB6289DF83A6F367
SHA-256:	E22D65BD78CA58C168869BE36867F7D3A88B1C5DD1001DC4F0507DA63666A1CC
SHA-512:	D8E3EF6BA03EF9EC62BD46CFD2FA196325D322734AC0CE4310520A9D36BB95DFD02455491EB27720FDBA2B092781ADA72000B24A16BE0AC941972A659F1F5BEC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........f:..i..i..i.Wi..i.Ui...i.Eui...i.Eeiq..i...i..i..i..i.Efib..i.Eti..i.Epi..iRich..i........PE..L...h..N.....................`.......{............@..................................Z.......................................j...........w...........@..............................................p1..@...................$j..@....................text............................... ..`.rdata..............................@..@.data...<`.......0..................@....rsrc....w..........................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\slabvcp.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	data
Category:	dropped
Size (bytes):	12356
Entropy (8bit):	6.838858924907412
Encrypted:	false
SSDEEP:	192:OeTWTgTeT9TXTqeTc+ECwNGoZBPRY8TE0rr1nYe+PjPurfyLb+vQtjtlAur9ZCs1:j06cFDHcswnnYPLSyLndUHeMMJ
MD5:	FB782004A59BF05EDAFEEE9CEB1AB567
SHA1:	0DDF1D5026BCAC265294F2BA111A85A3B01A7BE4
SHA-256:	6E82E523B5CEC089A9C660B9BD73FC235CC2001D3E0689DB8D637F5455CA8F66
SHA-512:	943C418A7B0C1ACA75C68689E53B53400ADEBDC1544127BD58463CBB17366C66C12ED618D4F5A67A5C15AB9A7C57EADC3CC10FEEC2A797976C69F0FD821C605F
Malicious:	false
Preview:	0.0@..*.H........010.0-...1.0...+......0.....+.....7......0...0...+.....7.......b..sM.b.....8..130122131327Z0...+.....7.....0...0....R0.5.6.3.9.9.F.A.A.C.B.9.F.C.4.9.F.3.C.F.7.8.B.F.C.3.D.9.F.2.F.4.6.3.E.5.0.1.2.E...1...0R..+.....7...1D0B...F.i.l.e.......0w.d.f.c.o.i.n.s.t.a.l.l.e.r.0.1.0.0.9...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........c.....I..x.....c...0....R0.7.6.B.6.4.E.F.3.2.1.0.F.7.5.E.E.2.8.8.3.5.2.7.8.E.6.9.0.A.2.B.1.6.C.4.D.6.4.0...1..s0<..+.....7...1.0,...F.i.l.e........s.i.l.a.b.e.n.m...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0i..+.....7...1[0Y04..+.....7.

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\slabvcp.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5992
Entropy (8bit):	5.5835373281452805
Encrypted:	false
SSDEEP:	96:KOvOAUHaqX2eMhdhpTCs1ojH4SvDivhacp1t1h0tHXBZYKLcJ0zx:XOAUHaq2eMhdhpTCsuz4SvDivhacpH1+
MD5:	6FA46FEDF1CBE21B587F21286466D8A6
SHA1:	39A9B9E3887960581A5F3E4DAA497F9111B7F74A
SHA-256:	32B8BDF3D6D7907AEC9FBA68B94BEF31FF5EB0597EB73C9B4FFE59B4B3CDAD69
SHA-512:	F003DDDC786885CF42D840840465D37EDE2506CD3BBDC68D7AD10B331F0F0DACDB8529043BCC0043A2632006BADD546E62CFB4CC9FE798013358603C92A7ECE3
Malicious:	false
Preview:	;/++..;..;Module Name:..;..; slabvcp.INF..;..; Copyright 2012, Silicon Laboratories..;..;Abstract:..; Installation INF for Silicon Laboratories CP210x device using KDMF Version 1.9..;..;--/....[Version]..Signature="$WINDOWS NT$"..Class=Ports..ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}..Provider=%Provider%..DriverVer=12/10/2012,6.6.1.0..CatalogFile=slabvcp.cat......; ================= Device section =====================....[Manufacturer]..%MfgName%=SiLabs, NTamd64....[SiLabs]..%USB\VID_10C4&PID_EA60.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA60..%USB\VID_10C4&PID_EA70&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_00..%USB\VID_10C4&PID_EA70&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_01..%USB\VID_10C4&PID_EA71&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_00..%USB\VID_10C4&PID_EA71&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_01..%USB\VID_10C4&PID_EA71&Mi_02.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_02..%USB\VID_

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\WdfCoInstaller01009.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1721576
Entropy (8bit):	7.978334410477683
Encrypted:	false
SSDEEP:	24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
MD5:	4DA5DA193E0E4F86F6F8FD43EF25329A
SHA1:	68A44D37FF535A2C454F2440E1429833A1C6D810
SHA-256:	18487B4FF94EDCCC98ED59D9FCA662D4A1331C5F1E14DF8DB3093256DD9F1C3E
SHA-512:	B3D73ED5E45D6F2908B2F3086390DD28C1631E298756CEE9BDF26B185F0B77D1B8C03AD55E0495DBA982C5BED4A03337B130C76F7112F3E19821127D2CF36853
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: SecuriteInfo.com.Program.RemoteAdminNET.1.22990.5900.msi, Detection: malicious, Browse Filename: InstallDriver.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Program.RemoteAdminNET.1.7216.330.msi, Detection: malicious, Browse Filename: SecuriteInfo.com.Program.RemoteAdminNET.1.1711.8851.msi, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: PL23XX-M_LogoDriver_Setup_408_20220725.exe, Detection: malicious, Browse Filename: PL23XX-M_LogoDriver_Setup_408_20220725.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Trojan.Agent.M47LP3.18905.20801.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Trojan.Agent.M47LP3.18905.20801.exe, Detection: malicious, Browse Filename: SidecarASICIDESetup.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.v...%...%...%.m+%...%.m:%...%...% ..%.m-%...%.m=%...%.m,%...%.m7%...%...%...%.m%...%.m/%...%Rich...%........................PE..d.....[J.........." .........0............................................................@.........................................`................p..l!...`..,....,...............................................................................................text...L........................... ..`.data....J..........................@....pdata..,....`......................@..@.rsrc...l!...p..."..................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabenm.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27336
Entropy (8bit):	6.172214959675352
Encrypted:	false
SSDEEP:	384:n6oIhnyUR2OZRy0m1KOd/V3nL7fVRQlQeddvuVyxxTWBU/TJ1mTbCemE:fIZygU31Kw/V3L7f4esv2+/TbobCM
MD5:	7799106FEE728B907A86D9C9751E02D5
SHA1:	F35320E535159D43B598C7C11684DB05BE4196A6
SHA-256:	EE85E8D3CF3819DB28221BFC103DE8DF0E14E1878CECF54E8CD8C161B0E0AF3C
SHA-512:	F91AF958ADF1B808FC6C30AA7FE9C6CF8C5C2A041327693403D9A12A06E7C5084D203433BA2D0917A3FC1A064626BCE89526C5FB4B951F0A4AA07E84D237A99C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: tconnect_HCP_Software_v301_Installer.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."..eL.eL.eL.eM.eL...7.eL...1.eL....eL....eL...!.eL....eL....eL....eL.Rich.eL.........................PE..d......K.........."......J..........................................................$...........................................................(............P.......\...............1...............................................0...............................text...f........................... ..h.rdata..t....0......................@..H.data........@......................@....pdata.......P....... ..............@..HPAGE....M....`.......".............. ..`PAGESENM.............<.............. ..`INIT....d............P.............. ....rsrc................X..............@..B........................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabser.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73216
Entropy (8bit):	6.104930566748915
Encrypted:	false
SSDEEP:	1536:0ZsxDp0cAS3xTZDPU+dlLxAoO4lx/CGxMP4TNYyTPfBi3ItZRmU2Eo+u:/xDScAGTFcWQGx/CGxMP4TNYyTPfBi4g
MD5:	447209C314E6E0D26E01962075802B18
SHA1:	DD8AF2E3AA38D2D6971568EBF2CF41848E0091F5
SHA-256:	AB1AC5854EB0EDF66025609CF9CB5639014C264327F4DEE1223BF7F6E1BD2D15
SHA-512:	E2F8470C31496D1547CF930DD32805407722F81F6846E4257BF28CE37BF635F8EDA07A19E99FCBE10AAD939E7912FED4ABA098B58CCCC66217F2965BF4D10C73
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........H...H...H...A.Y.K...A.Z.K...A.V.K...A.M.J...H...Q...>...K...>...I...A.].E...A.K.J...>...I...A.W.[...A.J.I...A.O.I...RichH...........PE..d...p..P.........."..........*.....................................................R.......................................................$v..<...............................8....................................................................................text............................... ..h.rdata..<...........................@..H.data...T...........................@....pdata..............................@..HPAGESRP0c9.......:.................. ..`PAGE....~....P...................... ..`PAGESER......`...................... ..`INIT.........p...................... ....rsrc...............................@..B.reloc..............................@..B........................................................................

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\WdfCoInstaller01009.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1461992
Entropy (8bit):	7.976326629681077
Encrypted:	false
SSDEEP:	24576:GjG90oN2lj11mk/22yYzGrarZRm4X5Uh6rVh5LdfBwOyCSQM1fFhSWRA2+:iGtN2h1120R7m4XShYVxfBwrC21fXSz
MD5:	A9970042BE512C7981B36E689C5F3F9F
SHA1:	B0BA0DE22ADE0EE5324EAA82E179F41D2C67B63E
SHA-256:	7A6BF1F950684381205C717A51AF2D9C81B203CB1F3DB0006A4602E2DF675C77
SHA-512:	8377049F0AAEF7FFCB86D40E22CE8AA16E24CAD78DA1FB9B24EDFBC7561E3D4FD220D19414FA06964692C54E5CBC47EC87B1F3E2E63440C6986CB985A65CE27D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.B...B...B...Kd1.E...B.......Kd7.Q...Kd .M...Kd6.C...Kd'.....e...C...Kd0.C...Kd5.C...RichB...........PE..L.....[J...........!.........N......C................................................S....@..........................................P...<...........6..................................................@............................................text............................... ..`.data....G..........................@....rsrc....<...P...>..................@..@.reloc...............*..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabenm.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	47176
Entropy (8bit):	6.438481556176545
Encrypted:	false
SSDEEP:	768:43jIG9nfU9USVPRaQT78wiYwMSxidYBb3obCv:YjIonWVPAvYzQx3cCv
MD5:	3EAD8E1668CE42A0AFE41D56E7157BCF
SHA1:	C164EE1014A9D64BEFCDB46AB4B1C67C1F23E47B
SHA-256:	90A1AA6372356046B28C079954458F42849779FFC48C93AF0549A7673B276EB3
SHA-512:	5E4E844D809E0D344EC3AAE456F9C0C0DFC89F7BA1D328AFC42FE474FDD57A8F156CCE8B269A125D113E3EEA660A693406BDD15EB1B0C00E3ABB20A192FA73F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................c.s.'...'...'...'........@."......-......&......&...Rich'...........................PE..L...Z..K.....................................).......................................X.........................................<....................................*...............................................)...............................text....#.......$.................. ..h.rdata.......).......)..............@..H.data... ....+.......+..............@...PAGE.....C...+...D...+..........

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabser.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63104
Entropy (8bit):	6.313958488927774
Encrypted:	false
SSDEEP:	1536:4CVK1U5FkvcfL+MexwdFzTRIkwbzNQfqahBv6E5uzAZFzad4:4CIu5tfLfFzTRIkwbzNQfqahBv6E5VD
MD5:	688F8D8A147F04169139A681A1AA0035
SHA1:	5D05647EBD0052433CB4574F5EC614E404F71314
SHA-256:	4857A353D5A3A390A134999268CF05F09C82E5E881822A43984F8BC74E7D00B1
SHA-512:	DD22AB8F0A5AD168F281DF8FE80E25E9F827B8AB8A5071E1568BB788F36A25488FF9E2839E4E1ADC28B9AFF181D1AE1A3B1D95448D289851D75EFB25F2512DD6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................wS...=...=...=..n....=..n....=..n....=...<...=.$.`...=.$.b...=..n....=..n....=..n....=.Rich..=.........................PE..L...\..P.....................#.......h...............................................`......................................h...<...............................$.......................................@...............t............................text............................... ..h.rdata..............................@..H.data...............................@...

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\BugReportCreator.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	57136
Entropy (8bit):	6.106593239716126
Encrypted:	false
SSDEEP:	768:y/H6w6hojTHPgIF//KY7P+6T8YymJBvBtuTVO5fZLIILmyE:y/6w6ijcG/iY7P+6TemXvbuTVOVZHaT
MD5:	E4F6DBE53E41F5CAA6A14D2195AC8615
SHA1:	92CF88730ECF93B28229A1C6D93C104671D51745
SHA-256:	F43E792653AA0C2E7D10339B27404500E179E98DEEE1F77F2A0F7CA6983635DA
SHA-512:	188E36FDBF31C02513A06B283064252B126E52AEDC84F77254F17234DEFC24DC87465CDFA50DD14F9AB8857D00E033A2C62BB31ED0B7F46558F77105CC394EE9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..N................................. ........@.. ....................... ......8`....@.....................................O.......................0...........@................................................ ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H...........H-..........`/...j...........................................0............,...i......+....-}....r...po.........-.(....r...ps....o........r...po.........-.(....r...ps....o........r...po.........-.(....r...ps....o......(......(.....s....(.....*.(...........0..?........~.....(.........-".r...p.....(....o....s............~.....+....0...........~.....+.."........0...........(....r_..p~....o ....+.....0...........(....r{..p~....o ....+..*...0...........(....r...p~

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\ICSharpCode.SharpZipLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	208176
Entropy (8bit):	5.776120659374479
Encrypted:	false
SSDEEP:	3072:njMibqfQqFyGCDXiW9Pp/+Tl4abpuu201PB1BBXIDwtqSPVINrAfvp1f:IibqI59PpOPf201/z7pl
MD5:	1314A8767E8FFB6B4C96C2E0C608AFEB
SHA1:	A4D30B8C0BDFC57DF67210B2111710773247BF0F
SHA-256:	0447FCF60D40409C937C49ACB9327E95A1AD949BC7E8AF0CA4A699FC6A178EBC
SHA-512:	A477283C96E3E4E68A45C173CF59594831A3706A54279701811F4BCD5E18840041491E4F0E0DBC642C5DF98FB505D790CEA6DB15F94E19C292B18E46E4727049
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.K...........!......... ......^.... ........@.. .......................@............@.....................................K.......................0.... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\de\BugReportCreator.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22832
Entropy (8bit):	6.029904736265425
Encrypted:	false
SSDEEP:	384:svXoki96uoMK8Giw0oojB7HY//KY7P+6TbtQ3mirILmyLndUHeMOJ87:WojTH6//KY7P+6TBzIILmyS
MD5:	C9DDB475613AC1F348DA11580A7E3085
SHA1:	34FF9F9EB04A5625D1BAF2455F1D8399B785FD9C
SHA-256:	9202488D2E02F704F0161F08DE10C945EEAE1DB31A402E22DBFC6BFD4B712FBD
SHA-512:	5264279AB0EFA85C1A024672DBBAC346EED838F0A972D9E371D83103254377BA7734E57D3124C133A15F73D5CDFC3EDB9ABAB22947F2BF154501BFE5793C8443
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..N...........!.....2...........P... ...`....@.. ....................................@.................................XP..S....`..h............<..0............................................................ ............... ..H............text....0... ...2.................. ..`.rsrc...h....`.......4..............@..@.reloc...............:..............@..B.................P......H.......pL..............P ...,...........................................).............lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............fSystem.Drawing.Icon, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a.System.Windows.Forms.ImageListStreamer, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089hSys

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\ModbusLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.275542302419595
Encrypted:	false
SSDEEP:	768:jFRHaFqz1KmeCEMDhFf/iHCoNWfDX0q2LT7:jX1reCjDNoNWf4q2n7
MD5:	C03E258BC2D9F57DD886D3181F8709BA
SHA1:	1E387CFDC5F332DC6DAB5A25745B42842ECB2830
SHA-256:	32C58021CECEDA30BDCB118CBD72E3C07772A51B7E13F6EB9FFFF6A9B155B55F
SHA-512:	A92550DB4FBCFCF30C0CA75BE824206CF9BB0BB5765803B7D55FB934BD6DFCEE2F6B60C6854DF9469761BF96129F74F80900027F2A3C28470CD83E6B5DB57D4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....fU...........!.....p... ......>.... ........... ..............................U.....@....................................W.................................................................................... ............... ..H............text...De... ...p.................. ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PCID1081818.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6370816
Entropy (8bit):	6.6141899573075085
Encrypted:	false
SSDEEP:	49152:pdOH6S0FnI9jByugYmX3lLuXAYe47jfnZ:P26S0FnINKX3lZY
MD5:	70EC0E7E43E2CD1BB00CFD7A383FF890
SHA1:	21B2BF3531CAD7267070FDE18CAB574459690010
SHA-256:	650907B817DC2FC92FA608A495B2C1A38A5E5BF792BCF4A51384AEA9EADD4591
SHA-512:	612E66997CE785374051E06B1D8133FC521838D8513532D3EC13C0082070A9A0208DEED7068BF7702FC8895F2726C98872DD65373305991154EEE14D3DBCF728
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O._.........." ..0..,a.........nFa.. ...`a...... ........................a...........@..................................Fa.O....`a.x.....................a......Da.............................................. ............... ..H............text....a.. ...,a................. ..`.rsrc...x....`a.......a.............@..@.reloc........a......4a.............@..B................PFa.....H........6..t_..............X.U..........................................0..L......... ......+8.....+(.._n...._...._cj....d.a.+...d...b....X.....2...X...2...a.0.......... ..D!....i(.........(,.....{...."..}......{...."..}....~.r...p(-...}......;}.....(,.....(......}........{....s....}......0..H........{....-...{......{....s....}........(....-.....(.......(.....{....o/...&...(.......0..^.............+6.-.s0....+...{....o1...&.,...o2...-.....o3...&..X...X...{....o4.

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PhoenixResourceManager.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.712980199848379
Encrypted:	false
SSDEEP:	192:Zqn5dCWmuJoLRd+X/wVdUPV0vOV6sPs4:Zq5kWmuJ8QX/wVdUOvqJb
MD5:	28F339164749C81FA8F33C5DE72FA316
SHA1:	ADC457E581AE811C1F9F073F2BDD510D093623CC
SHA-256:	BB223255FE4274A1FB5B6786DA1DB6EA8490287BB923A9ECA1CA7695D07B5A9F
SHA-512:	807EF8A9161C539D6B3BE9613C42F77F0114903B036AE6181B7F0757D8C4FA9EFCFF3D2613CAABBDC28BC3F303F9F9890DE614C557E494C8DE68CF15BE48FC90
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....T^].........." ..0.............~;... ...@....... ....................................@.................................,;..O....@..h....................`.......9............................................... ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`.......$..............@..B................`;......H........#..T.............................................................{...."..}....>..(......(........0................(....(......u....,..t.....o.....u....,).t.......(....o....o....t......,<..o......(....o....o....(....-..t".....(....o....o....o......(.....~...........j~..........%...(....t......(....~..........%...(....t....z~..........%...%...(....t.....~..........%...%...%...(....t.....~......o....r...p(....-.......(....o....,.......*r_..ps....z..0......

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\de\PCID1081818.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1867776
Entropy (8bit):	5.1523373443047635
Encrypted:	false
SSDEEP:	12288:fGpXa7SSJ3ph2lEEoofddsddd61168EEo5EzhfPW98tvOOtEEEosEzlKOh6OOtwC:fGKph2tfddsdddlEzhX6REzlJh
MD5:	056059639E9B75500B18C7A2111FC8D8
SHA1:	6E837B5E28ABD5CE244A52F4475F7F15B77D3A18
SHA-256:	732924973DA71BC926326D31DA8AFEA26AC399F7063B6D73E4712CBD4E716C9A
SHA-512:	D14EDE60208901FD5CACF30A71BB1443AB967363D3D4D0D63DDA146846C534AA861DBC68DBC5A08CDBA89D1568ED3B9CAEB9BB9C8F1D75A2BBB719B197AFB0B6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O._...........!.....P... .......c... ........@.. ....................................@..................................b..O.......p............................................................................ ............... ..H............text...4C... ...P.................. ..`.rsrc...p............`..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\modbconf.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.631581329956364
Encrypted:	false
SSDEEP:	3:U246mWFsG8+iYh/HYYL85tq9qYL8n6y31Y3VO:naN+iYJ4YA5tBYAn6yMVO
MD5:	3E5418C4E7E9DC9ACFE71127B455B084
SHA1:	8B1C6B323943D834706D029EFA829BD44DD74CBE
SHA-256:	15C3B96F195AF135766F99C55A5C4B79BD64EB42D21B5F1FFA2D8816E97B5F8D
SHA-512:	D1972A02B83085174A9D08328D0284665A97FA56D5DCDE70DD8B5F9B49590F2D88E148CB578C2D5D9805BA6FC441EAA1260517CC951C67883DED3E8B254269CF
Malicious:	false
Preview:	.<MODBUS_LIB_CONFIG TIME_OUT_CONFIG="2400" TIME_OUT_SEARCH="400" TIME_OUT_READ_WRITE="800" />

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Device\psiprog-1.57.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	188752
Entropy (8bit):	6.840116845482589
Encrypted:	false
SSDEEP:	3072:eUnvhnVUrdCVEj6Ex6ldmxo5cHy+5AcEz1Y5nsWH8fDyxxZaY3:eUnvhnVUrYVUFod+qxYxgfDyDYY3
MD5:	883FD5861FEFF333B5809ABBFEA98325
SHA1:	8B450839D343C261C61BB40041B80D96A42992E8
SHA-256:	7C2B9448886AB046C1A7536D8A5167FCE932CDED7C236D2F4D8C36618438ED06
SHA-512:	510941236253193AFE1597F5F2ADF91C8F8D91E33AE10F6877EC9C07B6F332E93B82D87198B5160F6E1918F58ADD559617A894BFB22FF927359E2B6ED57D9E77
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....>.y..........................................@..........................P................... ................... ..........x....@.............. ...0....0......................................................................................CODE................................ ..`DATA................................@....tls................................@....rdata..............................@..P.idata..............................@....edata....... ......................@..@.reloc.......0......................@..P.rsrc........@......................@....debug.......P......................@..P........................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Telit\Xfp1.9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	715568
Entropy (8bit):	6.5906902866846
Encrypted:	false
SSDEEP:	12288:PXhlNCHMEDzl4Acz10UitruYEb9e2HIX4yRudy+EyZGblod98KBHZr:PXhlNo1Lcz1039mb42oXQNEQzHZr
MD5:	05408F7E07C30618E6D8173D10F8323D
SHA1:	0D52BD8572ADAFE06BB6D050C30DFB08561F0501
SHA-256:	69F7701F54BBEF76830BEF6AEFCB8AB3B5ABD900D182C720E3FCA0E087A4F0A1
SHA-512:	BAF2057E4500801C03B1DA55C8A9A9C088A1B32BBA8CDE1B19276D0104B87B9AE74036299C62C014C94423057A47CA10EB4577F4D126511D5BC8B8FBB3F009F6
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Telit\Xfp1.9.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....OwH..................................... ....@..........................p......8............ ...................@..:.......v(...P...b..............0............................................................................................text............................... ..`.data........ ......................@....tls................................@....rdata..............................@..P.idata...0.......*..................@..@.edata.......@......................@..@

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Telit\streamGE864_7_02_005.BIN

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	data
Category:	dropped
Size (bytes):	3593695
Entropy (8bit):	7.999944535258576
Encrypted:	true
SSDEEP:	49152:Wk27I/NDLqSgUB5bD+zUAzkrsVvSS5aRw/hNld8Cm8PoHoNyIpw7z4IhnEggrDK6:Wj7M3go5bDLHspRlN78C1AzHJgx
MD5:	20D70503DCF8E01BD22E41B75B21C005
SHA1:	22FEEF11FC5F1165DB0515E19DC96F615DA89877
SHA-256:	9601CB4FD128C780A5F9BF7A7C43939E096B42240A899BF4A365A845A2062262
SHA-512:	5DA0A8AA38EF66828307B8DA14AC38192A2FE4D97BB11236200E4152B9E6EBCDF62F3490C0129469636B4CAB1465334570B91FA755958C2A00925844726578AA
Malicious:	false
Preview:	N.07.02.005.5_S...................GE864..............................."#..N........&....p~....,..>......p..@.f...~..L...Z.........................i\|.f..?.F........../........................L..............................\......p.H`-.Ha-.Hb-........H.-.H.-.@.-...P.h.L.P......L...r(.=......aHc.................%"..h'b.u@..8........>.\.v...425..U8..04...Z..G9(.`.i.^7^.!.:.,D/...A"A.....K...^.'?.....5.Z.a....'..>...3X..x...x....#..s_qlH...w... .....w.4]....nq. n:......FW.n7._.t<M.YZ..f....:HXN...r.....J..7F.. ........Z.J.....g\q.q....B@.m..a/.5.Z.a..'..'..>...3X..x....`.].]vw.Y.BY....Z..n...'<..Z.n....:HX>.f..`.M.I.bw...73g...?.?..e.....Q.=..%L..........DC...yn.F..F....].."..(.(.2I.P.+.v.D..TI.Y:...9..x.q..\,.T...`EF..J.....'....C8a..(.`i.d.....DZ....9w...@~H..w....:...Y.-.......D.Z4.\|.yrJ..^..8.....*L..v.=.1QAw.$...x+..].........,..zW.9.....ZbT...:...9\.8P'...o\|...E9.....l...Z?&.......8.....$...,.p.v...#.s..7.;n.J....)..9d.H.].u.K.;.#.j......<

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\PCID2313106.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4122112
Entropy (8bit):	5.714854006834732
Encrypted:	false
SSDEEP:	24576:dA87L/CqFjsgshEof1V8fWkB0M3CHS53dA:SCPFjsd/f/FA3Cy53d
MD5:	D577FE84B84F269CF750A3BB2A4AC85E
SHA1:	A6B1A0240C381E5B6E8758F2954CC354A0BAE3D9
SHA-256:	DA50A780B955AACEBF173C323F746297892F34E4E4F045CDEE6D743058F4F234
SHA-512:	CEEB0F68CF286BD704E278F46A1F985129F091FBEB4B9E75E7874F4CFBA61E8BCE4C8A051D06DDE8C6229C66BEFCF54954092FA004052FF3DCCCF65147445DF3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...........!......>...........>.. ....?...@.. .......................@?...........@...................................>.O.....?.@.................... ?.....,.>.............................................. ............... ..H............text.....>.. ....>................. ..`.rsrc...@.....?.......>.............@..@.reloc....... ?.......>.............@..B..................>.....H.........:.<.................6.........................................z.,..{....,..{....o......(....*..0..W............(....s......s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....{....o.....(.....{.....o.....{.....o .....{....r...po!....{.....o"....{.....o#....{.....o$....{....r...po%....{.....o&....{.....o.....{.....o .....{....r...po!....{.....o'....{.....o#....{....r...po%....{.....o.....{.....o .....{....r7..po!....{...

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\de\PCID2313106.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1998848
Entropy (8bit):	4.70671621401254
Encrypted:	false
SSDEEP:	6144:SY8Hln7P/WJN24tIx/UxdxGcGxdxSx4axhx:2l7ne1uy7EZPsBD
MD5:	8DFF2A8BCB8B4A74C603F66D02DDC8D3
SHA1:	BF56500BB29D63C6856D467FFF01E67094881EEB
SHA-256:	BF311DA284E71F5B157301EB645639E4AE6A4F0D855E24228EEB08D42F82B68E
SHA-512:	5F014B263315F063E6B9616CE6E64EC88E772661371B968456F578A3659AF7E644ED1E740F5C4B693D9164BA75B24B9655A9F9B039F845F55F23B9167A9AF67D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...........!.....P... .......j... ........@.. ....................................@..................................j..W.......h............................................................................ ............... ..H............text....J... ...P.................. ..`.rsrc...h............`..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\zh-CHS\PCID2313106.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	3.7201770633561257
Encrypted:	false
SSDEEP:	384:StF2IDCLV7twca53RHywLERoRMa0YsP0p8Ks0RCJb2X:SeR7twV53RHywBMaxAKs0ubK
MD5:	CEF030652945394F5382839392AD5D34
SHA1:	A6C6F02724DA7595BAB9D908C38271E3C5518895
SHA-256:	AFA0114429F5DF7F0BF73980E7CC8ED4CFE95CBD0333EC89C4F14C88A6287AD8
SHA-512:	1BF01AEA9B4789F656C01056DEFD5AF8138BB68B35E88DB7DBECF538F07C0BCE315F0E3159F22BC1EC942403DEC74C4986965A3D6F7B5CF0A530EA2018488B18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...........!.....p... ........... ........@.. ....................................@.................................l...O.......h............................................................................ ............... ..H............text....d... ...p.................. ..`.rsrc...h...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\PCID2313449.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3382064
Entropy (8bit):	5.198973125993803
Encrypted:	false
SSDEEP:	12288:ud5cgunuvoKegbzhljwH2WZiqWQIRfVtHu2:s1unDgxljwH2WfWH/Hu2
MD5:	F2053141CE19750B692E3EE1007C9DC6
SHA1:	1E43C7E522EBC4C9114501D8E509DF4390FB37A4
SHA-256:	6512AF72A86A34FE82AEE5E18880691F2A0D1CC8B78AA73E14C9BD3AD64D60B3
SHA-512:	F8C3A0007B0DEB2DB83B2FCB209C12D17392CC1712BDCEDD1C2173F3891936BA1FA907C0D12C330C7051F67709BB7E63AEF1A45541899EBCA62269A8DDB2515E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..O...........!.....t3.........n.3.. ....3...@.. ........................3.....v.4...@................................. .3.K.....3.@............~3.0.....3.......3.............................................. ............... ..H............text...ts3.. ...t3................. ..`.rsrc...@.....3......v3.............@..@.reloc........3......\|3.............@..B................P.3.....H.........1..............W...S/.........................................b..{.....(....t....}....b..{.....(....t....}....b..{.....(....t....}....b..{.....(....t....}....b..{.....(....t....}....b..{.....(....t....}......{...."..}......{...."..}.....0..........s......{....,..{......o.....0..........s......{....,..{......o.....0..O.........R.{....,C..s......{....o.......+....t........o.....o....-...X....i2...o....R~.(.....(............s....(......( ...,..( .........

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\de\PCID2313449.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2006320
Entropy (8bit):	4.2767847468419
Encrypted:	false
SSDEEP:	6144:z2R832R822R8pbTrpFXus+AiRljqUD7cBOTFz7lcQxMuSKrcu:8WbzRljVXmGNSQu04u
MD5:	A22F9A164C518A0F7F659DD68482E7EA
SHA1:	67121BAD6AD6087FA5CA3EE7CA13C18554A1B2CD
SHA-256:	23409C497BD9382F498291A190AE42B7ACAFB5C39C2F4DA390BE56D1957F8CD5
SHA-512:	B4A89AC1EAC2BB5A5CE3374E173BF1CC6D9E989F086E4BAA5DB66C9B760A2392563D7C3968637AF2B80101730696D74C1588371098524104D2046CF437A87D76
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*..O...........!.....P... .......f... ........@.. ....................................@..................................f..W.......h...............0............................................................ ............... ..H............text....F... ...P.................. ..`.rsrc...h............`..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\zh-CHS\PCID2313449.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2485552
Entropy (8bit):	4.931020814552356
Encrypted:	false
SSDEEP:	6144:Yriw5R9us+AihljqspTr+j3yJmbrPbT2EdA42+92Av/Eqakgj76R8YR8QR8cr1:zbzhljT+D8eHCEOyoAv/pZgW1
MD5:	468187A010F3003D51A7915985E4D699
SHA1:	CA9844935929CB1C1514439ACD23F8CC92A1ADD4
SHA-256:	A044E0F94A630F31EFE1F31DD18BA64D96C67127C87188F6D7B92F99E0C2A124
SHA-512:	CBCD5EE871AA20404E1C3F3BB9725A54F383CE1B6849F2DA539ACB26AF8525551945E12CE69185C105F6A7C57F819D07D262B019AA7A41ADC016019D0E54C887
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*..O...........!......%.. .......%.. ....%...@.. ........................&......&...@...................................%.K.....%.h.............%.0.....%...................................................... ............... ..H............text....%.. ....%................. ..`.rsrc...h.....%.......%.............@..@.reloc........%.......%.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\PCID2313533.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3465216
Entropy (8bit):	5.2926799444531705
Encrypted:	false
SSDEEP:	24576:4DfaHa8aHawaFaKHULFqoCoHjs4agFZCB:5KCoY0FZCB
MD5:	4260AFED258C22C66164B0EEBB7ABA54
SHA1:	E98010B1F337025F09336A2540D31B2F166BB348
SHA-256:	011FA216BD89E45E839FBFAF70E33837EB92C898EE9BC75BB6806C0C4338869E
SHA-512:	3C30922DC5DCAFC91974296727C5F9B66319256DC866FE3E8CF2CA1B783D0DCB5339416F73BA9BB3BB0D77E284506519B8DB82155CE2F6C36F9BC61997A9D3D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Q...........!......4...........4.. ....5...@.. .......................@5...........@...................................4.K.....5.@.................... 5..... .4.............................................. ............... ..H............text.....4.. ....4................. ..`.rsrc...@.....5.......4.............@..@.reloc....... 5.......4.............@..B..................4.....H.........2.x............p....0.........................................b..{.....(....t2...}....b..{.....(....t2...}....b..{.....(....t3...}....b..{.....(....t3...}....b..{.....(....t4...}....b..{.....(....t4...}......{...."..}......{...."..}.....0..........s......{....,..{......o.....0..........s......{....,..{......o.....0..O.........R.{....,C..s......{....o.......+....t2.......o.....o....-...X....i2...o....R~.(.....(............s....(......( ...,..( .........

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\de\PCID2313533.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2019328
Entropy (8bit):	4.335838247882912
Encrypted:	false
SSDEEP:	6144:eHlssrpqV+m423b/hizSPXAT0XU0d9IaWIaWIaWIavIaWIaoHlL:eHlj+bzL5qYWb7azazazagazaoHlL
MD5:	9B7AA089F3B887852B8E06661E851294
SHA1:	3DEA89A341FBDD72BECFCBDC51621A2A37F6137F
SHA-256:	3D83E371FF698D3275DE82606F56351B98B8140768666A51D27AC7A2BDF7525F
SHA-512:	005D8D72ACEAE604963D43B0E3817A3069D57BFAD93B33B1E29465E98285B9B97BC96AD790F1AF3AF14CBE9E61FDB62376DF472DF23D2469FA18491B3B99CA94
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Q...........!......... ......>.... ........@.. ....................................@....................................O.......h............................................................................ ............... ..H............text...D.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\zh-CHS\PCID2313533.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2514944
Entropy (8bit):	4.986412390991334
Encrypted:	false
SSDEEP:	12288:dLHl4+CbLFqYWJELsnai/DaYa7aYaEaeaHHl:5HbCbLFq/LaYa7aYaEaeaHH
MD5:	8E3AC961B052ABA76C8718E2BC61978F
SHA1:	9D3561C6FD301543AA724595A7F7397ACDFFCB60
SHA-256:	A1BFEE76B231F6DEA2F1D6644431B60B08D987BFC1EEC32558557420D46BF10E
SHA-512:	E8B8B9C0EF3A546C32743A5D0051FB2C3412ACF7744498C0DB0A128A2D29DA7A4CE0D06501C79EAACA0E430103F69788D9D37586045516CE34D655A5A427D9DB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Q...........!.....0&.. .......H&.. ...`&...@.. ........................&...........@..................................H&.S....`&.h.....................&...................................................... ............... ..H............text....)&.. ...0&................. ..`.rsrc...h....`&......@&.............@..@.reloc........&......P&.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\FactoryDefinedConnectionSets.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3413
Entropy (8bit):	5.168769933988629
Encrypted:	false
SSDEEP:	48:3pIBAjE2Mu8h1ftlbocia+y7fjuWNQdfjoNoCWdZdfjuIzMbdfjumjK7fjuCrydn:e+VKFUlOfgfs+D9fXzkfT6fRIf1fgg
MD5:	7D9975EF372241357C97C5E8D76F464E
SHA1:	A4B84F3FCE42EBEBD736E9ABEDA8F2EDBAFB3BB5
SHA-256:	7067D2EF52DD753D22166C156B7E52521881F32BD75C5F4ED2722C3B84E1B4B3
SHA-512:	2E7A725C899B830B8A8DB1823A456258AC6F0CE8404B2F2265A2F063712423639BA9129EEAF59683BA8E777CEA058EB122CF3EF81FEE9869864544E0B36CFF29
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. This file is used by the program "Serial Interface Configurator". -->.. It containes communication connectionprofiles for the serial interface. -->.. The following options are valid: -->.. Interface: 0=RS-232, 1=RS-422, 2=RS-485 -->.. Baudrate: 0=300, 1=1200, 2=2400, 3=4800, 4=7200, 5=9600, 6=19200, 7=31250, 8=38400, 9=57600, 10=75000, 11=93750, 12=115200, 13=136000, 14=187500 -->.. Databits: 0=7, 1=8 -->.. Parity: 0=None, 1=Odd, 2=Even -->.. Stopbits: 0=1, 1=2 -->.. Handshake: 0=Hardware (RTS/CTS), 1=None -->.. LinkPolicy: The default LinkPolicy is 0,0. This option is only used for point to point connections.-->.. The '+' character marks that this parameter can be modified by the user. It must always be the first character.-->.. Important: The parameters are always separated by a ','. -->..<ConnectionSettings>.. <Set1 Setname="Userdefined">.. <Interface>+,0,1,2</Interface>.. <Baudrate>+,

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\PCID2313559.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6659584
Entropy (8bit):	5.285907004754053
Encrypted:	false
SSDEEP:	24576:S588m4T/BEfv6vtx7l6rKmDPqaz0hGENta7nUGEa2Lz/8Z5/+tNfHU3d:S588mNrl28MNt2AH/8Z5/uNfHU3
MD5:	A033DB08E4147AB9C34F4A81F1A61436
SHA1:	E3292BA89714250C3903F2A9E6D84B7A128E906F
SHA-256:	0F40A78C97E542ACD797D362B78BE485AEFC459C67D1BA5054EC1DF048FCC1C0
SHA-512:	3162BA2CFA30E0D54120FFC3E028DD98792D586EBA1C6842C11F73A1281635B119FB063AEDCB955DF7476E344EE847B91BEEF165E7F09945480446B288B76265
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..T...........!......e..........e.. ....e...@.. ........................f...........@...................................e.O.....e.@.....................e.......e.............................................. ............... ..H............text....e.. ....e................. ..`.rsrc...@.....e.......e.............@..@.reloc........e.......e.............@..B..................e.....H.......DGa..k..........h....Y.........................................z.,..{....,..{....o......(......0...........(....."...@"..PAs....(......(..... .... .... ....(....o..... .... ....s....o ....r...p(!.... .... ....s....("...........s#...($...........s#...(%.....(&...b..{.....('...tB...}....b..{.....((...tB...}....b..{.....('...tC...}....b..{.....((...tC...}....b..{.....('...tD...}....b..{.....((...tD...}......{...."..}......{...."..}........0..........s).....{

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\de\PCID2313559.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3534848
Entropy (8bit):	3.6191415691043103
Encrypted:	false
SSDEEP:	6144:d6XIPyTWY+XylFqijuPF3/9p4MQmHRS+xHwbLjidNeWC442aBClLNFi6m48P2QIi:QIPyyYtIijuPFvHvXxLl62L
MD5:	5006B76FB41605DB287BFB21D442D263
SHA1:	FE73EF2297541173B62D6F15A37F0005E81FDB5A
SHA-256:	9BC5B119DA42F1738398A96D8C9CD21E70DF17615978194E02D3F6812D4984A3
SHA-512:	33FDAC1CD7012B03197B531D070B26C7F153B6C2158311FF03A6B14833DCCD77F077C14971DD9DE73C77E09B74DDB757FFB4BE006DAA8E9B88B2E8348CDD6B1C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P..T...........!......5.. ......^.5.. ....5...@.. ....................... 6...........@...................................5.W.....5.h.....................6...................................................... ............... ..H............text...d.5.. ....5................. ..`.rsrc...h.....5.......5.............@..@.reloc........6.......5.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\zh-CHS\PCID2313559.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4882432
Entropy (8bit):	4.646420258084772
Encrypted:	false
SSDEEP:	12288:1SbH/kZj/A2cv6vtx7l6yliv/3D3H4o8HUMd43:ggoLv6vtx7l6ys/3D3Y3E
MD5:	B974D415F0347DC692C0730085320177
SHA1:	4624E861E27A0CE93EC7D22A09D94F2D6102EDDE
SHA-256:	8B0699F868A610248A4DAEBEA60CD179B7BF640A56EE6DB37AC1FD5014C160CC
SHA-512:	AB629461C6CA75B46DC1BD963FE8A1ACD493BC47C6E2713E5D348D1DFE574E4A47B46B1D7704F49CDB17D3BD7ED58477BDFD83B5FF44AE02CCE466CACC840E98
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P..T...........!.....PJ.. .......jJ.. ....J...@.. ........................J...........@.................................xjJ.S.....J.h.....................J...................................................... ............... ..H............text....JJ.. ...PJ................. ..`.rsrc...h.....J......`J.............@..@.reloc........J......pJ.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\ICSharpCode.SharpZipLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	208176
Entropy (8bit):	5.776120659374479
Encrypted:	false
SSDEEP:	3072:njMibqfQqFyGCDXiW9Pp/+Tl4abpuu201PB1BBXIDwtqSPVINrAfvp1f:IibqI59PpOPf201/z7pl
MD5:	1314A8767E8FFB6B4C96C2E0C608AFEB
SHA1:	A4D30B8C0BDFC57DF67210B2111710773247BF0F
SHA-256:	0447FCF60D40409C937C49ACB9327E95A1AD949BC7E8AF0CA4A699FC6A178EBC
SHA-512:	A477283C96E3E4E68A45C173CF59594831A3706A54279701811F4BCD5E18840041491E4F0E0DBC642C5DF98FB505D790CEA6DB15F94E19C292B18E46E4727049
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.K...........!......... ......^.... ........@.. .......................@............@.....................................K.......................0.... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\PCID2313643.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6842880
Entropy (8bit):	5.709922741496236
Encrypted:	false
SSDEEP:	24576:6tP3QmSoRJ0HRkD2LurH3CR8ZjbmO6o7ptPoSE3jt17S0K+q2JjyIMxTX8WSmg9b:6tPAEv0urH3nuo1NVcNJeIeP
MD5:	676A4618AD188A26392A022D9AF5A829
SHA1:	60104036F71D9BB273DE34DFF675C1F6A086CCA9
SHA-256:	520A9E69807D59DBC5CB8BA30AA607D6042882F56792089AB849EC55D3DAB0B1
SHA-512:	F01D9E15808A2C9E62DEA094F529E99E7AD81D5CF9B90E9BB83607779CA52606F905097C1EE0E9CBFA4F7A9BD30C72EFAF6B214C73CE7A1DAD4D74A35E028AF2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;"._.........." ..0..`h.........z\|h.. ....h...... ........................h...........@.................................(\|h.O.....h.x.....................h......zh.............................................. ............... ..H............text...._h.. ...`h................. ..`.rsrc...x.....h......bh.............@..@.reloc........h......hh.............@..B................\\|h.....H.......$....Y...........U..(%Z...........................................{-.....{....V.(/.....}-.....}.......0..;........u......,/(0....{-....{-...o1...,.(2....{.....{....o3..... ... )UU.Z(0....{-...o4...X )UU.Z(2....{....o5...X.0...........r...p......%..{-....................-.q.............-.&.+.......o6....%..{.....................-.q.............-.&.+.......o6....(7.....{8.....{9...V.(/.....}8.....}9......0..;........u......,/(0....{8....{8...o1...,.(2....{9..

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\de\PCID2313643.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3158016
Entropy (8bit):	4.327398108672269
Encrypted:	false
SSDEEP:	12288:U7KvvQ8Q1Q77B2i5QJTcCxLOXCHrJTa1g9bo:DvQ/TcCtxTa1g9b
MD5:	8758318E6F42B9D275A0BCF0943DE84F
SHA1:	83D6BF7616C65F072946E5995B6900C05FD00CF9
SHA-256:	BFC253A44AE2415411874274C95B4846F40353F6D5A1DD5E8FED7427C6E8A15A
SHA-512:	784E31ECD0E64972E438C10CA0E09A69C7EFD2907125B4C32AEDC9EFA0EFEA4465FCB7B4297C5E35CB6129E24A5F06807C966F8D9596C7FBF65D30477733BB4C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;"._...........!......0.. ........0.. ... 0...@.. .......................`0...........@...................................0.K.... 0.p....................@0...................................................... ............... ..H............text...4./.. ....0................. ..`.rsrc...p.... 0.......0.............@..@.reloc.......@0...... 0.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\zh-CHS\PCID2313643.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3031040
Entropy (8bit):	4.372872944994666
Encrypted:	false
SSDEEP:	6144:iifawHQQ5VNQQ5VNUOcVGxQQ5V/wU02uGoBOzybTiT:imfHQMQ6dQSBuGor3O
MD5:	9E781B282C40680CABF168564CFF73C8
SHA1:	2AB89DB7EFB49580662F009B1ABEFA39811E6907
SHA-256:	89B9D892C3E48D61744828BFCE79070D8F81EB39C0700252E73C91E3612C71F3
SHA-512:	4FD60850ACA63066C39F0209ACFED00AB684DA77C27309DF14C30AC11985395A0C4A149FCFF1709F1FF033C120B305530941B13EC7D6E625C15167A2E02058EC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;"._...........!......... .......&... ...@....@.. ....................................@..................................%..W....@..p....................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc...p....@....... ..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\GSD\PXC0A8C.gsd

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	51126
Entropy (8bit):	4.947118356776155
Encrypted:	false
SSDEEP:	384:7W7mkosYzWz3QWmWdct5pWIOwwBaM2PxjSYfR7Bv/DKJ7ZT+mkmL+8Wda:y7meJ7ZT+mOy
MD5:	9675018AE8DB7686A12D0E931B4BBC16
SHA1:	1BD060B59FA499E8842622327C1E5E097274719C
SHA-256:	B6C7259E11468A68EC84C103D420DE69406E857FB0CCE94179964BFBA7C8F177
SHA-512:	6D299D83B039A8D5E7E73452EDA8B0A5D5364A781EAE69E84E4EA6102E3A0983F80ECBAA54CF6925426C19D467D7D1D0F48F5E4E78654A1F208231C31051B080
Malicious:	false
Preview:	;************************************************************..; GSD-File for Phoenix Contact..; Article-Desc. : FLS PB M12 IOL4 M12..; Article-No. : 2736987..; Firmware-Release : 1.20..; GSD-Revision : 1.31..; Date : 01.11.2009..;**********************************************************..;************** Changes *********************************..; Date Change..; 01.11.2009 revised Release..;..; autor : Klaus We.ling Phoenixcontact Electronics GmbH..;..; change : "PD-PCP" -Modul now aviable from 4 to 16 words..; in steps by 2 words..;..; version advice : this GSD works with the Fimware-Release Versions..; 1.20, 1.21 and 1.22..; user advice : Call the service an support center for special moduls..; (AUTOMATIONWORX Hotline +49 5281 9462888)..;

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\GSD\PXC_00F0.gsd

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35715
Entropy (8bit):	5.274392598080157
Encrypted:	false
SSDEEP:	768:6ikhciUldEZT+m6AmEHADUVaayzK59M57DVWZfNXRvt3pjbfhPVfJvVf8i1d9NN2:6ikhciWdEZT+m6AmEHsNaUKXM57DVWZK
MD5:	5E63A298493635C5DCBE4972C02C53C4
SHA1:	BC11BDC8D9F24466C8359CE4069F6211765ACDB4
SHA-256:	C80C2707853B070EC716B3ACFFC3F646ABFCF0E54E37C1B6A8CF9502ED31164F
SHA-512:	EF46093F87D07583CC16E10D36D0BD310030379DD8A344C539B47928A5AD0634861EFB9EDB3BDA6AC4E07BEBB104D40E11724A71E9003ED61673F213A03D7745
Malicious:	false
Preview:	;************************************************************..; GSD-File for Phoenix Contact IL PB BK DP/V1..; Article-No. : 2718688 (usage with DIP8 = OFF)..; Hardware-Release : 02..; Firmware-Release : B (42 hex)..; GSD-Revision : 1.21..; Date : 04.05.2010..;**********************************************************..;************** Changes *********************************..; Date Change..; 11.07.2002 First Release..; 14.10.2002 New modules added..; 30.01.2003 New modules added, ID-Code fixed..; 18.07.2003 New modules & Option added..; 22.10.2003 New modules added..; 10.05.2004 New modules..; 03.05.2005 New Modules: TEMP 4/8 RTD, AO 4/8/U/BP, RS232-PRO..; packed 120 DI 1, packed DI 2-NPN, IL 332..; Parameters: Baudrate 45.45, MaxTsdr..; 25.05.2005 changed desription for RS...-PRO..; module consistency for AO 4/8, TEMP 4/8..; 02.06.2005 separate entries for TEMPCON 300 models..; 30.09.

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\GSD\PXC_0656.gsd

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3459
Entropy (8bit):	4.606240635756223
Encrypted:	false
SSDEEP:	96:HUD2Fo1FLRDAHo7QLksVK3+HZUAFt6lKe+H2BC+:HAd1FL9sVG+HZU0tg/+H2B9
MD5:	5AA9845D55B47B942A9B9D17CFD20DD6
SHA1:	D61D389BB4412212990FEA0E1BF6AD833B996C2F
SHA-256:	D1D80B570E56233BAA52FA01F06B6425A4C838EF8C7452912303E84E292EBF61
SHA-512:	B9C01436B5EBAB1675A44B688FE970673326E182647EA4F6FD0736366A2AB575C73902DECC77A30E55C9CF71BE085313670975B5C2AB5E25CBD6C4E2F43399D7
Malicious:	false
Preview:	;********************************************************..; GSD-File for Phoenix Contact PB IP 400 ME-ELR ..; Article-No. : 2734840/2734772..; Firmware-Release : 1.11..; GSD-File Revision : 1.22..; File : PXC_0656.GSD..; Date : 09.07.03 mb..;******************************************************..; HISTORY:..; Date Autor Changes..; 09.07.2003 MB update software release information ..;******************************************************..; ATTENTION: Changes in this file can cause configuration ..; or communicationproblems...;********************************************************....#PROFIBUS_DP....; Unit-Definition-List:..GSD_Revision = 2..Vendor_Name = "Phoenix Contact"..Model_Name = "PB IP400 ME-ELR"..Revision = "V1.00"..Ident_Number = 0x0656..Protocol_Ident = 0..Station_Type = 0..Hardware_Release = "Version P.100"..Software_Release = "Version 1.11"..I

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\GSD\PXC_066A.gsd

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4949
Entropy (8bit):	4.349685836523314
Encrypted:	false
SSDEEP:	48:sg463OYdPCmOUvYa+Z4pUZT+mdNFefYn/3qc4w8aEWvHeZ/zdXH:sg41mTB+Z1ZT+mdP/L4Y3+Z/pXH
MD5:	3A75E80627DD94D84BD25E708C71B50E
SHA1:	6C3C8F2B0B25E407BB6A6250A01D9EA534A9071C
SHA-256:	F95D7072AEEE104D925509FA47CD965A86BE3CD464B8489D1A45250425A40066
SHA-512:	1FC91BACAF5A0A002E11BFD3722AAED695B82001424CE728D31C3D3754AF4932CD36AB8939CD019CD6B8DB1BE42076D077AE5B425D66FD1AD88204249A5A5A28
Malicious:	false
Preview:	;************************************************************..; GSD-File for Phoenix Contact FLS PB M12 DIO4/4 M12-2A..; Article-No. : 2736107..; Hardware-Release : 03..; Firmware-Release : none..; GSD-Revision : 1.02..; Date : 03-03-2005..;**********************************************************..;************** Changes *******************************..; Date Change..; 25.07.2002 First Release..; 25.09.2002 Parameter checked..; 03.03.2005 profibus chip changed (VPCLS into LSPMS2)..;..;************************************************************....#Profibus_DP..GSD_REVISION = 2 ; version ID of the GSD file format..Vendor_Name = "Phoenix Contact" ; manufacturer name..Model_Name = "FLS PB M12 DIO 4/4 M12-2A" ; device name..Revision = "HW 03" ; device revision..Ident_Number = 0x066A ; product ID..Slave_Family = 3@Phoenix Contact@Fieldline ; devic

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\GSD\PXC_067F.gsd

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	13331
Entropy (8bit):	5.2415183150036855
Encrypted:	false
SSDEEP:	192:RKJwNIxFZzN+wfmxVlxQ5rXrkt8+L7/O/QZRJM2PxKa1Aqchab8OE:WiIxFZzN+wfmxVlxQ5bAXe/QZRJM2JKb
MD5:	0F71605945866FE4DB6C548234D5D1BB
SHA1:	945C618ACCC0D4908D1B0304719D7AF8268004FA
SHA-256:	8E9C8B8F0E8B945E5C15C80C40296D91154F0E06729314570A550B241220A89D
SHA-512:	21804872AD67670C76B4D8437F420C9CEB0A678C41DF34929D72BD94FFF6E3EB17D28FCB0EFD6FC0FBAEC58CE87F6C2EF464A3D9A01E58AF3D06AF5F75172E2D
Malicious:	false
Preview:	;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;..;;..;; GSD-File : ELR Gateway Profibus 067F..;;..;; Manufacturer : Phoenix Contact GmbH & Co..;;..;; Article-No. : 2963530..;;..;; Hardware-Release : 03..;;..;; Firmware-Release : 1.00..;;..;; GSD-Revision : 1.01 ..;;..;; Date : 17.10.05..;;..;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;....;;;;;;;;;;;;;;;;;;;;;;;;;;; History ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;..;;..;; Revision Change..;; ----------------------------------------------------------------------------..;; 1.00 - initial product release..;; 1.01..- default modul definition changed..;;..;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;....#Profibus_DP....;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;..;;..;; general parameters..;;......PrmText = 2.. Text(0) = "Ausg.nge werden zur.ckgesetzt"..

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\GSD\PXC_06BD.gsd

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4698
Entropy (8bit):	4.492617967519819
Encrypted:	false
SSDEEP:	48:TfAH3xbd/tnYeAaQD4dep4/ZT+mdpR2+hbD8FZ6hxgWffNYQNlM:k5tldm+ZT+mdZD8FkaWm
MD5:	90FA7A0D7B52DAB37621CEB104564A71
SHA1:	3F1276244858EE423A259BDE4CB207A4C94CA69E
SHA-256:	BB2DD7B2D8254A3F56AD4AB2C1B4B7017CBB6618893B42B113BFA534ABFBA893
SHA-512:	0C8A5F227939852C436CA3B9E9204CA9E1F6CD6FFFA673F507157FE15B40B5F5C06885BBFD45C87D24680BFF4F52CD487E3250DC939744B067146F41D82F6F40
Malicious:	false
Preview:	;************************************************************..; GSD-File for Phoenix Contact..;...; ILB PB 24 DI16 DO16..Order-No.: 2862411..; ILB PB 24 DI8 DIO8..Order-No.: 2863562 ..; ILB PB 24 DI32..Order-No.: 2862398 ..; ILB PB 24 DO32..Order-No.: 2862408 ..; ..; ..; Hardware-Release : 03..; Firmware-Release : none..; GSD-Revision : 1.04..; Date : 08.05.2008..;**********************************************************..;************** Changes *******************************..; Date .Change..; 05.08.2002.PreRelease..; 07.04.2003.Release version..; 22.03.2004.New device added, device response time..; 03.03.2005 Profibus Chip changed (VPCLS into LSPM2)..; 07.08.2008 device response time changed..;************************************************************....#Profibus_DP..GSD_REVISION = 2 ; version ID of the GSD file format..Vendor_Name = "Phoenix Contact"

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\GSD\PXC_06CC.gsd

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173063
Entropy (8bit):	5.290511614037097
Encrypted:	false
SSDEEP:	3072:KN24ti/WrR+x9a8duBvnOJhttxJNt5rWfpMI004agUutYmPuyGvuwO5VvDNfhPV/:oi/WrMx9a8duZOJhttxJNt5afpMI004D
MD5:	3079F51A039FAC7688291029E852FF0A
SHA1:	0D6F2EC22A73E1CBB0F1511C88E29FA65C9A49E9
SHA-256:	B336B36C44AF6B143BAB2CCC7A1C0D0FE5855D02DDDED7CD38580E241FB33681
SHA-512:	24997A2FA793A6606E49F04A7919AEF3636FF5DD7B0F3671D858DFA13345D3D81041433282DBD0F7F2D1791813C21839A58CBD1FCD2057F727E2EDD9D59EADFC
Malicious:	false
Preview:	;************************************************************..; GSD-File for Phoenix Contact IL PB BK DP/V1..; Article-No. : 2718688 (usage with DIP8 = ON)..; Hardware-Release : 02..; Firmware-Release : B (42 hex)..; GSD-Revision : 1.28..; Date : 22.10.2010..;**********************************************************..;************** Changes *********************************..; Date Change..; 11.07.2002 First Release..; 14.10.2002 New modules added..; 23.01.2003 New modules added..; 30.01.2003 ID-Code fixed..; 18.07.2003 New modules & options..; 22.10.2003 New parameters for INC/SSI..; 10.05.2004 New modules & parameters..; 03.05.2005 New modules & parameters..; New Parameters for SSI-IN, IMPULSE-IN, EC AR..; New Modules: TEMP 4/8 RTD, AO 4/8/U/BP, RS232-PRO..; packed 120 DI 1, packed DI 2-NPN, IL 332..; Parameters: Baudrate 45.45, MaxTsdr, Fail_Safe,..; DPV1_Data_

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\GSD\PXC_06FD.gsd

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4947
Entropy (8bit):	4.325172997786582
Encrypted:	false
SSDEEP:	48:AqwMEIqNEOUvxa+K4pUZT+mdNFetQn/3qc4w8aEWvHeZ/zdXS:twvlqTE+K1ZT+md7/L4Y3+Z/pXS
MD5:	F3071E54B26E7529DD680D70C2512E94
SHA1:	A489765FBCECE1FA6A8666DF453134082C2C898A
SHA-256:	EFE14FE0A169B15ACE12E067E9102ECCD9B4FCB198E57085A9A649323A188E2D
SHA-512:	F38681E9079F5CECC8A9C977644A6EFEA5C66625CD0AE58D798560B42AEC4E3CB58FC3A061ED91B3DB119C2B25E2F91673F0CE52F407CECC95171C11B67FFA9E
Malicious:	false
Preview:	;************************************************************..; GSD-File for Phoenix Contact FLS PB M12 DIO8/8 M12..; Article-No. : 2736372..; Hardware-Release : 02..; Firmware-Release : none..; GSD-Revision : 1.01..; Date : 03-03-2005..;**********************************************************..;************** Changes *******************************..; Date Change..; 04.03.2003 First Release..; 25.04.2003 Parameter checked..; 03.03.2005 profibus chip changed (VPCLS into LSPM2)..;..;************************************************************....#Profibus_DP..GSD_REVISION = 2 ; version ID of the GSD file format..Vendor_Name = "Phoenix Contact" . ; manufacturer name..Model_Name = "FLS PB M12 DIO 8/8 M12" ; device name..Revision = "HW 02" ; device revision..Ident_Number = 0x06FD ; product ID..Slave_Family = 3@Phoenix Contact@Fieldline ; device family c

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\GSD\PXC_07E9.GSD

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	59188
Entropy (8bit):	5.274873808200923
Encrypted:	false
SSDEEP:	384:QGhFhiY6eQtUZT+mkQyYOtWYWWMPf7bSTXKJUrWdHbKRgfmV8VA0s00kM9rRSoGc:rFYY6eQtUZT+mlYWtk5NwuCvn0
MD5:	6E57FF371E272230F77D421EA06D15DF
SHA1:	D7D67DFD9D2CB8E894AD7FFA74510EF946951887
SHA-256:	07EED527422DE43FDD12126324CD8E92AC4E6E1819E5FC1CD85EF1A79DD88A9D
SHA-512:	193499876C2C4498FE0B2C1C8DC7AD082E72BD738AAFCD07D750057118D5B51025C1EE16CD19E337A79943262EEABD3E57B74F3FBAF8EC3919331AA93F0A80E9
Malicious:	false
Preview:	;************************************************************..; GSD-File for Phoenix Contact FLM BK PB M12 DI8 M12..; Article-No. : 2736330..; Hardware-Release : 02..; Firmware-Release : 1.03..; GSD-Revision : 1.16..; Date : 12.08.2009..;**********************************************************..;************** Changes *********************************..; Date Change..; 26.03.2004 First Release..; 21.04.2004 Added Diagnostic Info..; 11.06.2004 added modules and parameters..; 06.07.2004 parameters adapted..; 27.08.2004 parameters adapted..; 06.04.2005 new parameters, DIO 16/16 added..; 31.08.2005 FLM BT DIO 8/8 M12-P2P-SET added..; SlotDefinition instead of PresetModule..; 05.01.2006 M8 modules added..; 24.01.2006 Review & Release..; 12.04.2006 FLM BT BS 3 added..; 25.07.2006 FLM DI16 added..; FLM DIO8/8 added..; Max 16 modules (+ BK)..; 03.11.2006 FLM DIO8/8 revised..; 08.05.2007

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\GSD\PXC_096B.gsd

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	163995
Entropy (8bit):	5.2993350711471425
Encrypted:	false
SSDEEP:	3072:T0WIsfx9a8dQ9PI6aIUdtGn01z7tsQmvNUwdv2bl:T0WIKx9a8dQ9PI6aIUdtGn01z7tsQmv+
MD5:	44982A9CE2DF6D63DFDF8929DC6CBB03
SHA1:	E351F94588D99CF44A4369F89870F2D18CF9AB29
SHA-256:	F854C3C8D127C3C07F2C6229B19B8D36469A9F3759E9F907ABD6FA8EDB664350
SHA-512:	1794FF6AAFF788F991894878F6B4AE0738340A697427E818C23C74091B884E120025284423602D392A646FAF949D267813C3E532AC4C67BDB0EF8175E955FC8A
Malicious:	false
Preview:	;************************************************************..; GSD-File for Phoenix Contact IL PB BK DI8 DO4..; Article-No. : 2878926..; Hardware-Release : 02..; Firmware-Release : 1.02..; GSD-Revision : 1.21..; Date : 30.03.2010..;**********************************************************..;************** Changes *********************************..; Date Change..; 21.06.2005 First Release..; 28.06.2005 parameters adapted..; 29.06.2005 PD-PCP modules modified..; 16.01.2006 FLM M12 and M8 modules added..; 18.01.2006 FLM BT name and parameters adapted..; 24.01.2006 Review & Release..; 23.02.2006 SGI module added..; 07.04.2006 Add failsafe to IL motorstarter..; 11.04.2006 IL AI 4/EF module added..; 19.04.2006 FLM BT BS 3 added..; 26.04.2006 AI4 module parameters revised..; 23.05.2006 IB IL AO2/I/S7 added..; Modbus RTU/ASCII added to IB IL RS485..; 16.10.2006 IM support..; 27.10.2006 FLM DI16 M12 and FLM DI

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\GSD\PXC_196B_DPV0.gsd

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42148
Entropy (8bit):	5.314110746492594
Encrypted:	false
SSDEEP:	384:cFLB0UlDsEZT+mCXy3xST8xIt4DsEnVwj9EuFUVMHSKSz/o:cFB0UlDsEZT+mX6EuFUVLKh
MD5:	A44A350C5D7A7F76B826213DE131A34C
SHA1:	4526981F18F6F30CA1A5C45CFB2C16D90BCFEEB6
SHA-256:	7256C71DCD294B9968534AF43D7FF42B93D59E3E3550B8D65AAF36E96ABF8B96
SHA-512:	779C39080D506D291E33B1492C96DFA08F94D5A842403FB1614C3487F99CE4CB337ACFAB9EED6A1C02CFC54FE7720BF6ADFEC98CC7B85C0B11886E675F36EDB0
Malicious:	false
Preview:	;************************************************************..; GSD-File for Phoenix Contact IL PB BK DI8 DO4..; Article-No. : 2878926..; Hardware-Release : 02..; Firmware-Release : 1.02..; GSD-Revision : 1.18..; Date : 12.08.2009..;**********************************************************..;************** Changes *********************************..; Date Change..; 21.06.2005 First Release..; 28.06.2005 parameters adapted..; 29.06.2005 PD-PCP modules modified..; 16.01.2006 FLM M12 and M8 modules added..; 18.01.2006 FLM BT name and parameters adapted..; 24.01.2006 Review & Release..; 23.02.2006 SGI module added..; 07.04.2006 Add failsafe to IL motorstarter..; 11.04.2006 IL AI 4/EF module added..; 19.04.2006 FLM BT BS 3 added..; 26.04.2006 AI4 module parameters revised..; 23.05.2006 IB IL AO2/I/S7 added..; Modbus RTU/ASCII added to IB IL RS485..; 16.10.2006 IM support..; 27.10.2006 FLM DI16 M12 and FLM DI

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\GSD\Pxc_066b.gsd

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4754
Entropy (8bit):	4.298904852199056
Encrypted:	false
SSDEEP:	48:JXwivWOE9vOXi4znJ38elFe/3z1zXaEWvEeZVazdXX:JT+jaihz1O3hZ8pXX
MD5:	8C59693DEBABF35AE9E6514E67770BAB
SHA1:	C1F366A0EFDB4371C180463C357D6AE6E39363F4
SHA-256:	F8D7DF44D7E4D7189444796E6A829F97C7DE9BD917611B321D0167B563AF91B1
SHA-512:	6FF37C25E0F9AEA85B368F23A9F1F4E6FE5D9873C0A84E52E5E7D6EB94A92708FD282CC6AB17673ADEEF0B872500C05B064E02DE71051A4F879C474E548EF890
Malicious:	false
Preview:	;************************************************************..; GSD-File for Phoenix Contact FLS PB M12 DI8 M12..; Article-No. : 2736123-00..; Hardware-Release : 01..; Firmware-Release : 1.00..; GSD-Revision : 1.01..; Date : 25.09.2002..;**********************************************************..;************** Changes *******************************..; Date Change..; 25.07.2002 First Release..; 25.09.2002 Parameter checked..;..;************************************************************....#Profibus_DP..GSD_REVISION = 2 ; version ID of the GSD file format..Vendor_Name = "Phoenix Contact GmbH & Co." ; manufacturer name..Model_Name = "FLS PB M12 DI8 M12" ; device name..Revision = "V1.0" ; device revision..Ident_Number = 0x066B ; product ID..Slave_Family = 3@Phoenix Contact GmbH & Co KG@Fieldline ; device family class..Protocol_Ident = 0

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\GSD\Pxc_066c.gsd

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4953
Entropy (8bit):	4.316963095840369
Encrypted:	false
SSDEEP:	48:Pp6vSOHOUvPa+b4pUZT+mdNFep5lj/3qc4w3aEWvFeZ/kdXm:Pp4Ta+b1ZT+md4DL4P3YZ/eXm
MD5:	4B9083AA93F915307F3B3DC7D0B9B1C6
SHA1:	B354CDDD522B09CDE360B2CF6A34B4756316D475
SHA-256:	E2CDF8BA67635A7599715680A5A3F3DDD1D5849AD2E6E90F058B75E7ED9DCCFC
SHA-512:	47E57A64EDDB73748B08CBB65029CE5732193EE90CF2EAEF046100EE6A0D04786B32B8C8E4898B0C17B368ECC2731D165C8074C633F907FFC74A2A9C58C9DABD
Malicious:	false
Preview:	;************************************************************..; GSD-File for Phoenix Contact FLS PB M12 DO8 M12-2A..; Article-No. : 2736110..; Hardware-Release : 04..; Firmware-Release : none..; GSD-Revision : 1.02..; Date : 03-03-2005..;**********************************************************..;************** Changes *******************************..; Date Change..; 25.07.2002 First Release..; 25.09.2002 Parameter checked..; 03.03.2005 profibus chip changed (VPCLS into LSPM2)..;..;************************************************************....#Profibus_DP..GSD_REVISION = 2 ; version ID of the GSD file format..Vendor_Name = "Phoenix Contact" ; manufacturer name..Model_Name = "FLS PB M12 DO 8 M12-2A" ; device name..Revision = "HW 04" ; device revision..Ident_Number = 0x066C ; product ID..Slave_Family = 3@Phoenix Contact@Fieldline ; device fa

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\GSD\Pxc_06FB.gsd

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4847
Entropy (8bit):	4.323138878110891
Encrypted:	false
SSDEEP:	48:OWkpgOGOUvPa+b4OZT+mdTHu7q/V357zSAaEWvEeZVazdXK:Oz0Ta+bLZT+mdZB57a3hZ8pXK
MD5:	4F4101E8EFD619C0342F61433845AC0B
SHA1:	9F54605EDFD12F88F9F8EB97FC420B2AC40EED10
SHA-256:	199E2CABA09C6867AAB5C26F164D99A4283A652E3CD73DA0D0B0248846F53AE1
SHA-512:	052754FC7BAB0F735D1D71BB540BCE0F07CBD203BA88BDCFB6A479ACBFD9E6F81A5BEB2BA0AC90723EF6DDF6515768D7C477EB93E3573FEF38BB3F0F3A3E905A
Malicious:	false
Preview:	;************************************************************..; GSD-File for Phoenix Contact FLS PB M12 DI16 M12..; Article-No. : 2736220..; Hardware-Release : 04..; Firmware-Release : none..; GSD-Revision : 1.02..; Date : 11-10-2006..;**********************************************************..;************** Changes *******************************..; Date Change..; 28.08.2002 First Release..; 03.03.2005 profibus chip changed (VPCLS into LSPM2)..; 10.11.2006 Revision (presentation/File-Revision)..;..;************************************************************....#Profibus_DP..GSD_REVISION = 2 ; version ID of the GSD file format..Vendor_Name = "Phoenix Contact" ; manufacturer name..Model_Name = "FLS PB M12 DI 16 M12" ; device name..Revision = "HW 04" ; device revision..Ident_Number = 0x06FB ; product ID..Slave_Family = 3@Phoenix Contact@Fieldline

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\Help\SlottimeHelp_de.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	HTML document, ISO-8859 text, with very long lines (323), with CRLF, NEL line terminators
Category:	dropped
Size (bytes):	2699
Entropy (8bit):	5.175460125569093
Encrypted:	false
SSDEEP:	48:MqaCNSIUbxTILwvl7PhAZP6WpoAfzbA2LWcVDVezTAp2CViAEq5V1Ai:Mz9hl+wvl7J97KPLW2DfpWNah
MD5:	CA35C23E9C9AE5CB5BD5278842EE0FCD
SHA1:	9AD0F75EFA27F3D1A36A04527BEBFD0E61E09EB4
SHA-256:	24999F82CBB2677F698CC4B865E93568FBD07641D7C4F2354D60282E50A992BF
SHA-512:	FD3CFE82B9A0A1E49F41058606D14D2F6E0AB471599C96E008436D820A41BB0B909F0AF9E9949349DC13E27E242203A8519E8DADD2F38551440CA772B11A6D26
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".. "http://www.w3.org/TR/html4/loose.dtd">..<html>...<head>....<title>Slot-Zeit Konfiguration</title>...</head>...<body><font face=arial>....<table width="100%" border="0" cellpadding="0" cellspacing="0" >.....<tr >......<td colspan="3" height="33px" background="header.gif"><a href="http://www.phoenixcontact.com" target="_blank"><img src="logo.gif" hspace="19" align="middle" border="0" ></a></td>.....</tr>....</table>....<br><h2>Timing im PROFIBUS-Master anpassen</h2>....<br><h4>....Aufgrund der .bertragungsverz.gerung .ber die DSL-Strecke muss das PROFIBUS-Timing im PROFIBUS-Master angepasst werden.<br>....Die Anpassung ist hier am Beispiel des SIMATIC Manager, Version 5.x gezeigt.<br>....Sie finden die einzustellende Slot-Zeit in der PSI-CONF Software im Projekt-Assistent in Schritt 4 und in Schritt 7.</h4><br><br>....<table border="Dicke">.....<tr>......<th>Beschreibung</th>......<th>Screenshot</th>.....</tr>.....<tr

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\Help\SlottimeHelp_en.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2378
Entropy (8bit):	5.118612019371895
Encrypted:	false
SSDEEP:	48:Mq4CNSI6/EW5BEWLY8a/lTYVJfYNcfYM3VDfYnqYzJ9ojVmfY2C1EW2VFfYm:M99z/vzta/lTciqwJ2iC1O
MD5:	D1EBA4023A9B3BB7F9E6EACAF5641CF1
SHA1:	FCD341A17569C2EB60A36B80B68D3A81BED1F0BC
SHA-256:	6A255BE4D74A43FE58E12CD4320E0F0C31F52B00437761DF5D87D03F6A2FF3E6
SHA-512:	5D49956CD8FD4A34D0D29AC20C33EC8531DED3E552732EA28BCA5502072D883C0928931103CA17157B6E778D12F221F57C2C1694CDA0731022A6BDDC74C5A79E
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".. "http://www.w3.org/TR/html4/loose.dtd">..<html>...<head>....<title>Slot time configuration</title>...</head>...<body><font face=arial>....<table width="100%" border="0" cellpadding="0" cellspacing="0" >.....<tr >......<td colspan="3" height="33px" background="header.gif"><a href="http://www.phoenixcontact.com" target="_blank"><img src="logo.gif" hspace="19" align="middle" border="0" ></a></td>.....</tr>....</table>....<br><h2>Adjust timing in PROFIBUS master</h2>....<br><h4>....Owing to the transmission delay through the DSL installation, the PROFIBUS timing must be adjusted in the PROFIBUS master.<br>....This setting is shown here using the SIMATIC Manager, Version 5.x as an example.<br>....You can find the value for the slot time in the PSI-CONF software within the project wizard in step 4 and in step 7.</h4><br><br>....<table border="Dicke">.....<tr>......<th>Description</th>......<th>Screenshot</th>.....</tr>....

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\Help\header.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	GIF image data, version 89a, 430 x 57
Category:	dropped
Size (bytes):	3209
Entropy (8bit):	7.861452738042542
Encrypted:	false
SSDEEP:	96:WJcYbkPM3eQ0Vz6Mqjr/ZoC2Lr4IE8jSbUGSbSmR+:WQAr/ZoC2Lr3ebqbSmg
MD5:	D7744F15E8E4CC276C2357DE492622F8
SHA1:	868D9819894D1B7E89A990445ACDB019BCBFAFFD
SHA-256:	D696565F7571C276EF73681CEBB99EEAEA08C01CD6C7765228E9CF836CC26585
SHA-512:	00EA5FAE811CDEDEEDA1E06C628AC9F5EAC284D5CCBFA7BADFCBC2628009B95CB84FFFCE1B4EBCE11F5DFCFF289AA552B6A8136E9587FFCF7FCA744D9A64AF5F
Malicious:	false
Preview:	GIF89a..9....\|...G........._......V.....T.........>..................\|..h..@..r.....>..?........?...!.......,......9.....'.di.h..l.p,.tm.x..\|....pH,...r.l:..tJ.Z..v..z..xL...8.z..<`..`.`,...d..P.....t....s...-..\|l.....o/.rtv0z......p.t..,.......+......./..l.p.....y..k........'...........,.........+.............-.......... H3. ....5p.``...0..G.b...RP[.n..{,"H.....-...8(..Km....`.d.....(h..w.}.g.b..H7xP......q..j..S.$P...R.I...b...U.Z];.jZ.S..M...7.....pa)...~e...R.(S$h..[. Q@(PXp............M;.....$.......%... ..\...m..d......t...(..X[.v..w...M.......n83...O$...1].("........H....h.n..m.A.....{.]..g_)......._}i5.......k.b.!{H.0P\|..G.]'D`.`.fA)....~....[.Y%!...e.`..0.o.Mw.t...i%.7...m.....m..&.z%..d..T`....(Z~/.(.h..5..........b-H...XU...0.j.a.e..e(..........P.Iy.q..5.\|...}.i...%..`...`..Sf:f...)&.X.@A..nY(g....r...h.Q...(0'...H...Y...jJ... .J...!.k.s.XYa.d..3..@d.@`.r.8i_.^X..$..,...XU."..d.`I...y.....Qy&.j.....%.....(.D.\|.W.I...mw....Jh..

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\Help\logo.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	GIF image data, version 89a, 111 x 29
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	7.607044245859903
Encrypted:	false
SSDEEP:	48:LNghOG7AWFtRtKY19sWCMrMOoSb+rxuzSHVpRk:LNOFt7/9sW8oMuuHTG
MD5:	5F0DAC4FB2AF8974D0CBB7DEBC930568
SHA1:	47A2D205BB09B5EF1A2F4D7D210B6256BACE28C6
SHA-256:	43C55A4D82F42267E7AAC040FF50EA07D8B10CA554AF4A73E579E96D3E0EBC6A
SHA-512:	263D3790CD0652E6EB292D6A2CBF4A4A06A55D99D6121BDD788E90E1DE0FD32327FF5EA46095F310FB2BADA8CF976A8DBA42940352830389ED81F32B8FE689DE
Malicious:	false
Preview:	GIF89ao.........#. # ..?..?HEFA>>......,)966301\YZXUU......($%.........+'(...OLM...YWXTQR...%!"b_`hef.....sqq.....0,-..............xvvnll......P.......~...._\]..v..................................!.......,....o......@.pH,...r.l:..tJ.Z..v......A......Ak.....K..P.##._02ch.."7....C(b2.5n.0......$.{.rH9;?>+................&...(/..........&#..........2....... .....H;>--.-....................,...P.._..w$.XF..U.b..`...b........k...x.......L+.c..u.`.h.NE.",.4. !D..f.D\|p..A.W..(X......^..."....J8p....f./...........jC(.3.....;.'.T..!....`.]......((%F...e...X. ..<.fY(...Zf.F..hV@...T."..H../....^...l.5.......H.:.......".s..s.vUVCH.. ..1....a..I3..#'...D....`!...N....7...2.F......2pP......G.r...p....5D...'.m..F..2.`....d.@o..V@...BA+.....QUFU,....c.h.@Z(.AU.T..Z.`3.11...Lt...yC.p....ED.B..A.~]@.+.A..>.<..+.b@=...].18@$+..&..c.....m$...@).:4...1.p.0#..@.....+(.../..C.1'$..X....2:@h]+.\C.....J...b.{?.%W.t.G..................(.._.0+CBJ1.G)X..>.r[...%...z..o........S..

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\Help\step1.PNG

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PNG image data, 588 x 181, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	101998
Entropy (8bit):	7.997100087497268
Encrypted:	true
SSDEEP:	1536:rHL8z0EkgvlMR6xL69qYsRZ9xGgEw8E7CThxMn9HjG7XEselS7vSifApvU3jNgzw:ro7tyC29qYsRtaTXMY0sacSifAOWw
MD5:	685FCFF31CFAA44C60803C35F5CFDB00
SHA1:	E7B5B56D0F9E081C013A73D4529C73CDBCAC43E7
SHA-256:	E4F47D0B8D537670D81FF50E0360ABFDFD385F275485335CEFA9BFE83717A365
SHA-512:	B72345743B32AF80E70E715D5926229400FA91D13051B5C65878BED9ED3255FFEEC53AADE7029904926FCD1360A0C66B39CDD9D71A271081E892AFB47ABC4649
Malicious:	false
Preview:	.PNG........IHDR...L.........".7l....gAMA......a.....IDATx^...X.Y.6.........6K..3.bBT@..T.YPA..9.YQ1'..'.s...!.9t...s.nu.....>....z.....^.k.{...........:8.....tp......@`.....zmCMkm..:nC...........................R.R].\QS[..VK...6.?j..x\..USk0....?..+..........Z...._CS5.64.74U54.464.PCc..T....`.N.i..nl.jj.jl..%..........oj.om..#.6...44.44.F.....J-....5..u.h\|....~%.W...U..5.eu...M.....5......e.z.i..._...(.....B....vKc...fu}CEC...F]}....QC]]C..tQS}s.}OPC58.T_c.......V....8.<.......:8......@:44B\|).U..3.J.5u..U5M..f ....M.-.5.R]mK]...[....k.Z..!.Z...U.Mu..:uM.............G..M.%..+jj.k..!....j ..Z!`.....?......Z}Sm.....mC.1..#00.L.4.%.~)!....D.N.S.e.Y...).j........L.+.....D.a........yR=G..1..KA...O!.%...B.F(....T/..D2.H&.Qr.......'._,...bJ".d..zGr!.>.b.\#&...4b.7.I.......<..'...$.)JFJ).T.".2.L&.H.%.+D..@...I(..A8(..."..R...\&.=QRt.w6.!....!.D"......B.)$..W(g..r..41.]V..\|..\.......A.....b4.n..y...N..;...@.......7.(."....+.x.B.R..=.#...8U .d..

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\Help\step2.PNG

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PNG image data, 588 x 235, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	84338
Entropy (8bit):	7.994273290286128
Encrypted:	true
SSDEEP:	1536:x7oYglfiL7x3Lfo61gY25Loa/+0M850/sRFrKQn0wD97oC1OpEj7k9gMHW:x70aZliY258c+C0/sHKQ0+ojKj7+gMHW
MD5:	67CDAD24BCCBC0CF0E5D7BBF51882C85
SHA1:	20251A28F60A411107C187AD319AC85EC507E2A0
SHA-256:	CA4DDBFB509CB210091133D8DBDECD650D32F19B0BA5BEC053DA50AB34998236
SHA-512:	FB5B07A93E60C9B4290268FC2702B56947DE206EAFD9E70070638336B052178F19FD1172C7BE0F37E713495C6073EF6E6721D0601CBB67806AC875596557CE00
Malicious:	false
Preview:	.PNG........IHDR...L...........^.....gAMA......a.....IDATx^...x.G./...y......3.!f....`I&.".e.%..2.bff:.#&.C3.pf._.c{.g7.{wg..J'.y....~...............).H.E.,R`...#)...8!....dS...tb\49)....M.M..'.$.i..xf..X......$.B.<K>....'.e...I<?-...............V\|........Laj..LOO....'.gE.aF4.....s......56.%0...c3.z\|.7?=97%....=....M..eO.'.....................,..OL.NL..\|0..g..96...._1....hl.0#........c.x1@.b..zF.g&f...LN.&.y....O...96.`..r.gy...'...'..G.a..S.....3....y.r..abf\|lfblfR.S.3..33J .'_..'f8....Y...{r.;I..1.8H7..H..$..FM...I.._B..Mch..........lbF..c.@....g.&f^.H9....I.L..-.M/...O1.....I..tA...$..f.rb.s..3S..&^.........k...s..p\|.>.:K0...S..I.C.......,.q.1...YP.>>...eOL.'......I.....@6>39N...lT....d..........$...\|L..\|B...9...o..M.#BOB...0'06+.....c.;.......M..H!....U0q.o.^...8.7..>6.a.m.8......a.J.J..].E..C(0..:&....-H.3B..=3!.LM..S...k....`nb..05.x....)..X.&g'd.I..\|v^....}.dv.?1.Y.{4;.pV:.x\6=...../.g..N.KF.....1.T6%......../..0..ON..\|.m...............NE

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\Help\step3.PNG

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PNG image data, 589 x 437, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	122441
Entropy (8bit):	7.98978106334824
Encrypted:	false
SSDEEP:	3072:Jr3G/qazGY62J+uApN66TibegI7CcItTMgDqS:JjL+NJSBTiy3lAT0S
MD5:	38165EF6BAEB228106707D1592000D9E
SHA1:	37812388FCE358C5A62A6A46E3CFA29331EF23D3
SHA-256:	76BD4485A9B7D5C3312062425E7A26CC36A306A94A7486AD89C6EECEA64A0BBA
SHA-512:	3D356DD65FFEBFBE139D07BEC0F4B5A790E24CAE28CA10F4CA63347811AC10995DAD4275D3A6B3627DF3BADDB4CDCB77285BFCE77EA933C001BE3FA7731B629B
Malicious:	false
Preview:	.PNG........IHDR...M.........k.W.....gAMA......a.....IDATx^...t.G.....Z..s...'...Er.A." !.. ..H.$..s.9....A..s....9.`l.l............f...................#.'n.q..[@.....[m...W......o.....7._....w_}.......J..7....o.\|...7........-...#g..5v2g.}K {....=.\|....._....K..}...._?...W..2g...P....\|..y.......n....o^.....^..H........~.]......[@.K_...>.w....._.y...{_.y..._}...o.~C...._.....o.1..:.x. .s0.1..~......8.........yG.M_.<A........4._..C...o..$..E5s.~.j....oM.*."?h..............#.../.....E.....p./..\|E.......,.].......i0..}......g...^.\m~7..-3=..0...3%../..`K.j.N.%......^?gx....o_.......!...o^...E..".y.....\|...._..7._....z..^..x..o....x~....[C....wx.Y#.X#.9#...<...C6.G.......'.q..r.(..{..a.>{.!a......c..8..w..w...........S8..#.$.w..9....9S79....9......C..(.....s.?d.=..............>.......{.c`O....T."..9Sw9........cx.G.G..`t.......'m..&.M..@.....}.{.p.......z......,.Dh.....7Es.v.\|84....../...p_...6'.&..6.$....c.}T..x.x.X...~....

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\Help\step4.PNG

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PNG image data, 589 x 536, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	181649
Entropy (8bit):	7.993747700844444
Encrypted:	true
SSDEEP:	3072:XYEY7zC4AYheJpzU/CHhJgJ3br0HBpH7lUfrOfizUX/w4HX/9b+AtbEIHQKQp6ox:5gzpA0eJpzYJrAHBMO6zju1brtwKzNa
MD5:	7BFF972A438779CCC3CBCD867B971405
SHA1:	438044C15BC6C76BB71FA281853F5B7732CEECDA
SHA-256:	CB611C16F2B0699786D437418285DC515D2C6C0AA612272C4E961B2C43F9FBFD
SHA-512:	945505037097625590BC45A3F3949D8D34264009E4E86372948F11468C0AE8F78F2AE8B76A9E5BEF916A8E8CAF68D9B4B1C406766D526CC468629621BD68549E
Malicious:	false
Preview:	.PNG........IHDR...M...........OK....gAMA......a.....IDATx^...X\.8......Wg.&.!.$@.....!.............n.B..g2..[.4M.$....o..e...S]}....:Uo...?>.........._.......?....?.........w...p.w....w.}...}.wQ.U.............w.....{...y.._......h#...W.....w..v.;.....{.^..~.._..7..kB.?...;...w...;...w.{..w..~......Kx........w...n...}...........w....]t0.v........T../[O.....!..v..z{..=sO.W..2.h.[u[OG.c{...w.<h...u.Q..._...}.............w_....=(.l..?..G.c.w_...O..?.O...'...{.m....7...s.x.c;^..?W?...]g.;.o..x.m?..O.sEg.;....\..\|.../.........[.....=...w\|._.....~..\|..y.+.}k........0.G>....K....w.3.....2~..<.........y..\|.!.`....._...w........[...1...............w?".G..W.....W?~....w.}.o.....W.#7o6.......w_=.yg...................N.<.Zx<..pz.<.Yx4;.hn.......3..G3..Qa...........c.?F..E.d.3.....7.ro......s...Gs...._z...da.......s.V.WV...,,<..{.X.d,<d.?b.=f.?F....Yt.?.xv...\z...8<.`........->...b;HVyv......-`od..v.p..8..c8.8x........w........^W.]

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\Help\step5.PNG

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PNG image data, 588 x 235, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	69767
Entropy (8bit):	7.992809940510076
Encrypted:	true
SSDEEP:	1536:x7oYglfiL7x3Lfo61gY25Loa/+0M850/z6U5q1hG8PI4husT0Wmq:x70aZliY258c+C0/z6Umk8PI0wJq
MD5:	1E983D81FC3AE036A714966B52BA4BB3
SHA1:	F8F9D689309FDE32F129BF7C18D08BD3DC6A3A1C
SHA-256:	9073BE7CC0948B1368BEEFC5332394FCC8BAB3A5169075F329930536DC2CAE21
SHA-512:	7133F4F5AAC07405EC82A92BAB30D7A880047F6C0D1B4F97B8D2F00C456E079E315F44FFB30A9847B90466200EBD8D557DD54E16870B1F84F89B43EF32AD072E
Malicious:	false
Preview:	.PNG........IHDR...L...........^.....gAMA......a.....IDATx^...x.G./...y......3.!f....`I&.".e.%..2.bff:.#&.C3.pf._.c{.g7.{wg..J'.y....~...............).H.E.,R`...#)...8!....dS...tb\49)....M.M..'.$.i..xf..X......$.B.<K>....'.e...I<?-...............V\|........Laj..LOO....'.gE.aF4.....s......56.%0...c3.z\|.7?=97%....=....M..eO.'.....................,..OL.NL..\|0..g..96...._1....hl.0#........c.x1@.b..zF.g&f...LN.&.y....O...96.`..r.gy...'...'..G.a..S.....3....y.r..abf\|lfblfR.S.3..33J .'_..'f8....Y...{r.;I..1.8H7..H..$..FM...I.._B..Mch..........lbF..c.@....g.&f^.H9....I.L..-.M/...O1.....I..tA...$..f.rb.s..3S..&^.........k...s..p\|.>.:K0...S..I.C.......,.q.1...YP.>>...eOL.'......I.....@6>39N...lT....d..........$...\|L..\|B...9...o..M.#BOB...0'06+.....c.;.......M..H!....U0q.o.^...8.7..>6.a.m.8......a.J.J..].E..C(0..:&....-H.3B..=3!.LM..S...k....`nb..05.x....)..X.&g'd.I..\|v^....}.dv.?1.Y.{4;.pV:.x\6=...../.g..N.KF.....1.T6%......../..0..ON..\|.m...............NE

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\PCID2313656.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5699376
Entropy (8bit):	5.441015989612259
Encrypted:	false
SSDEEP:	24576:VAP6iyO3k4QJtJG3ENoY3JEoIWKzxcSdD7pciZ36Av:MQJtEUWN7zZ36Av
MD5:	B32C16E850C0E09747A6D1812BC46A66
SHA1:	898E5E545ECFE43091E9E861B4F2AC8B631211C9
SHA-256:	C65CA7A1F0E3C2270C922101D71BB337820A16AF6A8949400453BF3EA40EC6EC
SHA-512:	406B332F0C991C82B7A5504B8693770014B53D3FBADA166D5CC47E55481C038C1C0262A0DDBA2A596F67E27D397FA6E6FC348E99D979D0CE8A107FD8E8254552
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......P...........!......V...........V.. ....W...@.. .......................@W.....6(W...@.................................x.V.S.....W.@.............V.0.... W.......V.............................................. ............... ..H............text.....V.. ....V................. ..`.rsrc...@.....W.......V.............@..@.reloc....... W.......V.............@..B..................V.....H.......8.Q.............8....jK.........................................z.,..{....,..{....o......(......0...........(....."...@"..PAs....(......(..... .... .... ....( ...o!.... .... ....s"...o#....r...p($.... .... ....s"...(%...........s&...('...........s&...((.....()...b..{.....(...t....}....b..{.....(+...t....}....b..{.....(...t....}....b..{.....(+...t....}....b..{.....(...t....}....b..{.....(+...t....}......{...."..}......{...."..}....*....0..........s,.....{

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\de\PCID2313656.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2841904
Entropy (8bit):	4.168255143618694
Encrypted:	false
SSDEEP:	6144:pdWT14CaQQ5VE8/cV3/qYdtB2iIb5XYV8HQdee3:jWx4bQbbB2iIxE8w4e3
MD5:	DF04F8A2AD14137C1CF900CB53262289
SHA1:	C4C157E5566F14D06F7E9DD6E1C99EBBD56D3C83
SHA-256:	50BEFD26678685D07A8B20DC0D5DC9C8781B34551C8B4708013685CAE1D48FD4
SHA-512:	220EF4591A4A15D3FE7378358503A0699295BAFFD648E2D1AB10887BA98C694AD97D67DBF17A630850550371DED235C3E0253B026F691FB8C55C3A1939FB2EE5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......P...........!......+.. .......++.. ...@+...@.. ........................+.......+...@.................................4++.W....@+.h............@+.0....`+...................................................... ............... ..H............text.....+.. ....+................. ..`.rsrc...h....@+...... +.............@..@.reloc.......`+......0+.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\zh-CHS\PCID2313656.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3734832
Entropy (8bit):	4.845852221152544
Encrypted:	false
SSDEEP:	6144:ocmnWw3zZup5pTokSCQQ5V7F5NC/qYdOTInXlltUt7pfXMDOm52tYvIlJaA:DUDA5pTZQQGvsAB2WK
MD5:	79C7AC91441783299DE3249C71328CD1
SHA1:	B5478F12DCFF54E07FBD6FCB389F9000C767728E
SHA-256:	C7E86DEBBE24A04750F26D3794D4E885C7173792C8D1DB53C2DA0FFB8E662571
SHA-512:	D85778DD272B35D878EFCBEA3C556B3052C4236688832530D59BA39AF7E611AB7BF683C1452A72F63D07ECBC03CCCB1DA09C677C8FAE4B054415A14750610800
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......P...........!......8.. ........8.. ....8...@.. ....................... 9......T9...@...................................8.W.....8.h.............8.0.....9...................................................... ............... ..H............text...$.8.. ....8................. ..`.rsrc...h.....8.......8.............@..@.reloc........9.......8.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\FactoryDefinedConnectionSets.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7470
Entropy (8bit):	5.2883299573850655
Encrypted:	false
SSDEEP:	192:++dxwNer1BQBlQHpjiH5oQBd4QBOQHJiHRQBJQK5QK5QsLAQs4oQHBGQHS:Vdx1r1BQzQJiZoQn4QQQpixQDQcQIQc2
MD5:	D49A46DECE1EEC68F07F15587F98237B
SHA1:	7558E7504739477C203EB594B50B2FFCBF1B21E4
SHA-256:	10CFC7FFD1E40F2A91ED18EA2A71FFC653BBEC326C42205836AE252917E693D5
SHA-512:	2A35674E416F95C6C2A0F0FB2127D6545A46854CFDD344CB3C0B3916D175D3EC14ACE2CCF87B5B2667CA96EE729ABCEECD2FA847AD49E85E3B825128179C894A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. This file is used by the program "PSI-Conf". -->.. It containes communication connectionprofiles for the serial interface. -->.. The following options are valid: -->.. Interface: 0=RS-232, 1=RS-422, 2=RS-485 -->.. Baudrate: .92 - 2000000 bps, ATTENTION: The baudrate will be rounded to the next valid value!! -->.. Databits: 0=7, 1=8 -->.. Parity: 0=Even, 1=Odd, 2=None, 3=Mark, 4=Space -->.. Stopbits: 0=1, 1=1.5, 2=2 -->.. Handshake: 0=None, 1=Hardware (RTS/CTS), 2=XON/XOFF -->.. DCE/DTE Mode: 0=DCE, 1=DTE, 2=Automatic -->.. Termination: 0=Off, 1=On -->.. Transfer Mode: 0=Character oriented, 1=Packet oriented -->.. Packet settings: 0=Settings in Bit, 1=Settings in Time [.s], 2=Settings in Time [ms] -->.. Interframe gap: If Packet settings=0 : 0..4095, If Packet settings=1 : 1..10000, If Packet settings=2 : 1..37000 -->.. Frame end: If Packet settings=0 : 0..4093, If Packet settings=1

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\PCID2313669.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7432496
Entropy (8bit):	5.518908148953381
Encrypted:	false
SSDEEP:	24576:33NeZm+zH/qScKWxhviZcphC/S+FFTTXgR1ovU9qxF:CzH/fc1xhvB0/S+fTTXIMU9qf
MD5:	1334223DBBDF48A21E3C795E07A5DAE5
SHA1:	D7B09F7AAFB28CF92B5B0258BB7AA71A38D50BBE
SHA-256:	484C8B0372B6AE0DF045AB48E6244F382CE7CB297C6748484AA5C6139C28E7AE
SHA-512:	9C9A7EEF871C71F9CA49D19B173628619F024BE6E382AA06024E6584F78943BED64B3BEDEEC278959F5D31C9E113576F574C446C43707699CF1BAF68446A29BA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...V..P...........!.....Bq..........`q.. ....q...@.. ........................q.....".q...@.................................._q.K.....q.@............Lq.0.....q.....@_q.............................................. ............... ..H............text....@q.. ...Bq................. ..`.rsrc...@.....q......Dq.............@..@.reloc........q......Jq.............@..B................._q.....H.......Xzl...................f.........................................z.,..{....,..{....o......(......(.....(....o......(.....r...p( .....(!...6.("....(........0..q.........(#....o$....o%...s&.....7.......7.....s'....7......7....((....()....[s'....7......7.....()...s'....7.....o...b..{.....(+...t%...}....b..{.....(,...t%...}....b..{.....(+...t&...}....b..{.....(,...t&...}....b..{.....(+...t'...}....b..{.....(,...t'...}......{...."..}......{...."..}....*....0..

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\de\PCID2313669.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4414768
Entropy (8bit):	4.345052734298697
Encrypted:	false
SSDEEP:	6144:gQQ5VaDqydPaQQ5VPh8/cVJocnnZZVN1/xBuJd8889Xqol93S2XkJ/iHi7FEZu5W:gQ5DqydCQGVN1/xBVX6FFEZu5Pe
MD5:	4DA567FB8E268109161B030C3897C4D9
SHA1:	048853D71A37AED6A6B68E02FCCBE1C670EECCD6
SHA-256:	98FD742A50ACCC06F720FB630F9BAEAE578C72DF5A32442302F527AEDE08CD8C
SHA-512:	0E4B522EC8D24E1FC809600AB32427FE1FFA0E8D867BB83ABCAA85862E92375B1E5FDC930CAA36AAE6D7039140176CCFE2E4C142B9D2089D4A288A58A77A17DD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...V..P...........!......C.. .......#C.. ...@C...@.. ........................C.....b.D...@.................................."C.K....@C.h............@C.0....`C...................................................... ............... ..H............text...$.C.. ....C................. ..`.rsrc...h....@C...... C.............@..@.reloc.......`C......0C.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\zh-CHS\PCID2313669.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2153776
Entropy (8bit):	3.4635589989788262
Encrypted:	false
SSDEEP:	3072:HBaMYSs4S06KXkJlSrBMzlrZiYNsx/GK7d888BzkAqnQGpe:4M9jS2XkJMiHi/1Fd888BJqk
MD5:	C7513BF39EFE642B8C31F80BCC859402
SHA1:	C86CC51B8A0C28DEFB88CFB5BD0F1B6BBE0D50BC
SHA-256:	59E448E45215C57216515C96085084A20F39EA747E6DAA156F31D9E7842F788D
SHA-512:	C6058C50005C46956574301394D6D2A16C2CB0730ADADD80571ED92D734D238A8B0F5C32A04BB5175475A681FAE5A6BD41ED9E09D482E6116EFA23A46B2263A2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...V..P...........!...... .. ........ .. .... ...@.. ........................!.....#.!...@.................................. .W..... .h............. .0..... ...................................................... ............... ..H............text...$. .. .... ................. ..`.rsrc...h..... ....... .............@..@.reloc........ ....... .............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\ModbusLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.480590931648532
Encrypted:	false
SSDEEP:	768:PVmqvW+KleiYV3VMVyaJhKPNWfY/iH3Xsqp:NmqDKGZVSKPNWfoqp
MD5:	D234D24058CDF97A6D02DA4191F32B9E
SHA1:	EF5D436B4A09744F80BDB46A7B4062DFF017DFA1
SHA-256:	736B9437D2CECAB806AC2B9A87470380F76352FEB5EE175556D255E2946D9416
SHA-512:	5CF9AC42BB3712BAB8BFEA88E454584977B71C878131055C0991AD0C42166AAA63F1D7076FBD17B08E73E4508598EF0F6DA6C089C1F9C8123574E64084A300C0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|c.M...........!.....p... ......N.... ........... ..............................w1....@.....................................K.................................................................................... ............... ..H............text...Tn... ...p.................. ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\PCID2702184.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4405760
Entropy (8bit):	6.127186815043925
Encrypted:	false
SSDEEP:	24576:0hGyfJlwnEDG9gvKmqhyO7E006iQ6mKtI7sxlm/T44LuheWNEzrz2vbA:0hhfJlwn0W7E006iQ6mKelLu8Wm
MD5:	341799511CFD7DD9330A6CDE0F772525
SHA1:	ED99077B94EA60A66D8496BDD7A6CDFA8AE7CB73
SHA-256:	ECC0A043B8C7FC2DD2B2B0C89F9A4843EE4972CE918E69D4DE5A438FE4DEA29C
SHA-512:	02B3D81BA893F0912AD4C884E82F94574D2E8B36BF0C3F9708AF009AF19323B64A13F72BEBF1BFFEFD945EF21AEEBC4CDDCD76AD5A276DD5F33CBA6436E511C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~.^.........." ..0..0C.........~LC.. ...`C...... ........................C...........@.................................,LC.O....`C.......................C......JC.............................................. ............... ..H............text..../C.. ...0C................. ..`.rsrc........`C......2C.............@..@.reloc........C......8C.............@..B................`LC.....H...........H...........T.....;..........................................0..L......... ......+8.....+(.._n...._...._cj....d.a.+...d...b....X.....2...X...2...a.0.......... ..D!....i(.........(,.....{...."..}......{...."..}....~.r...p(-...}......;}.....(,.....(......}........{....s....}......0..H........{....-...{......{....s....}........(....-.....(.......(.....{....o/...&...(....*...0..^.............+6.-.s0....+...{....o1...&.,...o2...-.....o3...&..X...X...{....o4.

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\de\PCID2702184.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1638400
Entropy (8bit):	4.931419784027834
Encrypted:	false
SSDEEP:	12288:H2ViKKBYEEoSss3MEEoaEzRgVIE6D2IXSSJsEEoVOpy41jJYNTTSYPfYNHTSaduw:H2EEzlz2I2
MD5:	3CC1CA59B59A94C73D49CED150BE967C
SHA1:	05B87E317322E3E1C478BD32552E684D5CDB1183
SHA-256:	A254F74FD8F2849958FFE87A3E2945C8F55BAECB0D7ECC95CD7EA0D8D18DDD21
SHA-512:	215119A1F94A619DB0C41778083A1376A8A7D377D05E8911209DE682A69C69FC6601257A951F03947AD0FC4567EE389449FC8A688DA5EF86FDA99D094C6CB8E3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~.^...........!......... ........... ........@.. .......................@............@.................................8...S............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\modbconf.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.631581329956364
Encrypted:	false
SSDEEP:	3:U246mWFsG8+iYh/HYYL85tq9qYL8n6y31Y3VO:naN+iYJ4YA5tBYAn6yMVO
MD5:	3E5418C4E7E9DC9ACFE71127B455B084
SHA1:	8B1C6B323943D834706D029EFA829BD44DD74CBE
SHA-256:	15C3B96F195AF135766F99C55A5C4B79BD64EB42D21B5F1FFA2D8816E97B5F8D
SHA-512:	D1972A02B83085174A9D08328D0284665A97FA56D5DCDE70DD8B5F9B49590F2D88E148CB578C2D5D9805BA6FC441EAA1260517CC951C67883DED3E8B254269CF
Malicious:	false
Preview:	.<MODBUS_LIB_CONFIG TIME_OUT_CONFIG="2400" TIME_OUT_SEARCH="400" TIME_OUT_READ_WRITE="800" />

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\zh-CHS\PCID2702184.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.340825025982628
Encrypted:	false
SSDEEP:	48:6k/vA/kpvClm6GpiubDpPhycfe73wOy96ZgE5wXlo66vRr:AkhClm6Qb9Po9hc6KQGm66
MD5:	3BB9E48A026BEE0DF12A7225EDEDE6AD
SHA1:	9E93BD331E90BD1919FFE84912B3EBCEC22A2712
SHA-256:	9845C338E9DFC48067B46383A442A4B8A9D7451A4FAB9292185A05583FAC877E
SHA-512:	3C0CD344FCB1141774331CFCC206F31759A18695B92199C154AD92E3F296331C49852D6BE95F0FE3155D2B66D892F048E52B44B8C4FF9ACDBB89B7BC7BAA6FD3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~.^...........!.................&... ...@....@.. ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................%......H........!..............P ..S...........................................O..............lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.p....a.#............s.D.e.v.i.c.e.C.a.t.e.g.o.r.y..... s.D.e.v.i.c.e.N.a.m.e.E.r.r.o.r..........9..............256.....BSJB............v2.0.50727......l.......#~......x...#Strings........

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\ModbusLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.275542302419595
Encrypted:	false
SSDEEP:	768:jFRHaFqz1KmeCEMDhFf/iHCoNWfDX0q2LT7:jX1reCjDNoNWf4q2n7
MD5:	C03E258BC2D9F57DD886D3181F8709BA
SHA1:	1E387CFDC5F332DC6DAB5A25745B42842ECB2830
SHA-256:	32C58021CECEDA30BDCB118CBD72E3C07772A51B7E13F6EB9FFFF6A9B155B55F
SHA-512:	A92550DB4FBCFCF30C0CA75BE824206CF9BB0BB5765803B7D55FB934BD6DFCEE2F6B60C6854DF9469761BF96129F74F80900027F2A3C28470CD83E6B5DB57D4E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....fU...........!.....p... ......>.... ........... ..............................U.....@....................................W.................................................................................... ............... ..H............text...De... ...p.................. ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\PCID2702863.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6361600
Entropy (8bit):	6.61464983996453
Encrypted:	false
SSDEEP:	49152:DQXAOH6S0FnI9jByugYmX3lLuXAYe47jfnZ:DQw26S0FnINKX3lZY
MD5:	2D3E0D27C58502F5B58EB595F4BD1DEF
SHA1:	D40807641A1F000C292D96E9DA5EF5BF4176A8E2
SHA-256:	DD0453785B38030C6CC1DD6BA12CE9BB385CD22BAC72BB4DBE0112795256E4A8
SHA-512:	D2C81DE28646ED35275E00B2D35B21AD53787D404FEEBB3AD4AFDAF50EE9DBF632CDE28433D600F130E62C500EEE6E2E4E1A8A55611F07492F2EAC8C28C1714D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...PO._.........." ..0...a..........#a.. ...@a...... ........................a...........@.................................d#a.O....@a.x....................`a.....,"a.............................................. ............... ..H............text...L.a.. ....a................. ..`.rsrc...x....@a.......a.............@..@.reloc.......`a.......a.............@..B.................#a.....H.......l...hS...........r..X.U..........................................0..L......... ......+8.....+(.._n...._...._cj....d.a.+...d...b....X.....2...X...2...a.0.......... ..D!....i(.........(,.....{...."..}......{...."..}....~.r...p(-...}......;}.....(,.....(......}........{....s....}......0..H........{....-...{......{....s....}........(....-.....(.......(.....{....o/...&...(....*...0..^.............+6.-.s0....+...{....o1...&.,...o2...-.....o3...&..X...X...{....o4.

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\PhoenixResourceManager.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.712980199848379
Encrypted:	false
SSDEEP:	192:Zqn5dCWmuJoLRd+X/wVdUPV0vOV6sPs4:Zq5kWmuJ8QX/wVdUOvqJb
MD5:	28F339164749C81FA8F33C5DE72FA316
SHA1:	ADC457E581AE811C1F9F073F2BDD510D093623CC
SHA-256:	BB223255FE4274A1FB5B6786DA1DB6EA8490287BB923A9ECA1CA7695D07B5A9F
SHA-512:	807EF8A9161C539D6B3BE9613C42F77F0114903B036AE6181B7F0757D8C4FA9EFCFF3D2613CAABBDC28BC3F303F9F9890DE614C557E494C8DE68CF15BE48FC90
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....T^].........." ..0.............~;... ...@....... ....................................@.................................,;..O....@..h....................`.......9............................................... ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`.......$..............@..B................`;......H........#..T.............................................................{...."..}....>..(......(........0................(....(......u....,..t.....o.....u....,).t.......(....o....o....t......,<..o......(....o....o....(....-..t".....(....o....o....o......(.....~...........j~..........%...(....t......(....~..........%...(....t....z~..........%...%...(....t.....~..........%...%...%...(....t.....~......o....r...p(....-.......(....o....,.......*r_..ps....z..0......

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\de\PCID2702863.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1867776
Entropy (8bit):	5.1523477249508405
Encrypted:	false
SSDEEP:	12288:/GpXa7SSJ3ph2lEEoofddsddd61168EEo5EzhfPW98tvOOtEEEosEzlKOh6OOtwC:/GKph2tfddsdddlEzhX6REzlJh
MD5:	7D2FB7339E79BBFDF87B280D66089222
SHA1:	56318BCDD3B8497FFB6E1A5B58430F38BD7BF1B9
SHA-256:	DCB6E72A894B1DBBE95B7E0A608C3DD519AA17EF914D24F1703B4D0F41A42108
SHA-512:	E4765B5B5EC2F4ECD5B9F8F7B264FB76B153F213D8FC9FAC693BC2E944D28BC09C405225D14EBD94144D6FCB83FC6963C3CF15E1253DCA00805E481A8A3E757E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...PO._...........!.....P... .......c... ........@.. ....................................@..................................b..O.......p............................................................................ ............... ..H............text...4C... ...P.................. ..`.rsrc...p............`..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\modbconf.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.631581329956364
Encrypted:	false
SSDEEP:	3:U246mWFsG8+iYh/HYYL85tq9qYL8n6y31Y3VO:naN+iYJ4YA5tBYAn6yMVO
MD5:	3E5418C4E7E9DC9ACFE71127B455B084
SHA1:	8B1C6B323943D834706D029EFA829BD44DD74CBE
SHA-256:	15C3B96F195AF135766F99C55A5C4B79BD64EB42D21B5F1FFA2D8816E97B5F8D
SHA-512:	D1972A02B83085174A9D08328D0284665A97FA56D5DCDE70DD8B5F9B49590F2D88E148CB578C2D5D9805BA6FC441EAA1260517CC951C67883DED3E8B254269CF
Malicious:	false
Preview:	.<MODBUS_LIB_CONFIG TIME_OUT_CONFIG="2400" TIME_OUT_SEARCH="400" TIME_OUT_READ_WRITE="800" />

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\ru\PCID2702863.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1728512
Entropy (8bit):	5.042968577124625
Encrypted:	false
SSDEEP:	12288:9q1GpF250PfSSJ8EEoofddsdddGqqhwEEosEzO1Mrb222c0003EzlkLXfBDHCpL6:mfddsdddREz+EzlTHD
MD5:	F8D358214D9F7ACE831521605725C58C
SHA1:	71A4945761D7CAB32379DD8EA8598D4DB122751C
SHA-256:	11757CF567E585D292BFA905AC10BDB443DB4C92BA6A75D7D09B503539B78ABD
SHA-512:	C35F94B80C0B21766A20A7C2E81CBD34F8B01C5AB8E13D3F4B5D9A60FA8B8D966C3FC67DD824FDB2752BF25B042B68CB34FFFD4B0F0E9B53AC2B55D47361EE46
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...PO._...........!.....0... .......@... ...`....@.. ....................................@.................................\@..O....`..p............................................................................ ............... ..H............text.... ... ...0.................. ..`.rsrc...p....`.......@..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\zh-CHS\PCID2702863.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1683456
Entropy (8bit):	4.958367862386409
Encrypted:	false
SSDEEP:	12288:LIGaPfSSJ8EEoPnfddsdddBIIIU000PEzlsrb222c000IEzlUpppMuuNcEEoL:Snfddsddd4EzYEzl9
MD5:	55225666D6B08B52171BAFE32EC9D536
SHA1:	E9DB1E8FAE51FC89694407EADF15B97478B68264
SHA-256:	18E0B62CB59C7BEE77726164CA8A70358FDAEF98B6586BA2FDAA37BCB8204457
SHA-512:	A90C99D249564130940DE364E833176BC3E932C9F977D6F91B3915E44254CB480B4353091AB6B0E34A69AD842FD99503E6F456523D34F2D65105A54501CE2F74
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...QO._...........!......... ........... ........@.. ....................................@.................................8...S.......p............................................................................ ............... ..H............text....w... ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\ModbusLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.275542302419595
Encrypted:	false
SSDEEP:	768:jFRHaFqz1KmeCEMDhFf/iHCoNWfDX0q2LT7:jX1reCjDNoNWf4q2n7
MD5:	C03E258BC2D9F57DD886D3181F8709BA
SHA1:	1E387CFDC5F332DC6DAB5A25745B42842ECB2830
SHA-256:	32C58021CECEDA30BDCB118CBD72E3C07772A51B7E13F6EB9FFFF6A9B155B55F
SHA-512:	A92550DB4FBCFCF30C0CA75BE824206CF9BB0BB5765803B7D55FB934BD6DFCEE2F6B60C6854DF9469761BF96129F74F80900027F2A3C28470CD83E6B5DB57D4E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....fU...........!.....p... ......>.... ........... ..............................U.....@....................................W.................................................................................... ............... ..H............text...De... ...p.................. ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\PCID2702878.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6408704
Entropy (8bit):	6.656189088485623
Encrypted:	false
SSDEEP:	49152:SYOKlPX5M7BoAs6gqAeaDzh9QAPPsjxZLFuFkMNBJhPHSQ:SYjlPXqHqUjxZLzaL
MD5:	98A8224385599582F323129DD03FF347
SHA1:	ABA2812E8DD6D298740ECBD7B2971418B87A4451
SHA-256:	1343403BAC82F7CA2C7AFBB83171D915FA8A78A3E389D8AE365C814852897279
SHA-512:	D3DB2B4A21058DBD425751A85416AF7E8828F67F8B5A9D9046CE66E06BEF70CA373538F60DAD4221A0BB8D229DF0B96B059A042707EEECA63A3DA14A70E0C006
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\..].........." ..0...a.........r.a.. ....a...... ....................... b...........@................................. .a.O.....a.x.....................b.......a.............................................. ............... ..H............text... .a.. ....a................. ..`.rsrc...x.....a.......a.............@..@.reloc........b.......a.............@..B................T.a.....H.......,................`...zU.........................................f..(,...s.....o-...&s....zR..(....s.....o-...&b.({......(.......s....zV.({......(....&s....zb.(......0(.......s....zV.(......0(....&s....z....0...........g................................................................................+.......X....X.....g2..,...1...Q...R...,...Q...R.........+B..3.~ .........Y...+.............../...s0...(...+.....(........X.......i2...i.3/...Q...R....+!.............

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\de\PCID2702878.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1822720
Entropy (8bit):	5.286389237636197
Encrypted:	false
SSDEEP:	12288:yGSxqZZ1HKHcz+ZvTJa7SSJ3ph2lEEo7fddsdddOCCZMEEo8EzIJ1tvOOtEEEoDA:yPM3HK0uvyph28fddsddddEzIJJEzlS
MD5:	A9DB3BD550FAEFCE114DBE3B786321AB
SHA1:	31091A25C0CC8E5F2CD885BAAAC16A8661A3725C
SHA-256:	5AD992546FF2C2110D56A0C13D3230E9A3FFC42307223CEAF9DA4B8228F062FA
SHA-512:	C3DFF4C83C669F0FBA7644CACC2BEEA88CD8FEDC58E7D6BD5B1BEF20EB3A2D303983361E85E6AB9A93405EE4DF199D688122F23C17685F5FE878CEFBCAE05A7A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\..]...........!......... ........... ........@.. ....................................@.....................................S.......p............................................................................ ............... ..H............text........ ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\modbconf.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.631581329956364
Encrypted:	false
SSDEEP:	3:U246mWFsG8+iYh/HYYL85tq9qYL8n6y31Y3VO:naN+iYJ4YA5tBYAn6yMVO
MD5:	3E5418C4E7E9DC9ACFE71127B455B084
SHA1:	8B1C6B323943D834706D029EFA829BD44DD74CBE
SHA-256:	15C3B96F195AF135766F99C55A5C4B79BD64EB42D21B5F1FFA2D8816E97B5F8D
SHA-512:	D1972A02B83085174A9D08328D0284665A97FA56D5DCDE70DD8B5F9B49590F2D88E148CB578C2D5D9805BA6FC441EAA1260517CC951C67883DED3E8B254269CF
Malicious:	false
Preview:	.<MODBUS_LIB_CONFIG TIME_OUT_CONFIG="2400" TIME_OUT_SEARCH="400" TIME_OUT_READ_WRITE="800" />

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\zh-CHS\PCID2702878.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.3210406389237206
Encrypted:	false
SSDEEP:	48:6UPA/kpSlm6GisiZIJ5Dma9rfe/3wOy96ZgE5w9lyI65lLiO:0kElm67MLScKhc6KQgL65
MD5:	11B02FBF81B78981F7F4E39A4194B8B1
SHA1:	D5EAC5DB5F7327415FA8DC42CFDBC157B3535276
SHA-256:	AABE8C86B6D9D915307062A10F07D5D99502394C7302AD1B9618A216E9A4974A
SHA-512:	B94E2F696A74381FBE3F9F48D2CFFDDD7E13C9562F09F72967FE11B26BE8F12E8257DA419460AF35081E6B1248A517604A74DA55169285BE62F11C23A5ED1BF5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]..]...........!.................&... ...@....@.. ....................................@..................................%..S....@..p....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B.................%......H........!..............P ..S...........................................O..............lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.p....a.#............s.D.e.v.i.c.e.C.a.t.e.g.o.r.y..... s.D.e.v.i.c.e.N.a.m.e.E.r.r.o.r..........9..............256.....BSJB............v2.0.50727......l.......#~......x...#Strings........

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\FactoryDefinedConnectionSets.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3519
Entropy (8bit):	5.342552915571782
Encrypted:	false
SSDEEP:	48:3pIBAjE2Mu8h1ftlbo1poxiNnJjsC3mrNJjKfyitWJOoNJjsNczqmcNJjsUiSUnU:e+VKFUk6JkJOqb7JvzOJ/WJXIJpJN0J4
MD5:	686772D291FA4D79940D05379021C9D7
SHA1:	034846AD0BE63754898357CB6F1C756D1C9FF53B
SHA-256:	8D21E56AC0E7488EA5FF1D98DB73FB5791090156FED4850ABC0B3E7AF87807F2
SHA-512:	B77A68CECC496EF920F8806DBCDA506922D44D2FBE46BFB17E13463B12635A8D9705A7F55DA5AFF6270EBC1764F6F1C3D388411AA7CDA0B583E5F6DD6C94132B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. This file is used by the program "Serial Interface Configurator". -->.. It containes communication connectionprofiles for the serial interface. -->.. The following options are valid: -->.. Interface: 0=RS-232, 1=RS-422, 2=RS-485 -->.. Baudrate: 0=300, 1=1200, 2=2400, 3=4800, 4=7200, 5=9600, 6=19200, 7=31250, 8=38400, 9=57600, 10=75000, 11=93750, 12=115200, 13=136000, 14=187500 -->.. Databits: 0=7, 1=8 -->.. Parity: 0=None, 1=Odd, 2=Even -->.. Stopbits: 0=1, 1=2 -->.. Handshake: 0=Hardware (RTS/CTS), 1=None -->.. LinkPolicy: The default LinkPolicy is 0,0. This option is only used for point to point connections.-->.. The '+' character marks that this parameter can be modified by the user. It must always be the first character.-->.. Important: The parameters are always separated by a ','. -->..<ConnectionSettings>...<Set1 Setname="Userdefined">....<Interface>+,0,1,2</Interface>....<Baudrate>+,5,0,1

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\Manuals\ResetEscapeCharacter_DE_00.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PDF document, version 1.5, 4 pages
Category:	dropped
Size (bytes):	565870
Entropy (8bit):	7.698140399997754
Encrypted:	false
SSDEEP:	12288:S6BD+F8/F5QpKZRRAk2KaGvZBrADwaYwv8RAL+L2DFwXWJf2:RBquNvLBrA0+30
MD5:	C496C55E6A732DE454C6E42CD7F811A2
SHA1:	C414DC09C066B5297D49D7E438317C727CCB7A6B
SHA-256:	8BEF56F99FD6C87077299D091D642C5AEA79F247605A141AFA524F7B0865F4D5
SHA-512:	B60371DE627954D869DD29E5D0F2662296F37BA97E50C7E328D4034D96C24C22DEE5B22F1474B54163B02FCC7F3CDBC9103E2C94DA2E870301D132105BEEA7F1
Malicious:	false
Preview:	%PDF-1.5.%...5 0 obj.<</Length 6 0 R/Filter /FlateDecode>>.stream.x..VKo.1..[(m....@..f.&.y.@H..(sk9...T....g....U...xc..g...K..(..w4N..C.O........S.dA.....}r._.x1p.....1..;'p.FX.}P.+....J.(......JX.FWku#../.TW..t..sJW..N............y...&V.....C..&...XZ.c.+1..vF..#.ELr.6..>I...U.bw1V..q.v.......5..s{.CM....g.w~h.....h..{..G....L.nw.km.:t...Hm...Do.a......y........o.^8....^..B$..%..TE5....k+...F...F...V.T....\|..P........z.... ."?...2+Q..0.P....A...p.x.+?t;Z............;.u..&.z..K..N....F.&E._p.g]...`."-..Q..l..8..t.\....7.s-{...VR...&.3...$....-..)#M.^'..Nw.5....r....m.G...V....y.UQ.......L....K.@b..7..MVAc..:x.C...;.....i.Lt8...".G.0...I..m.v..O3.g..%0.. .`7.=..R.....t}A.B1'...H..<...^..+....r.9+.........$.Y......,.......O.X..`.Q..[n1..+..0.D..G..=..".....endstream.endobj.6 0 obj.747.endobj.16 0 obj.<</Length 17 0 R/Filter /FlateDecode>>.stream.x..UKOU1.N0..#Q..c....=.3}L.5.....$...*.x5\..}.<.kp..{7.<....s......O...?"y.K.by.f<,..H.u.^P

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\Manuals\ResetEscapeCharacter_EN_00.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PDF document, version 1.5, 4 pages
Category:	dropped
Size (bytes):	550301
Entropy (8bit):	7.670631490225616
Encrypted:	false
SSDEEP:	12288:3Uwnw5rFjUWA9pxRv+NV8Z4geygBJP4eBbRV3A8:3wlApbO44lysp4eJRVQ8
MD5:	534D004A5EC76F16AD76189CFC66A4A1
SHA1:	2B10E72B089D5AA1980B50F22733B6C18C043A56
SHA-256:	583318E77F1E5FF0C36B3681634C526D55D0C46A8D266BD2C7019E6A05C132A9
SHA-512:	D28F87EFC881E9847211FC7860F25C5AA6BE0E395CCF92AB68C3A32A15654FFA03469EBCCBB35786F4434DACC2DBC7834EF50D56E3C713676A56BBBF9F7A04AA
Malicious:	false
Preview:	%PDF-1.5.%...5 0 obj.<</Length 6 0 R/Filter /FlateDecode>>.stream.x..VKOUA..WD.@\|. .gy.....Gg.FcBt!...B%1A.....y...@\...._.i..r....F....< ~..j~.v..O..sB..AQ...U......W&..^#.F.@JH.. ..);l.. .h2.Ea$h.\oWR...U.]kW(.:..x#..E.z........@.U.2..5.E.T.r...c3....6C-s.....0`Q..%p.Z]F.r~....c.=L.7V..yKS.{....aN.X..5.%.}s{.../..;.J.-........."5w...xRnf\|x....u..}....ek.C.P./\.yc.i...j....j.tI-..."C...T].b.rw[.7W...G..Y...i..0.......K..6{%...YU....B\.......P....e5.N........2....H..c./....:d.l.R....C........r7...5.;;_...RG^......c...Wd......J.@X..0H..G..7w..}9.?\Ia3.W...+....^<.O..Q.Qc.dI...q...x:Q.4....k4.w.z.s....2.y.z.....3~...I.....@..s.E"..^..{.Z?....UqB...e.n....9....g..1.....k.6..&...a..*y..NF.F..'!.o...6endstream.endobj.6 0 obj.682.endobj.16 0 obj.<</Length 17 0 R/Filter /FlateDecode>>.stream.x..U.kT1........4..I.....U.........+.VZ...N.v_.dO.w/..\|3_f...Z.r..k.\|.^......5?}.2...Ee.\........9..1.RJ......[."!<..Lp.Y.!.$n..s&g.N5...(...[2(...1...

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\PCID2708517.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8143360
Entropy (8bit):	5.428415647806487
Encrypted:	false
SSDEEP:	24576:nCiRCYxo1unnnqJ3ZT8WKFIyWS5k3xf9xmnUGEGDi7rRtF9bHbGDLJciNX4AfV:guSz3V8/vk3x9xmmHUOiNX4AfV
MD5:	DF68458416F4C34C5108863E4DB305F3
SHA1:	92250F8428AB610DAC5B4F5C3829CEED834BEF30
SHA-256:	DD9588A5E3EC063832A1749CCE51987FDCBC4EE57410B337B29D53E1660478F0
SHA-512:	3E12F02E0C20C01BE24D814A282B7BBF9B561A289460268FC256FD92A95A9146B70966A81F98D4D4EFD66ED6BD82BB52E0AE4461CAED3D66C1C9FDCB76A7F53E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....W...........!.....8\|..........V\|.. ...`\|...@.. ........................\|...........@..................................V\|.O....`\|.0.....................\|.....,V\|.............................................. ............... ..H............text....7\|.. ...8\|................. ..`.rsrc...0....`\|......:\|.............@..@.reloc........\|......@\|.............@..B.................V\|.....H.........w.\|q...........+....l..........................................0..r........(......}.....s....}.....{....#.......@o.....{...........s....o.....s....}.....{.....o.....{...........s....o.......0...........{....o .....}.....{....{p...9.....{....o!...9.....{....{o...r...po"....{....{o...r?..po"....{....{o....{....o#...o"....{....{o...ri..p($........>...o%...r...p($......(&......('...((...o"....(....}.....{.....{....o....:.{.....lo...."..}......(....*b+..2()....(.....

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\de\PCID2708517.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3772416
Entropy (8bit):	3.6234227776657786
Encrypted:	false
SSDEEP:	6144:yhnnnQcccIG/Ur84sHnYvP97PwBPj3yubTveszVWAh2DJHY+KWErgy:yhnnn0Xw4s4NbwlDbb77zVRQDJH9DO
MD5:	C6CFC790DEFE336DC9A9FA8F04B8C95C
SHA1:	21B3092835145DDE69DD14CE67F42583BEF99008
SHA-256:	32DE74C97BB067A9AA2A9A433ADCC2D92EBDB024B76C5EE43C9B04A348916F51
SHA-512:	6543054A70DF940E9A66B455A811CD148462CE103D1DCD1064A90D71A9F51FFC2C6DFB971C14A4A2A8238F96FC1D0B103D1A9C82D6DBA4CC4EDCE161A33AB750
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....W...........!.....`9.. .......s9.. ....9...@.. ........................9...........@..................................s9.K.....9.X.....................9...................................................... ............... ..H............text....S9.. ...`9................. ..`.rsrc...X.....9......p9.............@..@.reloc........9.......9.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\zh-CHS\PCID2708517.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5959680
Entropy (8bit):	4.857698988306001
Encrypted:	false
SSDEEP:	12288:r4HbwNAoGQaktEF9XtnK/tN2BvMfvjl2H2BzC59377w4dCkD2b77dVRQ4JH9DgOa:sHb0qXQ/LsoMwCCkDi7rRtF9
MD5:	1B46DCFE73F4A9CA42686DDCEB776667
SHA1:	7FCE002529A498BA31219207BD59F1605FEC67C6
SHA-256:	B68E72C2F427EFAD15FD00C35479954B213C5ABA8CB106556018DCA0465420EC
SHA-512:	E5C7547C88549E61B2F98C0B82A2308CA58446C8F3D56DD86485C58DEC708F3378E98E5A1D7112ECD5CD8C6D77D3AE656E434E8A5641A561DE5249D280788C2A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....W...........!......Z.. ........Z.. ....Z...@.. ....................... [...........@...................................Z.K.....Z.X.....................[...................................................... ............... ..H............text....Z.. ....Z................. ..`.rsrc...X.....Z.......Z.............@..@.reloc........[.......Z.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\ModbusLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.275542302419595
Encrypted:	false
SSDEEP:	768:jFRHaFqz1KmeCEMDhFf/iHCoNWfDX0q2LT7:jX1reCjDNoNWf4q2n7
MD5:	C03E258BC2D9F57DD886D3181F8709BA
SHA1:	1E387CFDC5F332DC6DAB5A25745B42842ECB2830
SHA-256:	32C58021CECEDA30BDCB118CBD72E3C07772A51B7E13F6EB9FFFF6A9B155B55F
SHA-512:	A92550DB4FBCFCF30C0CA75BE824206CF9BB0BB5765803B7D55FB934BD6DFCEE2F6B60C6854DF9469761BF96129F74F80900027F2A3C28470CD83E6B5DB57D4E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....fU...........!.....p... ......>.... ........... ..............................U.....@....................................W.................................................................................... ............... ..H............text...De... ...p.................. ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\PCID2901540.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6407680
Entropy (8bit):	6.656195373375258
Encrypted:	false
SSDEEP:	49152:AXglPX5M7BoAs6gqAeaDzh9QAPPsjxZLFuFkMNBJhPHSQ:AQlPXqHqUjxZLzaL
MD5:	0B8DA3D1A2C95F5264D0F87FB94E879D
SHA1:	BF8262C539A7610F61FD259559FC72E6158EB595
SHA-256:	564ECFD27020789987874B85B3E9F99ADAEE639BF715B90B104FCA4DB94AD3ED
SHA-512:	C133B8E9C9EA80C092EF9B1FAE138489A043314E0CF97E4540EAB261A79A7075557E7E4CF54F8C9D9DD217BE5896D96EF5340378914CCBF47747FD0BDB08AEE1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......].........." ..0...a.........f.a.. ....a...... ....................... b...........@...................................a.O.....a.......................b.......a.............................................. ............... ..H............text.....a.. ....a................. ..`.rsrc.........a.......a.............@..@.reloc........b.......a.............@..B................H.a.....H.......................\...zU.........................................f..(,...s.....o-...&s....zR..(....s.....o-...&b.({......(.......s....zV.({......(....&s....zb.(......0(.......s....zV.(......0(....&s....z....0...........g................................................................................+.......X....X.....g2..,...1...Q...R...,...Q...R.........+B..3.~ .........Y...+.............../...s0...(...+.....(........X.......i2...i.3/...Q...R....+!.............

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\de\PCID2901540.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1822720
Entropy (8bit):	5.286408808326983
Encrypted:	false
SSDEEP:	12288:6GSxqZZ1HKHcz+ZvTJa7SSJ3ph2lEEo7fddsdddOCCZMEEo8EzIJ1tvOOtEEEoDA:6PM3HK0uvyph28fddsddddEzIJJEzlS
MD5:	4C175316874C05E4B96A4DA67DA7E447
SHA1:	D9DA50FC85945D62ED1A3C7FBA95CE590E4E46D3
SHA-256:	C70580EAF905CD7C761C2234CA01B2C35DA79353605253ED055AFE3A68C16CB9
SHA-512:	771C4789B96F24286CC474BD099C6ED13E9AF9D288F7F278CBF45849CCC84A3E48DFD6F2F19084E96A693628F15E3A0DFEFDA4A8B955E7EB819F3FE754B2A099
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]...........!......... ........... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\modbconf.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.631581329956364
Encrypted:	false
SSDEEP:	3:U246mWFsG8+iYh/HYYL85tq9qYL8n6y31Y3VO:naN+iYJ4YA5tBYAn6yMVO
MD5:	3E5418C4E7E9DC9ACFE71127B455B084
SHA1:	8B1C6B323943D834706D029EFA829BD44DD74CBE
SHA-256:	15C3B96F195AF135766F99C55A5C4B79BD64EB42D21B5F1FFA2D8816E97B5F8D
SHA-512:	D1972A02B83085174A9D08328D0284665A97FA56D5DCDE70DD8B5F9B49590F2D88E148CB578C2D5D9805BA6FC441EAA1260517CC951C67883DED3E8B254269CF
Malicious:	false
Preview:	.<MODBUS_LIB_CONFIG TIME_OUT_CONFIG="2400" TIME_OUT_SEARCH="400" TIME_OUT_READ_WRITE="800" />

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\zh-CHS\PCID2901540.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.3360548746217953
Encrypted:	false
SSDEEP:	48:63/vA/kpvClm6GpiHLXID6Obyfe/3wOy96ZgE5wUlb6kUeiO:tkhClm6V4dbvhc6KQpZ6k
MD5:	E9CFF9D3AECF7BD7B8D92D300F7B297D
SHA1:	DC88A7373CECD331D336EFFDEAB5E9E21F1A6893
SHA-256:	53AD2B2A19CD12EF75868CA1AAF046E48F3FD8416D73ED3CC642C665E254790B
SHA-512:	F8E6396D4A8BB88FA35FE455C1EC365FF85D5B53A013FC8835D5F8AAC206EAFB24755BEB6A73D48200EA13B594240F1964BDC4C6F581E9E717C954E672350650
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]...........!.................&... ...@....@.. ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................%......H........!..............P ..S...........................................O..............lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.p....a.#............s.D.e.v.i.c.e.C.a.t.e.g.o.r.y..... s.D.e.v.i.c.e.N.a.m.e.E.r.r.o.r..........9..............256.....BSJB............v2.0.50727......l.......#~......x...#Strings........

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\ModbusLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.275542302419595
Encrypted:	false
SSDEEP:	768:jFRHaFqz1KmeCEMDhFf/iHCoNWfDX0q2LT7:jX1reCjDNoNWf4q2n7
MD5:	C03E258BC2D9F57DD886D3181F8709BA
SHA1:	1E387CFDC5F332DC6DAB5A25745B42842ECB2830
SHA-256:	32C58021CECEDA30BDCB118CBD72E3C07772A51B7E13F6EB9FFFF6A9B155B55F
SHA-512:	A92550DB4FBCFCF30C0CA75BE824206CF9BB0BB5765803B7D55FB934BD6DFCEE2F6B60C6854DF9469761BF96129F74F80900027F2A3C28470CD83E6B5DB57D4E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....fU...........!.....p... ......>.... ........... ..............................U.....@....................................W.................................................................................... ............... ..H............text...De... ...p.................. ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\PCID2901541.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6367232
Entropy (8bit):	6.615820897826126
Encrypted:	false
SSDEEP:	49152:NdJVXOH6S0FnI9jByugYmX3lLuXAYe47jfnZ:NdD26S0FnINKX3lZY
MD5:	3C3E85D209E48C60E066F6681B64F3F8
SHA1:	D1FC714F86072C6706695FDE9399F51983FD08BB
SHA-256:	33746BCE5B955462BBF4FACFEB131A8EB44372C34F0E1917B303289ECAF73FEB
SHA-512:	B66656015D3B6F7BB6D21C3DA97B57F0CFB8E01A402A9B43B17B5E695939D785B33A8EFE78DC1176EF5FA27FDEEF5756CAA6CEECF7DC324C32F429438B79707D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N._.........." ..0...a..........9a.. ...@a...... ........................a...........@..................................9a.O....@a.x....................`a.....h8a.............................................. ............... ..H............text.....a.. ....a................. ..`.rsrc...x....@a...... a.............@..@.reloc.......`a......&a.............@..B.................9a.....H.......@...xS...........r....U..........................................0..L......... ......+8.....+(.._n...._...._cj....d.a.+...d...b....X.....2...X...2...a.0.......... ..D!....i(.........(,.....{...."..}......{...."..}....~.r...p(-...}......;}.....(,.....(......}........{....s....}......0..H........{....-...{......{....s....}........(....-.....(.......(.....{....o/...&...(....*...0..^.............+6.-.s0....+...{....o1...&.,...o2...-.....o3...&..X...X...{....o4.

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\PCID2901541_HG.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	5.014829538425208
Encrypted:	false
SSDEEP:	384:agmGD8BCVyouWUJiR0qXT/0PnnH+VtX4zEQ49ueOo39iAaFFJZ:hD8cVMJiVynqmsdx3w3Fn
MD5:	6B2C7BB726F707208798908A528C2214
SHA1:	5D3FD5784F5A3365D3CDD13FB892E90B6ADC7AE7
SHA-256:	C7778ADE676C32122DC9331867C3D0F1E6422FFB2674B57E953826D71DB5E994
SHA-512:	8C7B9C58C170AEDE90176E21C4474BBDE0E8554ED9E7E5B8DA256BB9C22E30F71E613FA16E1557EDC10B92C40930E3972132DD2FC9B8E52C26C954DF87D6178D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...wp.R...........!.....r............... ........@.. ....................................@.....................................O.......P...........................$................................................ ............... ..H............text....q... ...r.................. ..`.rsrc...P............t..............@..@.reloc...............z..............@..B........................H.......l{...............................................................0.. ........:.............................................................................+.......X....X.....:2..,b..0^~......Y..........s....(...+....+3.........(....,.........!.!.......!(............X......i2.+...Q...R.*...8......".".YE............%...5...E...U...e...u...8....~.........Y...+y~$........Y...+i~3........Y...+Y~B........Y...+I~Q........Y...+9~`........Y...+)~o........Y...+.~~........Y...+

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\de\PCID2901541.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1867776
Entropy (8bit):	5.152335273101027
Encrypted:	false
SSDEEP:	12288:lGpXa7SSJ3ph2lEEoofddsddd61168EEo5EzhfPW98tvOOtEEEosEzlKOh6OOtwC:lGKph2tfddsdddlEzhX6REzlJh
MD5:	220820175CC203249A8DD64A20C5CAA8
SHA1:	7C77F19B0003127167BE6E4D1B0F78E7814BD3C0
SHA-256:	EF426C4C5BF67F03DB03D91FA9F14E435A320908604A23FB19B8F5C6A5189C20
SHA-512:	3A8A732558666571176D0E909A1A4692CE51F7F68704362E079D93769B1A5640E4BDC565A8A67174E1DE363EFC9B412860373A443368613815E3582320672024
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N._...........!.....P... .......c... ........@.. ....................................@..................................b..O.......p............................................................................ ............... ..H............text...4C... ...P.................. ..`.rsrc...p............`..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\modbconf.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.631581329956364
Encrypted:	false
SSDEEP:	3:U246mWFsG8+iYh/HYYL85tq9qYL8n6y31Y3VO:naN+iYJ4YA5tBYAn6yMVO
MD5:	3E5418C4E7E9DC9ACFE71127B455B084
SHA1:	8B1C6B323943D834706D029EFA829BD44DD74CBE
SHA-256:	15C3B96F195AF135766F99C55A5C4B79BD64EB42D21B5F1FFA2D8816E97B5F8D
SHA-512:	D1972A02B83085174A9D08328D0284665A97FA56D5DCDE70DD8B5F9B49590F2D88E148CB578C2D5D9805BA6FC441EAA1260517CC951C67883DED3E8B254269CF
Malicious:	false
Preview:	.<MODBUS_LIB_CONFIG TIME_OUT_CONFIG="2400" TIME_OUT_SEARCH="400" TIME_OUT_READ_WRITE="800" />

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\ru\PCID2901541.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1728512
Entropy (8bit):	5.042968339757395
Encrypted:	false
SSDEEP:	12288:bq1GpF250PfSSJ8EEoofddsdddGqqhwEEosEzO1Mrb222c0003EzlkLXfBDHCpL6:ofddsdddREz+EzlTHD
MD5:	FD61B57B404677EB2C679989F3F5481A
SHA1:	AE3BAA2EADF1752B10982BA49F8E77494EC8EBFD
SHA-256:	51CB0AF18E575EAC167DA7B935E67B8144C546DD224FE3F5968420ABA6792ADF
SHA-512:	6905551A75078AE4A42FECD6B3C90BCB451E2C82DCFD084537F67E7697FD255435A6ABC4B6879F44563E57A39075B82573281B0F77D0426C79564CD3C6FB251D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N._...........!.....0... .......@... ...`....@.. ....................................@.................................\@..O....`..p............................................................................ ............... ..H............text.... ... ...0.................. ..`.rsrc...p....`.......@..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\zh-CHS\PCID2901541.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1683456
Entropy (8bit):	4.9583615004884445
Encrypted:	false
SSDEEP:	12288:QIGaPfSSJ8EEoPnfddsdddBIIIU000PEzlsrb222c000IEzlUpppMuuNcEEoL:Hnfddsddd4EzYEzl9
MD5:	C34BBF62177CAD8DB9A6B06267983F31
SHA1:	CD2C87E53938E40E22674A9A708EC36C65F39E3F
SHA-256:	DDBA7B7A8B56FAA82A6410CF42A69CA23B04CA37E1701282E5F88A91CB1FCD66
SHA-512:	4B52FC76B3F603717D193A9AAB759DACDB8731B4EC3C9F5CF7F4761163B390AC7F4C5C6D2B16C35AA6798B27233E6F404B9C08862A74F1E1902D2B55AB2FC19F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N._...........!......... ........... ........@.. ....................................@.................................8...S.......p............................................................................ ............... ..H............text....w... ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\ModbusLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.275542302419595
Encrypted:	false
SSDEEP:	768:jFRHaFqz1KmeCEMDhFf/iHCoNWfDX0q2LT7:jX1reCjDNoNWf4q2n7
MD5:	C03E258BC2D9F57DD886D3181F8709BA
SHA1:	1E387CFDC5F332DC6DAB5A25745B42842ECB2830
SHA-256:	32C58021CECEDA30BDCB118CBD72E3C07772A51B7E13F6EB9FFFF6A9B155B55F
SHA-512:	A92550DB4FBCFCF30C0CA75BE824206CF9BB0BB5765803B7D55FB934BD6DFCEE2F6B60C6854DF9469761BF96129F74F80900027F2A3C28470CD83E6B5DB57D4E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....fU...........!.....p... ......>.... ........... ..............................U.....@....................................W.................................................................................... ............... ..H............text...De... ...p.................. ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\PCID2904909.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5725184
Entropy (8bit):	6.50483391410872
Encrypted:	false
SSDEEP:	49152:ekVkxWnI/jBJEYvW/mlLuvY5lGZddsdddSe:JWWnIDGmlkYSZddsddd
MD5:	D09AD7CB84E0D5F84245F794FE585BF3
SHA1:	B428BF3AD2A49CBFCF91E7A5FEFDB65140783FB1
SHA-256:	66DB593301C617E46C1C65D5410514CE80B9AB06ED6582D00FC8C68A043E5A94
SHA-512:	9B8A9AE9D40C09487FAC08C5184135D6C7780BD1F147D258BE0F924054C17ACBC4114292985A76AD8FC368C8D89A10345816A90DBE60E56853200CE54771A39E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;0^.........." ..0..RW..........mW.. ....W...... ........................W...........@..................................mW.O.....W.x.....................W.....llW.............................................. ............... ..H............text....PW.. ...RW................. ..`.rsrc...x.....W......TW.............@..@.reloc........W......ZW.............@..B.................mW.....H...........,...........<...0.M..........................................0..L......... ......+8.....+(.._n...._...._cj....d.a.+...d...b....X.....2...X...2...a.0.......... ..D!....i(.........(,.....{...."..}......{...."..}....~.r...p(-...}......;}.....(,.....(......}........{....s....}......0..H........{....-...{......{....s....}........(....-.....(.......(.....{....o/...&...(....*...0..^.............+6.-.s0....+...{....o1...&.,...o2...-.....o3...&..X...X...{....o4.

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\de\PCID2904909.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1703936
Entropy (8bit):	4.915561186000932
Encrypted:	false
SSDEEP:	12288:arGpEaneedEEEosZddsdddqss3MEEopEzAJDra7OOtEEEoQxaeedwEEo3k:aiSZddsddd2EzAVH
MD5:	4764929C846922050A3EACAF680BC0F3
SHA1:	2D20FEFAC059A3B5D9231212BE9D73A297F4E3BE
SHA-256:	EFEB9715ACD4C6AABB4CFCF39A5FB8EF90C39E61AFA0B02B6DA3831E73370175
SHA-512:	AB711FFD96966F79186DFFAD03AA75A2AD28EF55550B766858FAB938FFB3082C39DB0457A66533EB41E1A8A3F262B4FF02150C5A4EC096FC3CDCC9EAC3867819
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;0^...........!......... ........... ........@.. .......................@............@.................................h...S.......p.................... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...p...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\modbconf.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.631581329956364
Encrypted:	false
SSDEEP:	3:U246mWFsG8+iYh/HYYL85tq9qYL8n6y31Y3VO:naN+iYJ4YA5tBYAn6yMVO
MD5:	3E5418C4E7E9DC9ACFE71127B455B084
SHA1:	8B1C6B323943D834706D029EFA829BD44DD74CBE
SHA-256:	15C3B96F195AF135766F99C55A5C4B79BD64EB42D21B5F1FFA2D8816E97B5F8D
SHA-512:	D1972A02B83085174A9D08328D0284665A97FA56D5DCDE70DD8B5F9B49590F2D88E148CB578C2D5D9805BA6FC441EAA1260517CC951C67883DED3E8B254269CF
Malicious:	false
Preview:	.<MODBUS_LIB_CONFIG TIME_OUT_CONFIG="2400" TIME_OUT_SEARCH="400" TIME_OUT_READ_WRITE="800" />

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\zh-CHS\PCID2904909.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.516196023236819
Encrypted:	false
SSDEEP:	48:6/qHZazhkQKSlm6GisiR6DCwKtFOey3wOy96ZgE5wglrI6tAyk:hYhkIlm67L6mwKtFKhc6KQdy6t
MD5:	C4687F40457C935063E7A3327E5B1FCF
SHA1:	3829D73F858BA2E90D8DD055296CAFDA696B31D1
SHA-256:	41DB742F0117D558AAD87CD5B31AEAA48B0CD99D385F5A9A6431FA805D34A057
SHA-512:	D3C7F5D63899E0B29E5BFB8AAF8D54A0DFAD7CE385F0610F08E6BA04F05D45E2D6FCBE0C88B39B4DA862524440EB9063AF6E2F16B21C9D3F3F4D89F9B9005663
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;0^...........!.................&... ...@....@.. ....................................@.................................<&..O....@..p....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................p&......H.......("..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADPzI...p....a.H...#.......=....s.D.e.v.i.c.e.C.a.t.e.g.o.r.y..... s.D.e.v.i.c.e.N.a.m.e.E.r.r.o.r.....$s.T.o.o.l.T.i.p.R.S.S.I.M.o.d.b.u.s.C........9..............256.....R..RSSI value.

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\GetActiveProxy.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27512
Entropy (8bit):	6.1109124934614405
Encrypted:	false
SSDEEP:	384:fCNYUF0jy26pMy26DcFaIC0Nq/IWy/U2v0nYPLeJa+OUZJW:Yo+W+DuW/E828E+D4
MD5:	BEBBAE4E39F35D231345E1BA4F7290AD
SHA1:	5F7A31BEAC9E362C37D9F326DE71EBC9874C2389
SHA-256:	F68AAFF06CBDB2EB3DE83E67CB917BC8B2B91D80BDBA2875D3AFABB4B8BC1C1B
SHA-512:	ADC08DD1CE29E608442BC63CD6F33A32417396356785F152B3190887BA0BA749C72EF6BC9A0BC835A1D26B7AD92DDA928B618A2C48DF283E071463E5B3485DE9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......^.........."...0..............L... ...`....@.. ..............................N.....@..................................L..O....`...............N..x...........dK............................................... ............... ..H............text....,... ...................... ..`.rsrc........`.......0..............@..@.reloc...............L..............@..B.................L......H........,...............................................................0..{........r...p}.....s....}.....(......}......YE....C...........+$...s....(.....(....,+...s....(....r...p........o....(....s....zv.r...p}.....s....}.....(........0...........(....s.....r...p...8.....o......r...po....:......o.....[3B...o.....Yo......{.....o....,..{.....o.....+`s......{......o....+K.,=..=o .........#....o..........Xo!..........o"...+.r;..ps#...zr;..ps#...z.o$...%.:D......o%....*.....

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF AutoUpdate.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	64525
Entropy (8bit):	7.9961609762612555
Encrypted:	true
SSDEEP:	1536:6XFAtpRAE5UZDSLXudENQxCIypK77gHcIGTmFWS78wP15:8FAt3PGSidEWYIypKfDIExDwPn
MD5:	6C4B6EC3261F09F10737CDDA984E7B9A
SHA1:	88B8031E8750BD2F0E0CAB7B41064578367B3E97
SHA-256:	12ABEC0966013E0FFB001CB4D7420446B296D7C084916025127D404E5612062D
SHA-512:	5EA0AC8EC5B6075314BF2CBC7DC6E29C7624867D1A5A0A6D1C5DA99BC410A6E5E6150B17A5C50D2051985382501B2B41122496534DE54782BD3599BFCE116779
Malicious:	false
Preview:	PK........7;.P................_TUProj.dat...q.+.w.....>....{..5...p.k..@..).......j..........R.....S,r7kA@....Eu..mSO.6j...>F.00....p..]l....[,..k..v5.$t..@...\....H:%:.Z...j<.HXm...d...]W.[.[..ps..e.\..!:.b....\|.^q.\..D=G....=b.O..iNg.O..W@.7(;..............9.z.g6..B..!...f[]..E..6."NI......v.. T.b.kI...,XU.x&l....09d..;.j.<..."..+.PyNx.z..H!B16..%.Jmq@/.x.z..5....=.....]......%.u...N....9E....]..`..\|.kVX.......Ru.u.tP.e...n.i.......N.O..N..p...P#._.L..W...\%Q.......).de.V2@.m.p...=}L.^V.v.#.8.-...D4......5.=...r...K..... .0...B{q.....+>l.T.)h...!H[=.ZCT...../...#8w.t.Cs.t.....r..^c.s....^.B,'(.....~.....}.....Lk.......N&..v_....YD.XL..t;..D..\|.../_N'..K..%..._t..6..T.<Jg..s.R......(mW(.kj.e\|.a..#.....'.....e...0x.....;...jf.b.:..9$..H..._...............,:.4...].^.w....*.J.3.G.g......]...;O......6Q.d.?l.+.C#C...6.k...........'3.<v....A4..1...V...!eA.y..........`){[.?Di......tF.{.....c^..q.}..U.....#^.c^.....P\|.93.......d.&Q(...f.\.{]...

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF AutoUpdate.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1240440
Entropy (8bit):	6.439729964960623
Encrypted:	false
SSDEEP:	24576:sQD1jCCYOU8K6HgqgUoxOElOaqf9VGSuxxitMBZD5W+f5M4NbbX:sQDYNxORLVX8W65M2br
MD5:	ACC823D15ED0A9358643E715CFB88DD0
SHA1:	B62FD53EF497CE9F3F4B3C1FC0EF920698DC48D9
SHA-256:	979B9D9484195DFA3190BB13F2E7F60EDBCC95297AA47505A0CAA0FD35DFD31F
SHA-512:	0A67C57621466291F270BD6A2DAB22B50276995B93C55846FD6BDD6B7FCA5A0C79FEF0D2FF867FF14CC3780C7B91A6288F99B9AE6B32E317BD003F6330ACBFD6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ao..%.s.%.s.%.s.s.`...s...}...s.q-C.?.s...y.(.s.%.r.y.s.G.`.<.s..(y...s..(x...s.%.s...s...u.$.s.Rich%.s.........PE..L.....?L.................0..........&........@....@.................................20..........................................h....p..4...............x............................................................@..,............................text....+.......0.................. ..`.rdata.......@.......@..............@..@.data............`..................@....rsrc...4....p.......0..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5014064
Entropy (8bit):	6.035747027676116
Encrypted:	false
SSDEEP:	24576:+9wEXtMvlPg9bjTBu49YsKk2ELTQUOlJXOpJCLrNo7Fddz21d2Yo:+9Mvli1u49YsKk2EcXOpJCLrNo5dL
MD5:	8F6908A3C2F22EE306CC55D7CFA08320
SHA1:	6E286485E0EEDAB7D978493911F9E6F1621E4138
SHA-256:	6B287EB4BFE5B551923F3401F6535E9181670F2B2E8967224CDD26BCB26C9B7E
SHA-512:	A08E6E673B2BDFA777ACD1BC1C80F7BFE4E6A980523A1C1080BA2C2001D1AD2C7E1D48FABEE88B9F52E6F0A54BE6CAF09E9FD24F715BD92A2AA4A7E9F4E9CAD4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....M._.........."...0...I..x......6.J.. ... J...@.. ........................L......L...@...................................J.O.... J..u...........dL.0.....L.......J.............................................. ............... ..H............text...L.I.. ....I................. ..`.rsrc....u... J..v....I.............@..@.reloc........L......bL.............@..B..................J.....H........(...E......n....m...G..........................................0..)........{.........( ...t......\|......(...+...3.....0..)........{.........("...t......\|......(...+...3.....0..)........{.........( ...t......\|......(...+...3.....0..)........{.........("...t......\|......(...+...3.....0..)........{.........( ...t......\|......(...+...3.....0..)........{.........("...t......\|......(...+...3...{...."..}......{...."..}......0..........s#.....{....,..{......o....*

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	5.015094985614157
Encrypted:	false
SSDEEP:	24:2dqtKPm4VK99ANK149GF7nbqcfke+ykvrh2N:cweNV89ANN8FDbFd+ykjw
MD5:	86C62D84005BCFA45EDE51C9DA4DEB4A
SHA1:	BCAECB7863D7775990D0D6714582992E0BA618A3
SHA-256:	0C51BDC0248DCDF43FEBB0DFDF03C53B04B9201BAB665DBFF48F7ACF5919394F
SHA-512:	428BC99A942A57FDD3D4EB3B80717B68036E0AAE1A2D65C2C703738D84A8585803B5EC2F95A9DC88EE594F26C24BC0D923F9EE05688E0DD1F2B4D5188DC80502
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <sectionGroup name="applicationSettings" type="System.Configuration.ApplicationSettingsGroup, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">.. <section name="FrameApplicationSerialIFConfTool.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false"/>.. </sectionGroup>.. </configSections>.. <runtime>.. <legacyUnhandledExceptionPolicy enabled="1"/>.. </runtime>.. <applicationSettings>.. <FrameApplicationSerialIFConfTool.Properties.Settings>.. <setting name="PSI_CONF_localhost_Service1" serializeAs="String">.. <value>http://localhost:55890/Service1.asmx</value>.. </setting>.. </FrameApplicationSerialIFConfTool.Properties.Settings>.. </applicationSettings>..<startup><support

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PhoenixResourceManager.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.7153635558795
Encrypted:	false
SSDEEP:	192:dqn5dCWmuJoLRd+X/wVdUPV0vtVEsPs4:dq5kWmuJ8QX/wVdUOvv3b
MD5:	432F18D0AB92CE5F3D072E4B288A53CF
SHA1:	2A63690A92F0B5FDE276FFDE070FD7220C59FCB3
SHA-256:	1AE20B2CF8929D5BFDCA90848E2D56616B5DBB9DE8B5FE311043CE82C7645337
SHA-512:	902F955FBC312F3592F86B6AD6EE66EBCD7B0118CFA5AD1BC91914EBF8CE82BC512BC8D003B6C184E06898D3D0BD434363A444EF697C891E22DE3344205F65D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....E[.........." ..0.............~;... ...@....... ....................................@.................................,;..O....@..h....................`.......9............................................... ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`.......$..............@..B................`;......H........#..T.............................................................{...."..}....>..(......(........0................(....(......u....,..t.....o.....u....,).t.......(....o....o....t......,<..o......(....o....o....(....-..t".....(....o....o....o......(.....~...........j~..........%...(....t......(....~..........%...(....t....z~..........%...%...(....t.....~..........%...%...%...(....t.....~......o....r...p(....-.......(....o....,.......*r_..ps....z..0......

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Uninstall\IRIMG1.BMP

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PC bitmap, Windows 3.x format, 497 x 63 x 24, image size 93996, cbSize 94050, bits offset 54
Category:	dropped
Size (bytes):	94050
Entropy (8bit):	2.2763927368055277
Encrypted:	false
SSDEEP:	192:zxQMerxCcxQX4RNy1RMdAE1MYFbw71NiNrtN4/5T:t7evxQX4Hy7MdAE1MYFbw71NiNrtN4/Z
MD5:	8EDCCEB1AB1209C16C36677FFC242F05
SHA1:	FE2BA3B05A22C0EF9638A61DEFDC72D835B12B23
SHA-256:	27937B5E40F1981EC50A03A12276AB7812D41475AE6862ACFE4F596194364DBD
SHA-512:	AE6CA31BA9FAE45B0BFD8D761C71C2ED3EB80D0F29D9CDB3419E964016E15AFAA443D5C0C670AB01BD472B8D925E6DF51690A041428F3744C2B32685F488FD23
Malicious:	false
Preview:	BMbo......6...(.......?...........,o....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Uninstall\IRIMG1.JPG

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS2 Windows, datetime=2008:07:08 14:20:15], baseline, precision 8, 166x312, components 3
Category:	dropped
Size (bytes):	29054
Entropy (8bit):	5.195708227193176
Encrypted:	false
SSDEEP:	384:wjV66AV66RU53DaYNg7y5fJ+dwd7L/dSivXHk4eo:wjs6As6R4aYyCfToi7R
MD5:	AC40DED6736E08664F2D86A65C47EF60
SHA1:	C352715BBF5AE6C93EEB30DF2C01B6F44FAEDAAA
SHA-256:	F35985FE1E46A767BE7DCEA35F8614E1EDD60C523442E6C2C2397D1E23DBD3EA
SHA-512:	2FBD1C6190743EA9EF86F4CB805508BD5FFE05579519AFAFB55535D27F04F73AA7C980875818778B1178F8B0F7C6F5615FBF250B78E528903950499BBE78AC32
Malicious:	false
Preview:	......JFIF.....H.H......Exif..MM..............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS2 Windows.2008:07:08 14:20:15........................................8...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................U.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...J....X.Z..l.i.........jl....p............\\.I<...=..v.....(..A.%.P.'!."UI.I....z.u...wq..*..hc4kt.6R.7H.Z.[.#O..O

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Uninstall\IRIMG2.BMP

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PC bitmap, Windows 3.x format, 497 x 63 x 24, image size 93996, cbSize 94050, bits offset 54
Category:	dropped
Size (bytes):	94050
Entropy (8bit):	2.2763927368055277
Encrypted:	false
SSDEEP:	192:zxQMerxCcxQX4RNy1RMdAE1MYFbw71NiNrtN4/5T:t7evxQX4Hy7MdAE1MYFbw71NiNrtN4/Z
MD5:	8EDCCEB1AB1209C16C36677FFC242F05
SHA1:	FE2BA3B05A22C0EF9638A61DEFDC72D835B12B23
SHA-256:	27937B5E40F1981EC50A03A12276AB7812D41475AE6862ACFE4F596194364DBD
SHA-512:	AE6CA31BA9FAE45B0BFD8D761C71C2ED3EB80D0F29D9CDB3419E964016E15AFAA443D5C0C670AB01BD472B8D925E6DF51690A041428F3744C2B32685F488FD23
Malicious:	false
Preview:	BMbo......6...(.......?...........,o....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Uninstall\IRIMG2.JPG

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS2 Windows, datetime=2008:07:08 14:20:15], baseline, precision 8, 166x312, components 3
Category:	dropped
Size (bytes):	29054
Entropy (8bit):	5.195708227193176
Encrypted:	false
SSDEEP:	384:wjV66AV66RU53DaYNg7y5fJ+dwd7L/dSivXHk4eo:wjs6As6R4aYyCfToi7R
MD5:	AC40DED6736E08664F2D86A65C47EF60
SHA1:	C352715BBF5AE6C93EEB30DF2C01B6F44FAEDAAA
SHA-256:	F35985FE1E46A767BE7DCEA35F8614E1EDD60C523442E6C2C2397D1E23DBD3EA
SHA-512:	2FBD1C6190743EA9EF86F4CB805508BD5FFE05579519AFAFB55535D27F04F73AA7C980875818778B1178F8B0F7C6F5615FBF250B78E528903950499BBE78AC32
Malicious:	false
Preview:	......JFIF.....H.H......Exif..MM..............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS2 Windows.2008:07:08 14:20:15........................................8...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................U.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...J....X.Z..l.i.........jl....p............\\.I<...=..v.....(..A.%.P.'!."UI.I....z.u...wq..*..hc4kt.6R.7H.Z.[.#O..O

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Uninstall\IRIMG3.BMP

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PC bitmap, Windows 3.x format, 497 x 362 x 24, image size 540104, cbSize 540158, bits offset 54
Category:	dropped
Size (bytes):	540158
Entropy (8bit):	0.18734821857142886
Encrypted:	false
SSDEEP:	192:KNvB8/qrIY5hGG0zGGGG63GGGEGqyGRMAeV:8vB8PYfTeV
MD5:	CD6B4F5490483B9D1BEB9600625DAC28
SHA1:	35F9077719C48D31A0BD45EA08761A75E6139285
SHA-256:	3F8A8C8698CECE5CEB6B96062B5C7ADE7CAB8375F8878D40E51E8CFD413321E9
SHA-512:	AEDB2EB624CA0EB485ED4294B9F958905961CE7AD86A70CADD7544EB2BA9E44D09FB0D038634C80216F34178675204B58B5676AAC25C6A386C7D41E310D795AA
Malicious:	false
Preview:	BM.=......6...(.......j............=....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Uninstall\IRZip.lmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	344064
Entropy (8bit):	6.284097757286593
Encrypted:	false
SSDEEP:	6144:F3BU3fvbdCpw73HIpXr2SzywQ5jTYrcSEeAImb+Zq:uvbAkIp72Szy55jTYiIDZq
MD5:	FCF0D70F428B081937103D32889535B8
SHA1:	A703030F601E5840D4718D570C4F59A4FF735158
SHA-256:	B1D22E20B8225402B76387421D0F1E10986724D4D9DAC1441DE2530507AA913C
SHA-512:	AD0DD0AC2046A19EAAF14B9FCA99F770446F8C211F1506DC86795BC763A823421EB391945E1F0536D41BC3F8706D9F05A53BC61C3CE34BCCBFCD39F6B66A9468
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n.........................................`...f......../.......,.......)..p....)......"......../......Rich............................PE..L...3..H...........!................-........................................@..........................................Z................N......................t-......................................................\............................text............................... ..`.rdata..ZR.......`..................@..@.data...,...........................@....rsrc....N.......P..................@..@.reloc...H.......P..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Uninstall\uni5359.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	data
Category:	dropped
Size (bytes):	219862
Entropy (8bit):	6.122545127264105
Encrypted:	false
SSDEEP:	3072:xvW0XGl6b15OCOV/Bv7YNRNcLfK2I9ZTO0xK80hNomh7VC:x7i7YfK+2IX60xmC
MD5:	A2342EB6351E213C49376466FCDD13D7
SHA1:	C7E420AB8AC0CC037EC7F9B624397A0B16F8E46A
SHA-256:	774DB386708BCC5D84E0904891F4DD7A8127B8604CA2DE30C128FFDEEF03A364
SHA-512:	0B032E4EF834E9433E55BBEC5C6CFF1112ABB6D4E8DFDEDC7D945F38B07D6F901B1C465FAE12C3EDB240705AF5713FECA5468EC7D99B73B9BA865A923C4AFD70
Malicious:	false
Preview:	2...............CGlobalIncludeLuaFile.........Constant Definitions.JPMB_OK=0;..MB_OKCANCEL=1;..MB_ABORTRETRYIGNORE=2;..MB_YESNOCANCEL=3;..MB_YESNO=4;..MB_RETRYCANCEL=5;..MB_ICONNONE=0;..MB_ICONSTOP=16;..MB_ICONQUESTION=32;..MB_ICONEXCLAMATION=48;..MB_ICONINFORMATION=64;..MB_DEFBUTTON1=0;..MB_DEFBUTTON2=256;..MB_DEFBUTTON3=512;..IDOK=1;..IDCANCEL=2;..IDABORT=3;..IDIGNORE=5;..IDRETRY=4;..IDYES=6;..IDNO=7;..SW_SHOWNORMAL=1;..SW_NORMAL=1;..SW_MAXIMIZE=3;..SW_MINIMIZE=6;..HKEY_CLASSES_ROOT=0;..HKEY_CURRENT_CONFIG=1;..HKEY_CURRENT_USER=2;..HKEY_LOCAL_MACHINE=3;..HKEY_USERS=4;..REG_NONE=0;..REG_SZ=1;..REG_EXPAND_SZ=2;..REG_BINARY=3;..REG_DWORD=4;..REG_DWORD_LITTLE_ENDIAN=4;..REG_DWORD_BIG_ENDIAN=5;..REG_LINK=6;..REG_MULTI_SZ=7;..REG_RESOURCE_LIST=8;..REG_FULL_RESOURCE_DESCRIPTOR=9;..REG_RESOURCE_REQUIREMENTS_LIST=10;..DLL_CALL_CDECL=0;..DLL_CALL_STDCALL=1;..DLL_RETURN_TYPE_INTEGER=0;..DLL_RETURN_TYPE_LONG=1;..DLL_RETURN_TYPE_STRING=2;..SUBMITWEB_POST=0;..SUBMITWEB_GET=1;..ACCESS_READ=131097;.

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Uninstall\uninstall.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	data
Category:	dropped
Size (bytes):	219864
Entropy (8bit):	7.9940222915417944
Encrypted:	true
SSDEEP:	3072:0LUbjRgF7z3bmANEGLtolsHJzAvRYva++POIPO8j2uWzQdY3ZO28zW3/FpJXIm:U8iTEMtBzTa++OIPO0Tco6tDT
MD5:	0A280BE7674243172A79EC1C565BEBEB
SHA1:	B36DAC0496253AB204329B4E5B3829BE5B04DB93
SHA-256:	270419C180F45EC297BCB1033DC6AAD12551E83EA3601C14AD2F05329E65EAAF
SHA-512:	9C1086704F8160EE619E326E10229BA3FC86D8BA21BF5774CE2AEAA6A267FEED4D1F626E2E581A31D3131B41598AE801650BBD3B135E09A04BB5B77C969F6882
Malicious:	false
Preview:	..P....J..UF..."....X.......L...........\.Q~A....~...3..h......@...iD)..=.(.....1.....9."..#.+.7..$.p.Y..h........Nwd..irM._../t...6..Sy.t.w..;,.s&a.......@...;...]3F..].@...;.&+....y.R....83.C.$~m.....?..nI.........wT..q...!..XR..AE.N.p...HM]..Bp....&.L`.H..j[ ..3m..c.."v.....?.E..(..`.....d....x%...R......]2...6.y..6.]6R..4X.....&P.0..........3..08...?....$.....<....2{<.l]..w.:..@.Vt...z........q............pf.P..g......U..C.+.Q...\|...x[mS=:S...Y.M......5.....a8..'...R..........a8..x.T..9.....2A,...+..8.......}....:.U.....a.s..YtF.50=E.....$..U.5.Ke.8I...aPs.[..\|.?#.E.]..%.V[.g...d#.....X...Qk:.;...........!$m..w...F.r....M...iR.......T..+\............. .%..K.......&...{..llqg.c\......P2.}...b......n....h2q>G.P....l06....V!.d,g.v2...A.'huJ...UG..+.5\|.w.....,Z..L.o..\|...K..W...o...!Lgt.........3........t........~..4B.-.....*.0R0....qc.......u.<.96.&D..Q+.i>E.....EB...0.6..B.<...Dj...].8...@..!..K)...8X.F.G<.m......s.S.

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Uninstall\uninstall.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	XML 1.0 document, ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	44162
Entropy (8bit):	5.245522285102619
Encrypted:	false
SSDEEP:	192:eIVFHiVFHzVFH+VFH8VFHKVFHWVFHIVFHqVFH8VFHGVFHQVFHaVFHQVFHqVFHsVm:f+Gs7
MD5:	C840221BCDC6C47F709CDCF50665AF88
SHA1:	14AC28C3249812CB0162B67860AF476D46CB7BB9
SHA-256:	51DE2BA8F79BF1C90EAEDB24AD6B3F99AFE5373810794BDDC3E4EE4EC52DD56D
SHA-512:	D23EA6394D549ADAEFDF35218A5543F4F4011CB05E6D40AD1D73FF7AB8AC583F97708BD53119E07813AB6C9F41CEA53EDFBBF2FF57F8A86633DE4C51D8BB0D19
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?><SUF70UninstallData>..<DataFilePath>C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Uninstall\uninstall.dat</DataFilePath>..<CPRegKey>SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PSI-CONF</CPRegKey>..<EXELocation>C:\Program Files (x86)\Phoenix Contact\PSI-CONF\uninstall.exe</EXELocation>..<AppShortcutFolderPath>C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Phoenix Contact\PSI-CONF</AppShortcutFolderPath>..<UninstallReverseOrder>1</UninstallReverseOrder>..<UninstallFiles>..<File>..<Filename>C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe</Filename>..<DecrementUsageCount>0</DecrementUsageCount>..<UnregisterCOM>0</UnregisterCOM>..<UnregisterFont>0</UnregisterFont>..<FontDesc/>..<BackupFile/>..</File>..<File>..<Filename>C:\Program Files (x86)\Phoenix Contact\PSI-CONF\de\PSI-CONF.resources.dll</Filename>..<DecrementUsageCount>0</DecrementUsageCount>..<UnregisterCOM>0</UnregisterCOM>..<UnregisterFont>0</UnregisterFont>..<F

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\de\PSI-CONF.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4632576
Entropy (8bit):	5.758562662721755
Encrypted:	false
SSDEEP:	12288:6CUu49YsKk2ELTQU/0hNblkwxBrbEFZpJC0M7gVIE6D2:6Bu49YsKk2ELTQUOlJXOpJC04z2
MD5:	1383AA8BAD7B2C430839209304934705
SHA1:	5C987461E07F65E39AF2DF880247A96CA75283B3
SHA-256:	EFFD37E264E1879C40D23BE66A29C47C41FC9EE4621BDBFFDBE39D4662FEDC39
SHA-512:	8D6BBBFFE0C7BCE095E89F0E11AACB7AB8A6EE1FEF61C532E2725C8DD33C8CF8FB8F78BCEBC3A69BB8DEAD4E963DD916DFC98734BB02A2326AE9D841F339D37B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....M._...........!......F.. ......~.F.. ....F...@.. ........................F...........@.................................(.F.S.....F.......................F...................................................... ............... ..H............text....tF.. ....F................. ..`.rsrc.........F.......F.............@..@.reloc........F.......F.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\ru\PSI-CONF.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4464640
Entropy (8bit):	5.771161550219254
Encrypted:	false
SSDEEP:	12288:kCUu49YsKk2ELTQU/0hNblkwxBrbEFZpJCNgVIE6D2:kBu49YsKk2ELTQUOlJXOpJCBz2
MD5:	36C233799D0AFFE668740A4734B11700
SHA1:	04C806BE9777F03F58D0B75EDB18B621089EFA5B
SHA-256:	436D028B7CEE2B89F7AFEFE00FD45792256F48ABBB2E70D98174D6CBAB1C51B1
SHA-512:	4808D502CFDC34BB0C8F7D6507767FDE1A114D7DF7F9D1C14E42ABF6AEAF5CC24A49CB487C2422EEDA41925A8E148E3EC28150B30FF0CF1FC1A10F4612566C77
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....M._...........!......C.. ......n.D.. ... D...@.. .......................`D...........@................................. .D.K.... D......................@D...................................................... ............... ..H............text...t.C.. ....C................. ..`.rsrc........ D.......D.............@..@.reloc.......@D.......D.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	580096
Entropy (8bit):	7.884950568875794
Encrypted:	false
SSDEEP:	12288:5gCYxPVQ1KRLLIyDASbumfbKFsdrojwSzunLEjzaQ/K1V+qr:5gCYQ1LGum4sx8Kofd/uV+w
MD5:	3FE7C92DBA5C9240B4AB0D6A87E6166A
SHA1:	7980D7DFFC073515B621834246DDA33AB00C308D
SHA-256:	A7818C1E0DAD1CBBA4D17809688887ADEEAFE940A3CB53A6AEABDFCD196F7258
SHA-512:	BD2C87B2D02B80B90F744A101BBB9294B1D90650A338BE725028E6649E46A759FA72032E80FFE911AE82B005B4D2394960E7B73CE7AD8FE3A70E8A47D2A7C98D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..A2...2...2......9.......7...........f...(.......0..........2.......2...........................3.......3...Rich2...........................PE..L....\|.J.................`....... .......0........@......................................................................................y...................................................................................{..`...................UPX0..... ..............................UPX1.....`...0...X..................@....rsrc............~...\..............@..............................................................................................................................................................................................................................................................................................................................................................3.03.UPX!....

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\zh-CHS\PSI-CONF.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4132864
Entropy (8bit):	5.769155046606851
Encrypted:	false
SSDEEP:	12288:wH/6mNCUu49YsKk2ELTQU/0hNblkwxBrbEFZpJCRgVIE6D2:iBu49YsKk2ELTQUOlJXOpJClz2
MD5:	D3350A3EE88C13680AD45EF541D09477
SHA1:	F4E5D24B36DAE1FB8C1E96D55FE1C288E88EBA29
SHA-256:	438084267B38D339216374FEA2A5509D7C9EA404A0AA5EE47E07C8213DF76FBF
SHA-512:	8CD2718B7406CB89A6252E672B530C2645F13C790F1F15C3152729B1B2BBF2B2FA95E63853BF2F56D943423CD5595B29A604F023B826EABE17D7B75DE123D843
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....M._...........!......>.. ........>.. ....?...@.. .......................@?...........@...................................>.W.....?...................... ?...................................................... ............... ..H............text.....>.. ....>................. ..`.rsrc.........?.......>.............@..@.reloc....... ?.......?.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Phoenix Contact\PSI-CONF\PSI-CONF Update Client.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Tue May 12 05:25:19 2020, mtime=Tue May 12 05:25:19 2020, atime=Tue Apr 7 04:21:48 2020, length=1240440, window=hide
Category:	dropped
Size (bytes):	2275
Entropy (8bit):	3.6586950738657746
Encrypted:	false
SSDEEP:	24:8cmWERdOEiLy68AF83NdsywdsyXdsyL3HsyaUUU/qygm:8cmJRdOmWF+dnwdnXdnTn7wyg
MD5:	4C51C90793ADAF5F118981E0940DC04B
SHA1:	A706B4FC445E3A15695ED5DFE2D9EE2E6D75A54E
SHA-256:	DFFCF6B6C01D2D729EAE8697DF161183E782427BEF01BC0420FA600A03DE8495
SHA-512:	EDAB23A024FBB2F07CAD6DA70D3E4615121BC98CC6088428FC635AF8F4EC42712E52841BD7F53D1A1FF2125D2DDFA7265A50A8E104305691D7A63D04FD68ADCD
Malicious:	false
Preview:	L..................F.@.. ....q..&(...q..&(.....o....x............................P.O. .:i.....+00.../C:\.....................1.....HY.=..PROGRA~2.........O.IHY.=....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....h.1.....HY.=..PHOENI~1..P......HY.=HY.=..........................]...P.h.o.e.n.i.x. .C.o.n.t.a.c.t.....Z.1.....HY.=..PSI-CONF..B......HY.=HY.=....3(....................@y..P.S.I.-.C.O.N.F.....\|.2.x....P.* .PSI-CO~1.EXE..`......P3.P3.....A........................P.S.I.-.C.O.N.F. .A.u.t.o.U.p.d.a.t.e...e.x.e.......v...............-.......u.............Ds.....C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF AutoUpdate.exe..Y.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.h.o.e.n.i.x. .C.o.n.t.a.c.t.\.P.S.I.-.C.O.N.F.\.P.S.I.-.C.O.N.F. .A.u.t.o.U.p.d.a.t.e...e.x.e./.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.h.o.e.n.i.x. .C.o.n.t.a.c.t.\.P.S.I.-.C.O.N.F.G.C.:.\.P.r

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Phoenix Contact\PSI-CONF\PSI-CONF.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Tue May 12 09:17:13 2020, mtime=Fri Jan 8 11:41:52 2021, atime=Fri Jan 8 11:39:11 2021, length=5014064, window=hide
Category:	dropped
Size (bytes):	2198
Entropy (8bit):	3.5473282702198876
Encrypted:	false
SSDEEP:	24:8QWERdOEiLyr8AA83adsy2dsyUdsy53dsywUUUvqygm:8QJRdOm3ALdn2dnUdnXnlgyg
MD5:	BBDEC950CEDC99C208FD66FA617EAFF1
SHA1:	927469A379D386B51E1A90AC21A3F9FB93EA1860
SHA-256:	197901CEDA3A4DDA7CC14AA42A2EEDBBE2B7DFE23D2BD9297F656DEEC2969752
SHA-512:	8A382176F91540EFBBBE92B7819E896681A2B0975303D86B6CFFEF7D3C87FFC83853A87D00ADCDE59E8A2B2BB300FB8FFCC53726DEA6AEF4E63967362BFAA9FB
Malicious:	false
Preview:	L..................F.@.. ....Z.F(...h.........C....0.L..........................P.O. .:i.....+00.../C:\.....................1.....HY.=..PROGRA~2.........O.IHY.=....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....h.1.....HY.=..PHOENI~1..P......HY.=HY.=..........................]...P.h.o.e.n.i.x. .C.o.n.t.a.c.t.....Z.1.....HY.=..PSI-CONF..B......HY.=HY.=....3(....................@y..P.S.I.-.C.O.N.F.....f.2.0.L.(R.d .PSI-CONF.exe..J......P'R(R:e.....(........................P.S.I.-.C.O.N.F...e.x.e.......k...............-.......j.............Ds.....C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe..N.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.h.o.e.n.i.x. .C.o.n.t.a.c.t.\.P.S.I.-.C.O.N.F.\.P.S.I.-.C.O.N.F...e.x.e./.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.h.o.e.n.i.x. .C.o.n.t.a.c.t.\.P.S.I.-.C.O.N.F.<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.h.o.e.n.i.x. .C.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Phoenix Contact\PSI-CONF\Uninstall PSI-CONF.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 8 06:46:20 2024, mtime=Tue Oct 8 06:46:20 2024, atime=Tue Oct 8 06:46:20 2024, length=580096, window=hide
Category:	dropped
Size (bytes):	2337
Entropy (8bit):	3.601142943313388
Encrypted:	false
SSDEEP:	48:8V1eJRdOmvMIDXdnfmdnZhxWdnfJnf4Ayg:8cvMufiZhxyfJf4Ay
MD5:	96755DFBF5600F5E8500556ACB657531
SHA1:	0B1ECC10462599FE0109984FB77C24F7120C6E66
SHA-256:	AE35054F65AB07DA73BF801EA81627840B699B4CB3769DC4B81B0AAEB0DF55EC
SHA-512:	5B1BAF822BA8F8E51F2DE376E0D012FD439AE2D9B26087CA97EC90B34C03D20653FD44A1D97A486E8CEF9A0867A06286A499B7EF7DF23798B88B9E822864732B
Malicious:	false
Preview:	L..................F.@.. ....."V....."V....."*V................................P.O. .:i.....+00.../C:\.....................1.....HY.=..PROGRA~2.........O.IHY.=....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....h.1.....HY.=..PHOENI~1..P......HY.=HY.=..........................]...P.h.o.e.n.i.x. .C.o.n.t.a.c.t.....Z.1.....HY.=..PSI-CONF..B......HY.=HY.=....3(....................@y..P.S.I.-.C.O.N.F.....h.2.....HY.= .UNINST~1.EXE..L......HY.=HY.=....I(........................u.n.i.n.s.t.a.l.l...e.x.e.......l...............-.......k.............Ds.....C:\Program Files (x86)\Phoenix Contact\PSI-CONF\uninstall.exe..$.R.e.m.o.v.e.s. .P.S.I.-.C.O.N.F. .f.r.o.m. .y.o.u.r. .c.o.m.p.u.t.e.r...O.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.h.o.e.n.i.x. .C.o.n.t.a.c.t.\.P.S.I.-.C.O.N.F.\.u.n.i.n.s.t.a.l.l...e.x.e.L."./.U.:.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.h.o.e.n.i.x. .C.o.n.t.a.c

C:\ProgramData\Phoenix Contact\PSIConfSoftware\FactoryDefinedConnectionSets1081818.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4331
Entropy (8bit):	5.186515147891882
Encrypted:	false
SSDEEP:	48:3pLkAo2Md1vhOaNrLKlboy/A3oaOZatryjBGtrMdkBGtrj93U/trQYUNtr+YUNtJ:jWdhbBBDwVdKaWx
MD5:	66F8939138E6B35C3322BF752AD0207B
SHA1:	FF3F6F4343370569AB9160CF5E282EABE59DC07B
SHA-256:	B3524388D1C8BBEF0D3245695F00BC9A4545681231D3CF393EFBED713AEB171D
SHA-512:	3BA8D356F9C841169940E5EA84AB6A43C964DAE407CDFEBA005C6E4CD52A9C1D4CFA787C828947DDA530CEF0A66BBF2128663501BBAD23AEFFA2B6A7997F98A3
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. This file is used by the program "PSI-Conf special edition". -->.. It containes communication connectionprofiles for the serial interface. -->.. The following options are valid: -->.. Interface: 0=RS-232, 1=RS-485 -->.. Baudrate: 0=300, 1=600, 2=1200, 3=2400, 4=4800, 5=9600, 6=19200, 7=38400, 8=57600, 9=93750, 10=115200, 11=187500 -->.. Databits: 0=7, 1=8 -->.. Parity: 0=Even, 1=Odd, 2=None -->.. Stopbits: 0=1, 1=2 -->.. Packet size: 32..1480 -->.. Packet settings: 0=Settings in Bit, 1=Settings in Time [.s], 2=Settings in Time [ms]-->.. Interframe gap: If Packet settings=0 : 0..4095, If Packet settings=1 : 1..10000, If Packet settings=2 : 1..37000-->.. Frame end: If Packet settings=0 : 0..4093, If Packet settings=1 : 1..10000, If Packet settings=2 : 1..37000-->.. TransmissionRetries: 0: Send once, 1: send twice, ...

C:\ProgramData\Phoenix Contact\PSIConfSoftware\FactoryDefinedConnectionSets2901540.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6062
Entropy (8bit):	5.186153481734688
Encrypted:	false
SSDEEP:	48:3p3Ao2Md1ykhOaNrLKlboy/A3Gd5OZatryx87Y5UR+aP3VY5U/tr+d8P3R5U/trx:+WkkhbBBD/6tR+QtUzc44zmotg
MD5:	6BC07CADA6CD4C6EAB08BE09A438354C
SHA1:	2653E7F602FDDE3761AD4F6AE3FB2C523C7C6CD4
SHA-256:	06A9416E1FB030FCEA1A7C4C14696498E7FF373EFD1828F9E78DA905BDA61E10
SHA-512:	D3A9B314F9B94A58937147ED1A3A01BCE7907307F8D740ACC38C585BF4077D3F0D7A74B0F0AC72AF9AD6AE993D0A916419B4D9B2FEB492BA1D6A8A1FC7DB4FE0
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. This file is used by the program "PSI-Conf". -->.. It containes communication connectionprofiles for the serial interface. -->.. The following options are valid: -->.. Interface: 0=RS-232, 1=RS-485 -->.. Baudrate: 0=300, 1=600, 2=1200, 3=2400, 4=4800, 5=9600, 6=19200, 7=38400, 8=57600, 9=93750, 10=115200, 11=187500 -->.. Databits: 0=7, 1=8 -->.. Parity: 0=Even, 1=Odd, 2=None -->.. Stopbits: 0=1, 1=2 -->.. Handshake: 0=None, 1=Hardware -->.. Packet size: 32..1480 -->.. Packet settings: 0=Settings in Bit, 1=Settings in Time [.s], 2=Settings in Time [ms]-->.. Interframe gap: If Packet settings=0 : 0..4095, If Packet settings=1 : 1..10000, If Packet settings=2 : 1..37000-->.. Frame end: If Packet settings=0 : 0..4093, If Packet settings=1 : 1..10000, If Packet settings=2 : 1..37000-->.. TransmissionRetries: 0: Send o

C:\ProgramData\Phoenix Contact\PSIConfSoftware\FactoryDefinedConnectionSets2901541.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5716
Entropy (8bit):	5.1807445675569435
Encrypted:	false
SSDEEP:	48:3p3Ao2Md1vhOaNrLKlboy/A3GBOZatryx87qUR+aP3VqU/tr+d8P3FU/tritvEVj:+WdhbBBD567R+Q7Utc42rImtg
MD5:	1BA8E4F7E8D2B29873DDC764ACD892F0
SHA1:	1EA6C93B7A696E83B1FC051D70BAFBDF7F9AF3C4
SHA-256:	62DA65EF0F747076EE0B6DB13A649B2904765E2BA2148B75A9441CAE1CF04C2B
SHA-512:	66D9172B1C8374651574AB65D03F591278418DF3702682575D95DFBA701812702B22AC5530F25D684CAFA721F64FE351B25787C367D3DF863A3A065E8BF9601A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. This file is used by the program "PSI-Conf". -->.. It containes communication connectionprofiles for the serial interface. -->.. The following options are valid: -->.. Interface: 0=RS-232, 1=RS-485 -->.. Baudrate: 0=300, 1=600, 2=1200, 3=2400, 4=4800, 5=9600, 6=19200, 7=38400, 8=57600, 9=93750, 10=115200, 11=187500 -->.. Databits: 0=7, 1=8 -->.. Parity: 0=Even, 1=Odd, 2=None -->.. Stopbits: 0=1, 1=2 -->.. Packet size: 32..1480 -->.. Packet settings: 0=Settings in Bit, 1=Settings in Time [.s], 2=Settings in Time [ms]-->.. Interframe gap: If Packet settings=0 : 0..4095, If Packet settings=1 : 1..10000, If Packet settings=2 : 1..37000-->.. Frame end: If Packet settings=0 : 0..4093, If Packet settings=1 : 1..10000, If Packet settings=2 : 1..37000-->.. TransmissionRetries: 0: Send once, 1: send twice, ... 9: Send 10 times

C:\ProgramData\Phoenix Contact\PSIConfSoftware\FactoryDefinedConnectionSets2904909.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4306
Entropy (8bit):	5.19106095263168
Encrypted:	false
SSDEEP:	48:3p3Ao2Md1vhOaNrAwlboy/A3GBOZaQyFYP3VqU/Qw+aP3FU/Q838vEVqqQ8tvEFW:+Wdhb+D5G67/+NtTx+m
MD5:	F5278BDB2DB399BD0B36F6CFABB007A5
SHA1:	4C8E9D85BC04228A67E9FD0F43576A89B3528A80
SHA-256:	456CF3344BADEE47B6AFB7F10E31E38BB74B27E28479B27A3890D4CF33A19A3A
SHA-512:	133154640B29DABACE4B1531AE21E7E5502C43137AEDC795E3BA142FD0C7B5536E1AA26AA087152C9DC163890700F7673D44527357D376E82F781139E4BB3FBD
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. This file is used by the program "PSI-Conf". -->.. It containes communication connectionprofiles for the serial interface. -->.. The following options are valid: -->.. Interface: 0=RS-232, 1=RS-485 -->.. Baudrate: 0=300, 1=600, 2=1200, 3=2400, 4=4800, 5=9600, 6=19200, 7=38400, 8=57600, 9=93750, 10=115200, 11=187500 -->.. Databits: 0=7, 1=8 -->.. Parity: 0=Even, 1=Odd, 2=None -->.. Stopbits: 0=1, 1=2 -->.. Packet size: 32..1480 -->.. Packet settings: 0=Settings in Bit, 1=Settings in Time [.s], 2=Settings in Time [ms]-->.. Interframe gap: If Packet settings=0 : 0..4095, If Packet settings=1 : 1..10000, If Packet settings=2 : 1..37000-->.. Frame end: If Packet settings=0 : 0..4093, If Packet settings=1 : 1..10000, If Packet settings=2 : 1..37000-->.. TransmissionRetries: 0: Send once, 1: send twice, ... 7: Send 8 times.

C:\ProgramData\Phoenix Contact\PSIConfSoftware\PSI-CONF_Update.SAV

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	Generic INItialization configuration [Server]
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.101867845933429
Encrypted:	false
SSDEEP:	6:xqvqc1PfQXNMpSormUS87AKaviyLSogYfAoH7AKyeWEWACug+Ty:QoNMpiX8mviQo0eeWEX7NTy
MD5:	8F4D7E3B101F4AAADD41CEB7BB3058DD
SHA1:	9F0F3773CA7C44258C4F665AFD4F2C1FA3E9F71C
SHA-256:	9715090DD109174E22F773DA9398930FCA9783AC9C834B2968310B1ABBC05544
SHA-512:	B806F312B1D4C51982CE9A2BAF0F4C1241C1300EEDA2248F02533891236BFBFE8A175393C8247D18B830EEBB79B35B82AC1B0461327EBDA68D1E2C86CA8A5014
Malicious:	false
Preview:	[INIFile]..Version=1.00....[Server]..ServerAddress=https://select.phoenixcontact.com/phoenix/dwl/dwl01.jsp?from=psiconf&file=..UserName=..PassWord=..Port=443....[Update]..TargetVersion=2.70....[Proxy]..ServerAddress=..UserName=..PassWord=..DefaultBrowser=..UsedBrowser=..LastUsedServerAddress=....[PSI-CONF]..DebugMode=FALSE..SetupLanguage=9....

C:\ProgramData\Phoenix Contact\PSIConfSoftware\ProjectData.SAV

Download File

Process:	C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	932
Entropy (8bit):	5.075127405517536
Encrypted:	false
SSDEEP:	12:MMHdpGp4ZzXiaN/37ldZYYjXjJyjRc5NGXdHX/SGzUMrSq4Dgcm2KkXB2Im:JdpLzX55dZ9pBGzUMOfMc/le
MD5:	92058E75010134C9EC8E4F915E0ED60B
SHA1:	2614318A25119ACDB5D3CBEE7C3A364D97FF78C3
SHA-256:	31F8C07D3DD6E3D8F6C90E069D08317FCB53776666CC42BA567490E94F4E8A0B
SHA-512:	B4D5B5FECBEED75D9D6384E752300E3E3EEA2A49A723A724002952B8134CAFFF3A5DA9D30FEBBDC1BD2B3259A5E9FC29201BC2D174002D8E5F6A1A119FC74088
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<MainFrameProjectData>.. <iMainDialogWidth>1024</iMainDialogWidth>.. <iMainDialogHeight>768</iMainDialogHeight>.. <iMainDialogPositionX>0</iMainDialogPositionX>.. <iMainDialogPositionY>0</iMainDialogPositionY>.. <iLastSelectedTab>0</iLastSelectedTab>.. <sLastFiveProjects />.. <sMainDialogWindowState>Normal</sMainDialogWindowState>.. <sLastUsedComPort />.. <sLastUsedProjectPath>C:\Users\user\Desktop</sLastUsedProjectPath>.. <iCurrentLanguage>9</iCurrentLanguage>.. <bEulaAccepted>false</bEulaAccepted>.. <sFeedbackHandling />.. <sFeedbackFunctions />.. <sFeedbackIndustry />.. <sFeedbackComment />.. <sFeedbackName />.. <sFeedbackAddress />.. <sFeedbackPhone />.. <sFeedbackEMail />.. <sFeedbackSystem />.. <sFeedbackSoftware />.. <sFeedbackFirmware />.. <bFeedbackSend>false</bFeedbackSend>.. <bCheckForUpdates>true</bCheckForUpdates>..</MainFrameProjectData>

C:\ProgramData\Phoenix Contact\PSIConfSoftware\SetupLog.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	58026
Entropy (8bit):	5.423727772366391
Encrypted:	false
SSDEEP:	192:FUvln8EOabaajHJRbAK9I9u0O8gkJAGCCN0fo/M/0G:qvln1AQ2u0O2AGNN0l
MD5:	25D0E6C1C13BF1873DDEE6C6E7C6A9DE
SHA1:	63F733A35A9894212F761910CD638EC7A96DE548
SHA-256:	9A7E71DA0F07ED9678FED6B2AD85F79ECB949BC2389CB0433DDF8BF0D0164FC8
SHA-512:	927F4269D50A796EEC18B85334644CBCE46FF520BD13671641533AFB460EC5AF1BBEDF3DD44C6244EE663BFDA454F3B3925CC663FEEBB7EC90D72FD3C9549A9D
Malicious:	false
Preview:	[10/08/2024 03:45:35] Success.Setup started: C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe..[10/08/2024 03:45:35] Notice.Setup engine version: 0.0.0.0..[10/08/2024 03:45:35] Notice.Product: PSI-CONF, version 2.76..[10/08/2024 03:45:35] Success.Language set: Primary = 9, Secondary = 2..[10/08/2024 03:45:35] Success.Verify archive integrity..[10/08/2024 03:45:35] Skipped.Date expiration check..[10/08/2024 03:45:35] Skipped.Uses expiration check..[10/08/2024 03:45:35] Success.System requirements check..[10/08/2024 03:45:35] Success.Load plugin: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd..[10/08/2024 03:45:35] Success.Include script: _SUF70_Global_Functions.lua..[10/08/2024 03:45:35] Notice.Start project event: Global Functions..[10/08/2024 03:45:35] Success.Run project event: Global Functions..[10/08/2024 03:45:35] Success.Detection Script: Windows Installer 3.1 v2..[10/08/2024 03:45:35] info.Windows installer service 3.1v2 module: Minimum requirement detected on System

C:\Users\Public\Desktop\PSI-CONF.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Icon number=0, Archive, ctime=Tue May 12 09:17:13 2020, mtime=Tue Oct 8 06:46:52 2024, atime=Fri Jan 8 11:39:11 2021, length=5014064, window=hide
Category:	dropped
Size (bytes):	2078
Entropy (8bit):	3.538152583150107
Encrypted:	false
SSDEEP:	24:82WERdOEiLyR8AA83Wdsy9dsy53dsywUUUvqygm:82JRdOmtAXdn9dnXnlgyg
MD5:	FFF6754A890E75F326A3F85E9110B47A
SHA1:	8BBE01D87F69F4C9AE7943CD0A03C86157D1BBFD
SHA-256:	39CFB15CF9BB2725120814E3BE8DF03E5738C24250FFC4262650FCF15EEE47B2
SHA-512:	B13BF2A9E4CC96C3240526368F89F9ABDBC1B85049AD2AFC93228C083AA48FE8F5F3B9ED14E033F486DE6820580F5C47C0C640F8B9C7CE9449C95A218A3351CE
Malicious:	false
Preview:	L..................F.@.. ....Z.F(....T=V......C....0.L..........................P.O. .:i.....+00.../C:\.....................1.....HY.=..PROGRA~2.........O.IHY.=....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....h.1.....HY.=..PHOENI~1..P......HY.=HY.=..........................]...P.h.o.e.n.i.x. .C.o.n.t.a.c.t.....Z.1.....HY.=..PSI-CONF..B......HY.=HY.=....3(....................@y..P.S.I.-.C.O.N.F.....f.2.0.L.(R.d .PSI-CONF.exe..J......P'RHY.=.....(........................P.S.I.-.C.O.N.F...e.x.e.......k...............-.......j.............Ds.....C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe..B.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.h.o.e.n.i.x. .C.o.n.t.a.c.t.\.P.S.I.-.C.O.N.F.\.P.S.I.-.C.O.N.F...e.x.e.<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.h.o.e.n.i.x. .C.o.n.t.a.c.t.\.P.S.I.-.C.O.N.F.\.P.S.I.-.C.O.N.F...e.x.e.........%ProgramFiles%\Phoenix Contact\PSI-CONF\PSI-CONF.exe....

C:\Users\user\AppData\Local\Temp\CSCF17D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	664
Entropy (8bit):	3.1797904448336247
Encrypted:	false
SSDEEP:	12:DXtEki3nYAHOa5YAk9aUGiqZsiN522ryc4Bak7Ynqqn4P7PN5eHMlq5e7:SNI3g3NNNUakSnW7PNwkqi
MD5:	3B6322B76724299A0E21A877A355F6E9
SHA1:	1DFCF47508E6197F0E8FFFBB389DDE68E4F6FA23
SHA-256:	966416F4E86A9E16CA64322A3C22BE70DBB256C65597AB312A04CD77B6EF82E3
SHA-512:	EEEBD98B35A9F59E0C6858FFF813FECA38854DD628EDC58EC1B89E83AC12E93D6DAF6FCF1FAAFC1FF003B5323B7D02FC43AB38EB121C512E843ADEF371ED940E
Malicious:	false
Preview:	.... ...........................X...<...............0...........X.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............L.......L.......?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...4.....F.i.l.e.V.e.r.s.i.o.n.....2...7.6...0...0.....<.....I.n.t.e.r.n.a.l.N.a.m.e...r.q.c.o.3.g.p.6...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...r.q.c.o.3.g.p.6...d.l.l.....8.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...2...7.6...0...0.....<.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...2...7.6...0...0.....

C:\Users\user\AppData\Local\Temp\RESF17E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x40e, 9 symbols, created Tue Oct 8 07:47:00 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1204
Entropy (8bit):	3.687812473236234
Encrypted:	false
SSDEEP:	24:HeFJ9YGr6vfjHnoUnhKzI3g3NNNUakSnW7PNwkqAt5r:1Gr6HjjnhKz13XNUa3nMgA7r
MD5:	75D3390FB8EF9C312DFADFEBC9C6DFCA
SHA1:	12C88155F3528AA605E7A0F635DDAF3E3A00C98D
SHA-256:	8894C8A6A7CBBA60F7D13EDF793F071265EAFFA32714ED16438BA08ABD7AE33F
SHA-512:	9749A764698EB94E363588CFF931327CE4E1CEDD98B68258D4F0C10F6CA1E17F461C4DB2C26E5EB3B44D8AC1AC46F78AD4E36163D3E8EEC5653480E0C1348DFE
Malicious:	false
Preview:	L...t..g.............debug$S............................@..B.rsrc$01........X...T...............@..@.rsrc$02........X...................@..@........0....c:\Users\user\AppData\Local\Temp\CSCF17D.tmp...............;c".g$)..!.w.U........d...5.......C:\Users\user\AppData\Local\Temp\RESF17E.tmp.+...................'.Microsoft (R) CVTRES...............................................0.......................H.......X...........H.........X.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............L.......L.......?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...4.....F.i.l.e.V.e.r.s.i.o.n.....2...7.6...0...0.....<.....I.n.t.e.r.n.a.l.N.a.m.e...r.q.c.o.3.g.p.6...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...r.q.c.o.3.g.p.6...d.l.l.....8.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...2...7.6...0...0.....<.....A.s.s.e.m.b.l.y.

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PC bitmap, Windows 3.x format, 497 x 63 x 24, image size 93996, cbSize 94050, bits offset 54
Category:	dropped
Size (bytes):	94050
Entropy (8bit):	2.2763927368055277
Encrypted:	false
SSDEEP:	192:zxQMerxCcxQX4RNy1RMdAE1MYFbw71NiNrtN4/5T:t7evxQX4Hy7MdAE1MYFbw71NiNrtN4/Z
MD5:	8EDCCEB1AB1209C16C36677FFC242F05
SHA1:	FE2BA3B05A22C0EF9638A61DEFDC72D835B12B23
SHA-256:	27937B5E40F1981EC50A03A12276AB7812D41475AE6862ACFE4F596194364DBD
SHA-512:	AE6CA31BA9FAE45B0BFD8D761C71C2ED3EB80D0F29D9CDB3419E964016E15AFAA443D5C0C670AB01BD472B8D925E6DF51690A041428F3744C2B32685F488FD23
Malicious:	false
Preview:	BMbo......6...(.......?...........,o....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS2 Windows, datetime=2008:07:08 14:20:15], baseline, precision 8, 166x312, components 3
Category:	dropped
Size (bytes):	29054
Entropy (8bit):	5.195708227193176
Encrypted:	false
SSDEEP:	384:wjV66AV66RU53DaYNg7y5fJ+dwd7L/dSivXHk4eo:wjs6As6R4aYyCfToi7R
MD5:	AC40DED6736E08664F2D86A65C47EF60
SHA1:	C352715BBF5AE6C93EEB30DF2C01B6F44FAEDAAA
SHA-256:	F35985FE1E46A767BE7DCEA35F8614E1EDD60C523442E6C2C2397D1E23DBD3EA
SHA-512:	2FBD1C6190743EA9EF86F4CB805508BD5FFE05579519AFAFB55535D27F04F73AA7C980875818778B1178F8B0F7C6F5615FBF250B78E528903950499BBE78AC32
Malicious:	false
Preview:	......JFIF.....H.H......Exif..MM..............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS2 Windows.2008:07:08 14:20:15........................................8...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................U.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...J....X.Z..l.i.........jl....p............\\.I<...=..v.....(..A.%.P.'!."UI.I....z.u...wq..*..hc4kt.6R.7H.Z.[.#O..O

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PC bitmap, Windows 3.x format, 497 x 63 x 24, image size 93996, cbSize 94050, bits offset 54
Category:	dropped
Size (bytes):	94050
Entropy (8bit):	2.2763927368055277
Encrypted:	false
SSDEEP:	192:zxQMerxCcxQX4RNy1RMdAE1MYFbw71NiNrtN4/5T:t7evxQX4Hy7MdAE1MYFbw71NiNrtN4/Z
MD5:	8EDCCEB1AB1209C16C36677FFC242F05
SHA1:	FE2BA3B05A22C0EF9638A61DEFDC72D835B12B23
SHA-256:	27937B5E40F1981EC50A03A12276AB7812D41475AE6862ACFE4F596194364DBD
SHA-512:	AE6CA31BA9FAE45B0BFD8D761C71C2ED3EB80D0F29D9CDB3419E964016E15AFAA443D5C0C670AB01BD472B8D925E6DF51690A041428F3744C2B32685F488FD23
Malicious:	false
Preview:	BMbo......6...(.......?...........,o....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPG

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS2 Windows, datetime=2008:07:08 14:20:15], baseline, precision 8, 166x312, components 3
Category:	dropped
Size (bytes):	29054
Entropy (8bit):	5.195708227193176
Encrypted:	false
SSDEEP:	384:wjV66AV66RU53DaYNg7y5fJ+dwd7L/dSivXHk4eo:wjs6As6R4aYyCfToi7R
MD5:	AC40DED6736E08664F2D86A65C47EF60
SHA1:	C352715BBF5AE6C93EEB30DF2C01B6F44FAEDAAA
SHA-256:	F35985FE1E46A767BE7DCEA35F8614E1EDD60C523442E6C2C2397D1E23DBD3EA
SHA-512:	2FBD1C6190743EA9EF86F4CB805508BD5FFE05579519AFAFB55535D27F04F73AA7C980875818778B1178F8B0F7C6F5615FBF250B78E528903950499BBE78AC32
Malicious:	false
Preview:	......JFIF.....H.H......Exif..MM..............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS2 Windows.2008:07:08 14:20:15........................................8...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................U.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...J....X.Z..l.i.........jl....p............\\.I<...=..v.....(..A.%.P.'!."UI.I....z.u...wq..*..hc4kt.6R.7H.Z.[.#O..O

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PC bitmap, Windows 3.x format, 497 x 362 x 24, image size 540104, cbSize 540158, bits offset 54
Category:	dropped
Size (bytes):	540158
Entropy (8bit):	0.18734821857142886
Encrypted:	false
SSDEEP:	192:KNvB8/qrIY5hGG0zGGGG63GGGEGqyGRMAeV:8vB8PYfTeV
MD5:	CD6B4F5490483B9D1BEB9600625DAC28
SHA1:	35F9077719C48D31A0BD45EA08761A75E6139285
SHA-256:	3F8A8C8698CECE5CEB6B96062B5C7ADE7CAB8375F8878D40E51E8CFD413321E9
SHA-512:	AEDB2EB624CA0EB485ED4294B9F958905961CE7AD86A70CADD7544EB2BA9E44D09FB0D038634C80216F34178675204B58B5676AAC25C6A386C7D41E310D795AA
Malicious:	false
Preview:	BM.=......6...(.......j............=....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	344064
Entropy (8bit):	6.284097757286593
Encrypted:	false
SSDEEP:	6144:F3BU3fvbdCpw73HIpXr2SzywQ5jTYrcSEeAImb+Zq:uvbAkIp72Szy55jTYiIDZq
MD5:	FCF0D70F428B081937103D32889535B8
SHA1:	A703030F601E5840D4718D570C4F59A4FF735158
SHA-256:	B1D22E20B8225402B76387421D0F1E10986724D4D9DAC1441DE2530507AA913C
SHA-512:	AD0DD0AC2046A19EAAF14B9FCA99F770446F8C211F1506DC86795BC763A823421EB391945E1F0536D41BC3F8706D9F05A53BC61C3CE34BCCBFCD39F6B66A9468
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n.........................................`...f......../.......,.......)..p....)......"......../......Rich............................PE..L...3..H...........!................-........................................@..........................................Z................N......................t-......................................................\............................text............................... ..`.rdata..ZR.......`..................@..@.data...,...........................@....rsrc....N.......P..................@..@.reloc...H.......P..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\PXC_USB-Driver.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3491348
Entropy (8bit):	7.99967489720211
Encrypted:	true
SSDEEP:	98304:b62awMURwguLGv1mMnreN0Q9ynqzBcCyp2:9MURwD417nrtE2CI2
MD5:	B09B52E58A7F36D01BD772456F9205F6
SHA1:	74DA05E855124FF8F5D1FBC392C7B267E0CFE875
SHA-256:	6CBFAF72E4EADD5FE61AA610E8EA3085116375F06B9220436CD4A6BA5486ABFE
SHA-512:	7E0D853DABB845BD379EDF7A08B7E5FDEF770E49A0556389BF0912CF29DE02E895ED9D29321A9A13125895E8B68D3C8DBE6922866BD65A09E565152A2DE4387D
Malicious:	false
Preview:	PK.........q6B. ...i..... ...Phoenix Contact VCPInstaller.exe.:mxSe..&.m(.\0@...h@...\AJ.....&hm.#t..)....%....38.......?f.u....l.B.H..g...yk+...@...&i)..}.O_..&.=.9.=....{.........ic%7...7s.ogr.L;..._wl....m..x.C....u[...-...V[.V[.z..m..\7cF.]..J}..$.?P..+.......O.....u.=..j......o.l}.i8.W.....d.K..]w.-.K...u..m}....)..O.M...............&...j...;5......3..Q..}.>.xv...<\|..8ka^...q.+.......\.......W^...... <?.1j.5.s..a.M.5n./x....[.....2..N...&....^...E.k..x?\|g{.=s"<...w!.....ScjL..15....Scj...Rj.......Y&..T.b.G.z...Z...ab......13..o........@~n...........x..H...d..$....-.A..AUU......!..M>.l.}.u.'.....1P...9.~.Dx(.._..u."cL..c..S..3.]..x...J.k.%...\|..$Z.UC.k.........yI...uP....(,=T...sN......~..k._...7<.....sd..[.s.._.+..WV..#j..!...i3....r.....]iyJ..3x..N..~...s.,.....dZM\X.q.........(.Z.....ry....O....a&..D..CD.......j7I.U...a..-....1HJ..mb%].%....H@P.f..n.P......Y...P........w...v.K.I>)O.T.E2.......[..n..5

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	638704
Entropy (8bit):	6.223115498205246
Encrypted:	false
SSDEEP:	12288:lMGNq4zUrm/PmP9AULJv2GydXZtzBsDNr:zPw9a9ptCr
MD5:	A6EA5C9B61F3DD92B3833AE2DD3FA72F
SHA1:	C840D4BB4F9BCF9E046E5ED69DEE804E651A14D8
SHA-256:	652348D6E96B1F9426C2B9610BC87FE306DB5D92BA84D0756AB0FA85DCE64657
SHA-512:	FD61375B6A535B08CAAB55552DC8553FEFF9047D292763A9F3365E2199D5B9E22AD92863486BA292F76DBA6B24749DD4D80BBC72D168869E53D82B4193EDE4CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.:..ki..ki..ki3.4i..ki3.6i..ki...i..ki...ih.ki.(xi..ki..ji..ki...i..ki...i..ki...i..kiRich..ki........PE..L...n..N.................p... ....................@..................................x......................................./..........................................................................@..................../..@....................text....f.......p.................. ..`.rdata..............................@..@.data....`...`...0...`..............@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	data
Category:	dropped
Size (bytes):	350825
Entropy (8bit):	6.110809934327647
Encrypted:	false
SSDEEP:	3072:ZvW0XGl6b15JzW5IMGZmp0vSSHlvdxGAZF9FYp7YNRNcLfW4K1nV2kjCusDzWoHg:Z7pr/A7YfKa4KhQkjqG
MD5:	0ABEAA65E4293126C5842BDE76E379A1
SHA1:	63F8E8E7EB0C52387F7B5FB1BD1419DD6A260CD1
SHA-256:	2790F30B360799EE24CC2F68511F4210F77CEC3BFAD9186E266DA58784F40469
SHA-512:	547501FC70E014828AB42EE0F3ABAA2C085EB5A3615EDD1F72F8F7D6BCA8E59B64B62DB4592625F59B7F081DC101BF0A0E10C309F9F0A888767E4852FAE76916
Malicious:	false
Preview:	........CGlobalIncludeLuaFile.........Constant Definitions.JPMB_OK=0;..MB_OKCANCEL=1;..MB_ABORTRETRYIGNORE=2;..MB_YESNOCANCEL=3;..MB_YESNO=4;..MB_RETRYCANCEL=5;..MB_ICONNONE=0;..MB_ICONSTOP=16;..MB_ICONQUESTION=32;..MB_ICONEXCLAMATION=48;..MB_ICONINFORMATION=64;..MB_DEFBUTTON1=0;..MB_DEFBUTTON2=256;..MB_DEFBUTTON3=512;..IDOK=1;..IDCANCEL=2;..IDABORT=3;..IDIGNORE=5;..IDRETRY=4;..IDYES=6;..IDNO=7;..SW_SHOWNORMAL=1;..SW_NORMAL=1;..SW_MAXIMIZE=3;..SW_MINIMIZE=6;..HKEY_CLASSES_ROOT=0;..HKEY_CURRENT_CONFIG=1;..HKEY_CURRENT_USER=2;..HKEY_LOCAL_MACHINE=3;..HKEY_USERS=4;..REG_NONE=0;..REG_SZ=1;..REG_EXPAND_SZ=2;..REG_BINARY=3;..REG_DWORD=4;..REG_DWORD_LITTLE_ENDIAN=4;..REG_DWORD_BIG_ENDIAN=5;..REG_LINK=6;..REG_MULTI_SZ=7;..REG_RESOURCE_LIST=8;..REG_FULL_RESOURCE_DESCRIPTOR=9;..REG_RESOURCE_REQUIREMENTS_LIST=10;..DLL_CALL_CDECL=0;..DLL_CALL_STDCALL=1;..DLL_RETURN_TYPE_INTEGER=0;..DLL_RETURN_TYPE_LONG=1;..DLL_RETURN_TYPE_STRING=2;..SUBMITWEB_POST=0;..SUBMITWEB_GET=1;..ACCESS_READ=131097;..ACCESS_

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Download File

Process:	C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	580096
Entropy (8bit):	7.884950568875794
Encrypted:	false
SSDEEP:	12288:5gCYxPVQ1KRLLIyDASbumfbKFsdrojwSzunLEjzaQ/K1V+qr:5gCYQ1LGum4sx8Kofd/uV+w
MD5:	3FE7C92DBA5C9240B4AB0D6A87E6166A
SHA1:	7980D7DFFC073515B621834246DDA33AB00C308D
SHA-256:	A7818C1E0DAD1CBBA4D17809688887ADEEAFE940A3CB53A6AEABDFCD196F7258
SHA-512:	BD2C87B2D02B80B90F744A101BBB9294B1D90650A338BE725028E6649E46A759FA72032E80FFE911AE82B005B4D2394960E7B73CE7AD8FE3A70E8A47D2A7C98D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..A2...2...2......9.......7...........f...(.......0..........2.......2...........................3.......3...Rich2...........................PE..L....\|.J.................`....... .......0........@......................................................................................y...................................................................................{..`...................UPX0..... ..............................UPX1.....`...0...X..................@....rsrc............~...\..............@..............................................................................................................................................................................................................................................................................................................................................................3.03.UPX!....

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\setup.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	Generic INItialization configuration [Driver Version]
Category:	dropped
Size (bytes):	823
Entropy (8bit):	5.396065278162756
Encrypted:	false
SSDEEP:	24:oXB19DGryVozHm2Wgu34FuPxPIMpy2L0sdImIhZ:ox19Dyy4Hm2W5IF8xgcL0cIfhZ
MD5:	D84921B74EB52ABBBBC4FF89D3E31DC7
SHA1:	9E133216F50AE3AB40A564D5580318EB63F8B33A
SHA-256:	230B4F3AE7D7FC835FF2402929DC8661D61E3B28961ABB8EF98DB697C5B4D7B4
SHA-512:	AF3413BCADF31D79C057A0B2B07979B8E5A114FE315583C37DC0729FD2B441500059C00C7CC5F1C49FF0FC561AC4315CBBCFF97FDEB8D479A891BB26BA3A67C1
Malicious:	false
Preview:	[Driver Type]..VCP CP210x....[Driver Version]..6.6.1....[Product Name]..Phoenix Contact USB to UART Interface....[Company Name]..Phoenix Contact GmbH & Co. KG....[VID_PID List]..10C4_EA60..10C4_EA70..10C4_EA71..10C4_82AA..10C4_8377..1B93_1002..1B93_1003..1B93_1006....[Relative Install]..Relative To Program Files....[Install Directory]..Phoenix Contact\Drivers\USB to UART Interface\....[Install Subdirectories]..x86..x64....[Install Quiet Mode]..Off....[Uninstall Quiet Mode]..Off....[Copy Driver Files]..Yes....[Remove Copied Files On Uninstall]..Yes....[XP_2K_2K3_VISTA INF Files]..slabvcp.inf....[XP_2K_2K3_VISTA Driver Files]...\x64\silabser.sys...\x64\silabenm.sys...\x64\WdfCoInstaller01009.dll...\x86\silabser.sys...\x86\silabenm.sys...\x86\WdfCoInstaller01009.dll....[XP_2K_2K3_VISTA Catalog Files]..slabvcp.cat..

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\setup.iss (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	Generic INItialization configuration [File Transfer]
Category:	dropped
Size (bytes):	687
Entropy (8bit):	5.369038780399974
Encrypted:	false
SSDEEP:	12:HMJnga9BuwOzLzSP+RNtzSPKzuDKzSP8P7HbTX8GoiYG4oTzSPCM2zuDvY:Hwg6BuwOvZrtTXvP7nYGJT1F
MD5:	8EEE855357E95B370EABAECA264F213A
SHA1:	27F5C298AA895AD6E886E737BFF653E60BF7CDF8
SHA-256:	B64875316A151F71FAB800A3416C701DADA1617D21E14B0BE8EDC07902E56A3F
SHA-512:	C3D57B728378E248FF607EC9B45C180FC240EB1BE3EE55E3BF0DF257D47BD49A6CB889B9E47C0F5369DF4E86B026034E0F32D9E3D2442CB1ABFBEB6264EABF2D
Malicious:	false
Preview:	[InstallShield Silent]..Version=v7.00..File=Response File..[File Transfer]..OverwrittenReadOnly=NoToAll..[{A22BAB0C-9364-4618-A00D-69AF1DC83910}-DlgOrder]..Dlg0={A22BAB0C-9364-4618-A00D-69AF1DC83910}-MessageBox-0..Count=3..Dlg1={A22BAB0C-9364-4618-A00D-69AF1DC83910}-MessageBox-1..Dlg2={A22BAB0C-9364-4618-A00D-69AF1DC83910}-SdFinish-0..[{A22BAB0C-9364-4618-A00D-69AF1DC83910}-MessageBox-0]..Result=6..[Application]..Name=Silicon Laboratories CP210x VCP Drivers for Windows 7..Version=5.40.24..Company=Silicon Laboratories, Inc...Lang=0009..[{A22BAB0C-9364-4618-A00D-69AF1DC83910}-MessageBox-1]..Result=1..[{A22BAB0C-9364-4618-A00D-69AF1DC83910}-SdFinish-0]..Result=1..bOpt1=0..bOpt2=0..

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\setupWin2K.iss

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	Generic INItialization configuration [File Transfer]
Category:	dropped
Size (bytes):	708
Entropy (8bit):	5.435316555326038
Encrypted:	false
SSDEEP:	12:HMJnga9BuwKVZfZy+RN3ZyaZqRGVZy8P7HbTXe/3RYG4o7VZyCLVZqRvY:Hwg6BuwO9Br3RVnP7eRYGJpHt
MD5:	488A9F4A8C50E1B27A3412360BD2804E
SHA1:	5AB6E1BBE12ECFBEBD16925DAC3321B9179F94A9
SHA-256:	5DD7FB9AE36DAF2531F3A9360223E97E585C241910670266783F5BB313E13A43
SHA-512:	CF211760FE9212B756A3EC61BC274C07687FD4D00923760C3CA300D9AA3D264B2512488AABAE9EEB6D40BB23B605951838DB52118672EC1E3DE390D12B5876C7
Malicious:	false
Preview:	[InstallShield Silent]..Version=v7.00..File=Response File..[File Transfer]..OverwrittenReadOnly=NoToAll..[{2AEE35FC-0EF1-4DAC-BAF1-790BD087175D}-DlgOrder]..Dlg0={2AEE35FC-0EF1-4DAC-BAF1-790BD087175D}-MessageBox-0..Count=3..Dlg1={2AEE35FC-0EF1-4DAC-BAF1-790BD087175D}-MessageBox-1..Dlg2={2AEE35FC-0EF1-4DAC-BAF1-790BD087175D}-SdFinish-0..[{2AEE35FC-0EF1-4DAC-BAF1-790BD087175D}-MessageBox-0]..Result=6..[Application]..Name=Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista..Version=5.40..Company=Silicon Laboratories, Inc...Lang=0009..[{2AEE35FC-0EF1-4DAC-BAF1-790BD087175D}-MessageBox-1]..Result=1..[{2AEE35FC-0EF1-4DAC-BAF1-790BD087175D}-SdFinish-0]..Result=1..bOpt1=0..bOpt2=0..

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\setupWin7.iss

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	Generic INItialization configuration [File Transfer]
Category:	dropped
Size (bytes):	687
Entropy (8bit):	5.369038780399974
Encrypted:	false
SSDEEP:	12:HMJnga9BuwOzLzSP+RNtzSPKzuDKzSP8P7HbTX8GoiYG4oTzSPCM2zuDvY:Hwg6BuwOvZrtTXvP7nYGJT1F
MD5:	8EEE855357E95B370EABAECA264F213A
SHA1:	27F5C298AA895AD6E886E737BFF653E60BF7CDF8
SHA-256:	B64875316A151F71FAB800A3416C701DADA1617D21E14B0BE8EDC07902E56A3F
SHA-512:	C3D57B728378E248FF607EC9B45C180FC240EB1BE3EE55E3BF0DF257D47BD49A6CB889B9E47C0F5369DF4E86B026034E0F32D9E3D2442CB1ABFBEB6264EABF2D
Malicious:	false
Preview:	[InstallShield Silent]..Version=v7.00..File=Response File..[File Transfer]..OverwrittenReadOnly=NoToAll..[{A22BAB0C-9364-4618-A00D-69AF1DC83910}-DlgOrder]..Dlg0={A22BAB0C-9364-4618-A00D-69AF1DC83910}-MessageBox-0..Count=3..Dlg1={A22BAB0C-9364-4618-A00D-69AF1DC83910}-MessageBox-1..Dlg2={A22BAB0C-9364-4618-A00D-69AF1DC83910}-SdFinish-0..[{A22BAB0C-9364-4618-A00D-69AF1DC83910}-MessageBox-0]..Result=6..[Application]..Name=Silicon Laboratories CP210x VCP Drivers for Windows 7..Version=5.40.24..Company=Silicon Laboratories, Inc...Lang=0009..[{A22BAB0C-9364-4618-A00D-69AF1DC83910}-MessageBox-1]..Result=1..[{A22BAB0C-9364-4618-A00D-69AF1DC83910}-SdFinish-0]..Result=1..bOpt1=0..bOpt2=0..

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\slabvcp.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	data
Category:	dropped
Size (bytes):	12356
Entropy (8bit):	6.838858924907412
Encrypted:	false
SSDEEP:	192:OeTWTgTeT9TXTqeTc+ECwNGoZBPRY8TE0rr1nYe+PjPurfyLb+vQtjtlAur9ZCs1:j06cFDHcswnnYPLSyLndUHeMMJ
MD5:	FB782004A59BF05EDAFEEE9CEB1AB567
SHA1:	0DDF1D5026BCAC265294F2BA111A85A3B01A7BE4
SHA-256:	6E82E523B5CEC089A9C660B9BD73FC235CC2001D3E0689DB8D637F5455CA8F66
SHA-512:	943C418A7B0C1ACA75C68689E53B53400ADEBDC1544127BD58463CBB17366C66C12ED618D4F5A67A5C15AB9A7C57EADC3CC10FEEC2A797976C69F0FD821C605F
Malicious:	false
Preview:	0.0@..*.H........010.0-...1.0...+......0.....+.....7......0...0...+.....7.......b..sM.b.....8..130122131327Z0...+.....7.....0...0....R0.5.6.3.9.9.F.A.A.C.B.9.F.C.4.9.F.3.C.F.7.8.B.F.C.3.D.9.F.2.F.4.6.3.E.5.0.1.2.E...1...0R..+.....7...1D0B...F.i.l.e.......0w.d.f.c.o.i.n.s.t.a.l.l.e.r.0.1.0.0.9...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........c.....I..x.....c...0....R0.7.6.B.6.4.E.F.3.2.1.0.F.7.5.E.E.2.8.8.3.5.2.7.8.E.6.9.0.A.2.B.1.6.C.4.D.6.4.0...1..s0<..+.....7...1.0,...F.i.l.e........s.i.l.a.b.e.n.m...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0i..+.....7...1[0Y04..+.....7.

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\slabvcp.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5992
Entropy (8bit):	5.5835373281452805
Encrypted:	false
SSDEEP:	96:KOvOAUHaqX2eMhdhpTCs1ojH4SvDivhacp1t1h0tHXBZYKLcJ0zx:XOAUHaq2eMhdhpTCsuz4SvDivhacpH1+
MD5:	6FA46FEDF1CBE21B587F21286466D8A6
SHA1:	39A9B9E3887960581A5F3E4DAA497F9111B7F74A
SHA-256:	32B8BDF3D6D7907AEC9FBA68B94BEF31FF5EB0597EB73C9B4FFE59B4B3CDAD69
SHA-512:	F003DDDC786885CF42D840840465D37EDE2506CD3BBDC68D7AD10B331F0F0DACDB8529043BCC0043A2632006BADD546E62CFB4CC9FE798013358603C92A7ECE3
Malicious:	false
Preview:	;/++..;..;Module Name:..;..; slabvcp.INF..;..; Copyright 2012, Silicon Laboratories..;..;Abstract:..; Installation INF for Silicon Laboratories CP210x device using KDMF Version 1.9..;..;--/....[Version]..Signature="$WINDOWS NT$"..Class=Ports..ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}..Provider=%Provider%..DriverVer=12/10/2012,6.6.1.0..CatalogFile=slabvcp.cat......; ================= Device section =====================....[Manufacturer]..%MfgName%=SiLabs, NTamd64....[SiLabs]..%USB\VID_10C4&PID_EA60.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA60..%USB\VID_10C4&PID_EA70&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_00..%USB\VID_10C4&PID_EA70&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_01..%USB\VID_10C4&PID_EA71&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_00..%USB\VID_10C4&PID_EA71&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_01..%USB\VID_10C4&PID_EA71&Mi_02.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_02..%USB\VID_

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\WdfCoInstaller01009.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1721576
Entropy (8bit):	7.978334410477683
Encrypted:	false
SSDEEP:	24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
MD5:	4DA5DA193E0E4F86F6F8FD43EF25329A
SHA1:	68A44D37FF535A2C454F2440E1429833A1C6D810
SHA-256:	18487B4FF94EDCCC98ED59D9FCA662D4A1331C5F1E14DF8DB3093256DD9F1C3E
SHA-512:	B3D73ED5E45D6F2908B2F3086390DD28C1631E298756CEE9BDF26B185F0B77D1B8C03AD55E0495DBA982C5BED4A03337B130C76F7112F3E19821127D2CF36853
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.v...%...%...%.m+%...%.m:%...%...% ..%.m-%...%.m=%...%.m,%...%.m7%...%...%...%.m%...%.m/%...%Rich...%........................PE..d.....[J.........." .........0............................................................@.........................................`................p..l!...`..,....,...............................................................................................text...L........................... ..`.data....J..........................@....pdata..,....`......................@..@.rsrc...l!...p..."..................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\silabenm.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27336
Entropy (8bit):	6.172214959675352
Encrypted:	false
SSDEEP:	384:n6oIhnyUR2OZRy0m1KOd/V3nL7fVRQlQeddvuVyxxTWBU/TJ1mTbCemE:fIZygU31Kw/V3L7f4esv2+/TbobCM
MD5:	7799106FEE728B907A86D9C9751E02D5
SHA1:	F35320E535159D43B598C7C11684DB05BE4196A6
SHA-256:	EE85E8D3CF3819DB28221BFC103DE8DF0E14E1878CECF54E8CD8C161B0E0AF3C
SHA-512:	F91AF958ADF1B808FC6C30AA7FE9C6CF8C5C2A041327693403D9A12A06E7C5084D203433BA2D0917A3FC1A064626BCE89526C5FB4B951F0A4AA07E84D237A99C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."..eL.eL.eL.eM.eL...7.eL...1.eL....eL....eL...!.eL....eL....eL....eL.Rich.eL.........................PE..d......K.........."......J..........................................................$...........................................................(............P.......\...............1...............................................0...............................text...f........................... ..h.rdata..t....0......................@..H.data........@......................@....pdata.......P....... ..............@..HPAGE....M....`.......".............. ..`PAGESENM.............<.............. ..`INIT....d............P.............. ....rsrc................X..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x64\silabser.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73216
Entropy (8bit):	6.104930566748915
Encrypted:	false
SSDEEP:	1536:0ZsxDp0cAS3xTZDPU+dlLxAoO4lx/CGxMP4TNYyTPfBi3ItZRmU2Eo+u:/xDScAGTFcWQGx/CGxMP4TNYyTPfBi4g
MD5:	447209C314E6E0D26E01962075802B18
SHA1:	DD8AF2E3AA38D2D6971568EBF2CF41848E0091F5
SHA-256:	AB1AC5854EB0EDF66025609CF9CB5639014C264327F4DEE1223BF7F6E1BD2D15
SHA-512:	E2F8470C31496D1547CF930DD32805407722F81F6846E4257BF28CE37BF635F8EDA07A19E99FCBE10AAD939E7912FED4ABA098B58CCCC66217F2965BF4D10C73
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........H...H...H...A.Y.K...A.Z.K...A.V.K...A.M.J...H...Q...>...K...>...I...A.].E...A.K.J...>...I...A.W.[...A.J.I...A.O.I...RichH...........PE..d...p..P.........."..........*.....................................................R.......................................................$v..<...............................8....................................................................................text............................... ..h.rdata..<...........................@..H.data...T...........................@....pdata..............................@..HPAGESRP0c9.......:.................. ..`PAGE....~....P...................... ..`PAGESER......`...................... ..`INIT.........p...................... ....rsrc...............................@..B.reloc..............................@..B........................................................................

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x86\WdfCoInstaller01009.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1461992
Entropy (8bit):	7.976326629681077
Encrypted:	false
SSDEEP:	24576:GjG90oN2lj11mk/22yYzGrarZRm4X5Uh6rVh5LdfBwOyCSQM1fFhSWRA2+:iGtN2h1120R7m4XShYVxfBwrC21fXSz
MD5:	A9970042BE512C7981B36E689C5F3F9F
SHA1:	B0BA0DE22ADE0EE5324EAA82E179F41D2C67B63E
SHA-256:	7A6BF1F950684381205C717A51AF2D9C81B203CB1F3DB0006A4602E2DF675C77
SHA-512:	8377049F0AAEF7FFCB86D40E22CE8AA16E24CAD78DA1FB9B24EDFBC7561E3D4FD220D19414FA06964692C54E5CBC47EC87B1F3E2E63440C6986CB985A65CE27D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.B...B...B...Kd1.E...B.......Kd7.Q...Kd .M...Kd6.C...Kd'.....e...C...Kd0.C...Kd5.C...RichB...........PE..L.....[J...........!.........N......C................................................S....@..........................................P...<...........6..................................................@............................................text............................... ..`.data....G..........................@....rsrc....<...P...>..................@..@.reloc...............*..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x86\silabenm.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	47176
Entropy (8bit):	6.438481556176545
Encrypted:	false
SSDEEP:	768:43jIG9nfU9USVPRaQT78wiYwMSxidYBb3obCv:YjIonWVPAvYzQx3cCv
MD5:	3EAD8E1668CE42A0AFE41D56E7157BCF
SHA1:	C164EE1014A9D64BEFCDB46AB4B1C67C1F23E47B
SHA-256:	90A1AA6372356046B28C079954458F42849779FFC48C93AF0549A7673B276EB3
SHA-512:	5E4E844D809E0D344EC3AAE456F9C0C0DFC89F7BA1D328AFC42FE474FDD57A8F156CCE8B269A125D113E3EEA660A693406BDD15EB1B0C00E3ABB20A192FA73F0
Malicious:	false
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................c.s.'...'...'...'........@."......-......&......&...Rich'...........................PE..L...Z..K.....................................).......................................X.........................................<....................................*...............................................)...............................text....#.......$.................. ..h.rdata.......).......)..............@..H.data... ....+.......+..............@...PAGE.....C...+...D...+..........

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\x86\silabser.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63104
Entropy (8bit):	6.313958488927774
Encrypted:	false
SSDEEP:	1536:4CVK1U5FkvcfL+MexwdFzTRIkwbzNQfqahBv6E5uzAZFzad4:4CIu5tfLfFzTRIkwbzNQfqahBv6E5VD
MD5:	688F8D8A147F04169139A681A1AA0035
SHA1:	5D05647EBD0052433CB4574F5EC614E404F71314
SHA-256:	4857A353D5A3A390A134999268CF05F09C82E5E881822A43984F8BC74E7D00B1
SHA-512:	DD22AB8F0A5AD168F281DF8FE80E25E9F827B8AB8A5071E1568BB788F36A25488FF9E2839E4E1ADC28B9AFF181D1AE1A3B1D95448D289851D75EFB25F2512DD6
Malicious:	false
Preview:	MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................wS...=...=...=..n....=..n....=..n....=...<...=.$.`...=.$.b...=..n....=..n....=..n....=.Rich..=.........................PE..L...\..P.....................#.......h...............................................`......................................h...<...............................$.......................................@...............t............................text............................... ..h.rdata..............................@..H.data...............................@...

C:\Users\user\AppData\Local\Temp\rqco3gp6.0.cs

Download File

Process:	C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	18192
Entropy (8bit):	4.687683275480424
Encrypted:	false
SSDEEP:	192:FHGxSypaLmjNDj4w71EknylBXFQ6X9VPdGXbcXxceB80qp48k8zc8yQ:hbw7yIgjZV0MceB80qp489zc83
MD5:	DC5B47768E17E1487214C7E29396E4AC
SHA1:	45CDF0CFC120D8AF8EB8D02276AD9EF2F9D436A3
SHA-256:	9587AD0B8AF0A18B61BA6DB0FA385DD6000AF388DCF6253CF0085D5ECFD432DC
SHA-512:	4743F5165F4A168829A14885E26EA797DB8828DF0D9DAC98907D4A089DB9A060D49F36008007DBC385E3F92BFBD50E4DAFF942D75EB62DB246BA6E60F347309E
Malicious:	false
Preview:	.#if _DYNAMIC_XMLSERIALIZER_COMPILATION..[assembly:System.Security.AllowPartiallyTrustedCallers()]..[assembly:System.Security.SecurityTransparent()]..#endif..[assembly:System.Reflection.AssemblyVersionAttribute("2.76.0.0")]..namespace Microsoft.Xml.Serialization.GeneratedAssembly {.... public class XmlSerializationWriterService1 : System.Xml.Serialization.XmlSerializationWriter {.... public void Write1_SubmitFeedbackData(object[] p) {.. WriteStartDocument();.. TopLevelElement();.. int pLength = p.Length;.. WriteStartElement(@"SubmitFeedbackData", @"http://psiconf.hopto.org/", null, false);.. if (pLength > 0) {.. WriteElementString(@"sFeedbackData", @"http://psiconf.hopto.org/", ((global::System.String)p[0]));.. }.. WriteEndElement();.. }.... public void Write2_GetFeedbackMessagesCount(object[] p) {.. WriteStartDocument();.. TopLevelElement();..

C:\Users\user\AppData\Local\Temp\rqco3gp6.cmdline

Download File

Process:	C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (596), with no line terminators
Category:	dropped
Size (bytes):	599
Entropy (8bit):	5.588367265555739
Encrypted:	false
SSDEEP:	12:p3rz5YkNoT7f83MO1862UNvQ5CIrHc9ow16Ph5CDx:VX2kN8f83MOkZ5CeW1ch5CF
MD5:	0446FDF8D7C480DEC9680B7C301C3EB7
SHA1:	BBF6BFB0CD7EEEFECFEC2BD51FC9B99C75671364
SHA-256:	C6F50D4A82E2FAB0ABA426EA7DFAF419834DE741E01B3168E0E4B5E1976D084C
SHA-512:	9F6FD2B4244224040CEA3B09F66309A7D0A67A7629C62A5546121D4123F48A667A52493D384E41DB7E69DAB5A1EE3A7C5FED0193145035E708C1931D7CF75250
Malicious:	true
Preview:	./t:library /utf8output /R:"C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll" /R:"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorlib.dll" /R:"C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe" /R:"C:\Windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll" /R:"C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll" /out:"C:\Users\user\AppData\Local\Temp\rqco3gp6.dll" /debug- /optimize+ /nostdlib /D:_DYNAMIC_XMLSERIALIZER_COMPILATION "C:\Users\user\AppData\Local\Temp\rqco3gp6.0.cs"

C:\Users\user\AppData\Local\Temp\rqco3gp6.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	4.480764967659836
Encrypted:	false
SSDEEP:	192:iEYry0Ki1zzttBPHUAmxxrsoS1GqQW8GKPZ:9Yrlj3ttBcOGq58GKPZ
MD5:	26140D7363DAEE905038C859A19E5623
SHA1:	83B957B3EF1EBEA69719675C7228549348488E79
SHA-256:	6C0BADCDA1DDD5A8729152E791E09D52DBE9248B0AC38516C433617D89FF0E56
SHA-512:	994E9C9F3D8570DCEEFE19F9F6E57E964C42441026B52A913D8F53399ED9572110A6B23C62BEB9A0998F950C0AE0D5B851843379EF488C5279D379FA15CA03EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t..g...........!.....&...........D... ...`....@.. ....................................@..................................D..S....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................D......H.......4)..d............................................................0..E........(.....(......i..r...pr'..p..(......1..r[..pr'..p...t....(.....(......(.....(......i&.rw..pr'..p..(.....(....F.(.....(......i&F.(.....(......i&...(........0...........(....o....&..........j.......(....o....&...(.....8C....(.....{.....{....o....9............(....o....,..(....o.....(....o....&8.....(....o.....(....o....&....(......8.....(....o.....3W...-D.(....o.....{....31.(....o.....{...

C:\Users\user\AppData\Local\Temp\rqco3gp6.out

Download File

Process:	C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (679), with CRLF line terminators
Category:	modified
Size (bytes):	886
Entropy (8bit):	5.6196447172960715
Encrypted:	false
SSDEEP:	24:KMoNzdX2kN8f83MOkZ5CeW1ch5CgKai3SGzKIMl6I5Dvy:dob2kWfckZcT1ScgKb3xKxl6I5Da
MD5:	55B93B1445910E1F9B0995A0EB3D492E
SHA1:	F9D4E3D1EF4303734DE42D54C3F6C70460BDF7F7
SHA-256:	FFA09B59F6FC4ABA58F595021FC8CC4263B682F0862C6CB16C4C55AC2D02CDE3
SHA-512:	27BB0D48BD162E268422AA913122002668CEF8383C270B1AE1C09D7FA33628CCA06AC8401EDA1F1D227CA4ABD50551585B360637CA87977AD1BAA8E4AD85728B
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /t:library /utf8output /R:"C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll" /R:"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorlib.dll" /R:"C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe" /R:"C:\Windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll" /R:"C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll" /out:"C:\Users\user\AppData\Local\Temp\rqco3gp6.dll" /debug- /optimize+ /nostdlib /D:_DYNAMIC_XMLSERIALIZER_COMPILATION "C:\Users\user\AppData\Local\Temp\rqco3gp6.0.cs"......Microsoft (R) Visual C# 2005 Compiler version 8.00.50727.9149..for Microsoft (R) Windows (R) 2005 Framework version 2.0.50727..Copyright (C) Microsoft Corporation 2001-2005. All rights reserved.....

C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\SET152A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	data
Category:	dropped
Size (bytes):	12356
Entropy (8bit):	6.838858924907412
Encrypted:	false
SSDEEP:	192:OeTWTgTeT9TXTqeTc+ECwNGoZBPRY8TE0rr1nYe+PjPurfyLb+vQtjtlAur9ZCs1:j06cFDHcswnnYPLSyLndUHeMMJ
MD5:	FB782004A59BF05EDAFEEE9CEB1AB567
SHA1:	0DDF1D5026BCAC265294F2BA111A85A3B01A7BE4
SHA-256:	6E82E523B5CEC089A9C660B9BD73FC235CC2001D3E0689DB8D637F5455CA8F66
SHA-512:	943C418A7B0C1ACA75C68689E53B53400ADEBDC1544127BD58463CBB17366C66C12ED618D4F5A67A5C15AB9A7C57EADC3CC10FEEC2A797976C69F0FD821C605F
Malicious:	false
Preview:	0.0@..*.H........010.0-...1.0...+......0.....+.....7......0...0...+.....7.......b..sM.b.....8..130122131327Z0...+.....7.....0...0....R0.5.6.3.9.9.F.A.A.C.B.9.F.C.4.9.F.3.C.F.7.8.B.F.C.3.D.9.F.2.F.4.6.3.E.5.0.1.2.E...1...0R..+.....7...1D0B...F.i.l.e.......0w.d.f.c.o.i.n.s.t.a.l.l.e.r.0.1.0.0.9...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........c.....I..x.....c...0....R0.7.6.B.6.4.E.F.3.2.1.0.F.7.5.E.E.2.8.8.3.5.2.7.8.E.6.9.0.A.2.B.1.6.C.4.D.6.4.0...1..s0<..+.....7...1.0,...F.i.l.e........s.i.l.a.b.e.n.m...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0i..+.....7...1[0Y04..+.....7.

C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\SET154A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5992
Entropy (8bit):	5.5835373281452805
Encrypted:	false
SSDEEP:	96:KOvOAUHaqX2eMhdhpTCs1ojH4SvDivhacp1t1h0tHXBZYKLcJ0zx:XOAUHaq2eMhdhpTCsuz4SvDivhacpH1+
MD5:	6FA46FEDF1CBE21B587F21286466D8A6
SHA1:	39A9B9E3887960581A5F3E4DAA497F9111B7F74A
SHA-256:	32B8BDF3D6D7907AEC9FBA68B94BEF31FF5EB0597EB73C9B4FFE59B4B3CDAD69
SHA-512:	F003DDDC786885CF42D840840465D37EDE2506CD3BBDC68D7AD10B331F0F0DACDB8529043BCC0043A2632006BADD546E62CFB4CC9FE798013358603C92A7ECE3
Malicious:	false
Preview:	;/++..;..;Module Name:..;..; slabvcp.INF..;..; Copyright 2012, Silicon Laboratories..;..;Abstract:..; Installation INF for Silicon Laboratories CP210x device using KDMF Version 1.9..;..;--/....[Version]..Signature="$WINDOWS NT$"..Class=Ports..ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}..Provider=%Provider%..DriverVer=12/10/2012,6.6.1.0..CatalogFile=slabvcp.cat......; ================= Device section =====================....[Manufacturer]..%MfgName%=SiLabs, NTamd64....[SiLabs]..%USB\VID_10C4&PID_EA60.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA60..%USB\VID_10C4&PID_EA70&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_00..%USB\VID_10C4&PID_EA70&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_01..%USB\VID_10C4&PID_EA71&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_00..%USB\VID_10C4&PID_EA71&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_01..%USB\VID_10C4&PID_EA71&Mi_02.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_02..%USB\VID_

C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\slabvcp.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	data
Category:	dropped
Size (bytes):	12356
Entropy (8bit):	6.838858924907412
Encrypted:	false
SSDEEP:	192:OeTWTgTeT9TXTqeTc+ECwNGoZBPRY8TE0rr1nYe+PjPurfyLb+vQtjtlAur9ZCs1:j06cFDHcswnnYPLSyLndUHeMMJ
MD5:	FB782004A59BF05EDAFEEE9CEB1AB567
SHA1:	0DDF1D5026BCAC265294F2BA111A85A3B01A7BE4
SHA-256:	6E82E523B5CEC089A9C660B9BD73FC235CC2001D3E0689DB8D637F5455CA8F66
SHA-512:	943C418A7B0C1ACA75C68689E53B53400ADEBDC1544127BD58463CBB17366C66C12ED618D4F5A67A5C15AB9A7C57EADC3CC10FEEC2A797976C69F0FD821C605F
Malicious:	false
Preview:	0.0@..*.H........010.0-...1.0...+......0.....+.....7......0...0...+.....7.......b..sM.b.....8..130122131327Z0...+.....7.....0...0....R0.5.6.3.9.9.F.A.A.C.B.9.F.C.4.9.F.3.C.F.7.8.B.F.C.3.D.9.F.2.F.4.6.3.E.5.0.1.2.E...1...0R..+.....7...1D0B...F.i.l.e.......0w.d.f.c.o.i.n.s.t.a.l.l.e.r.0.1.0.0.9...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........c.....I..x.....c...0....R0.7.6.B.6.4.E.F.3.2.1.0.F.7.5.E.E.2.8.8.3.5.2.7.8.E.6.9.0.A.2.B.1.6.C.4.D.6.4.0...1..s0<..+.....7...1.0,...F.i.l.e........s.i.l.a.b.e.n.m...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0i..+.....7...1[0Y04..+.....7.

C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\slabvcp.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5992
Entropy (8bit):	5.5835373281452805
Encrypted:	false
SSDEEP:	96:KOvOAUHaqX2eMhdhpTCs1ojH4SvDivhacp1t1h0tHXBZYKLcJ0zx:XOAUHaq2eMhdhpTCsuz4SvDivhacpH1+
MD5:	6FA46FEDF1CBE21B587F21286466D8A6
SHA1:	39A9B9E3887960581A5F3E4DAA497F9111B7F74A
SHA-256:	32B8BDF3D6D7907AEC9FBA68B94BEF31FF5EB0597EB73C9B4FFE59B4B3CDAD69
SHA-512:	F003DDDC786885CF42D840840465D37EDE2506CD3BBDC68D7AD10B331F0F0DACDB8529043BCC0043A2632006BADD546E62CFB4CC9FE798013358603C92A7ECE3
Malicious:	false
Preview:	;/++..;..;Module Name:..;..; slabvcp.INF..;..; Copyright 2012, Silicon Laboratories..;..;Abstract:..; Installation INF for Silicon Laboratories CP210x device using KDMF Version 1.9..;..;--/....[Version]..Signature="$WINDOWS NT$"..Class=Ports..ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}..Provider=%Provider%..DriverVer=12/10/2012,6.6.1.0..CatalogFile=slabvcp.cat......; ================= Device section =====================....[Manufacturer]..%MfgName%=SiLabs, NTamd64....[SiLabs]..%USB\VID_10C4&PID_EA60.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA60..%USB\VID_10C4&PID_EA70&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_00..%USB\VID_10C4&PID_EA70&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_01..%USB\VID_10C4&PID_EA71&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_00..%USB\VID_10C4&PID_EA71&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_01..%USB\VID_10C4&PID_EA71&Mi_02.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_02..%USB\VID_

C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\SET14D9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27336
Entropy (8bit):	6.172214959675352
Encrypted:	false
SSDEEP:	384:n6oIhnyUR2OZRy0m1KOd/V3nL7fVRQlQeddvuVyxxTWBU/TJ1mTbCemE:fIZygU31Kw/V3L7f4esv2+/TbobCM
MD5:	7799106FEE728B907A86D9C9751E02D5
SHA1:	F35320E535159D43B598C7C11684DB05BE4196A6
SHA-256:	EE85E8D3CF3819DB28221BFC103DE8DF0E14E1878CECF54E8CD8C161B0E0AF3C
SHA-512:	F91AF958ADF1B808FC6C30AA7FE9C6CF8C5C2A041327693403D9A12A06E7C5084D203433BA2D0917A3FC1A064626BCE89526C5FB4B951F0A4AA07E84D237A99C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."..eL.eL.eL.eM.eL...7.eL...1.eL....eL....eL...!.eL....eL....eL....eL.Rich.eL.........................PE..d......K.........."......J..........................................................$...........................................................(............P.......\...............1...............................................0...............................text...f........................... ..h.rdata..t....0......................@..H.data........@......................@....pdata.......P....... ..............@..HPAGE....M....`.......".............. ..`PAGESENM.............<.............. ..`INIT....d............P.............. ....rsrc................X..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\SET14EA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73216
Entropy (8bit):	6.104930566748915
Encrypted:	false
SSDEEP:	1536:0ZsxDp0cAS3xTZDPU+dlLxAoO4lx/CGxMP4TNYyTPfBi3ItZRmU2Eo+u:/xDScAGTFcWQGx/CGxMP4TNYyTPfBi4g
MD5:	447209C314E6E0D26E01962075802B18
SHA1:	DD8AF2E3AA38D2D6971568EBF2CF41848E0091F5
SHA-256:	AB1AC5854EB0EDF66025609CF9CB5639014C264327F4DEE1223BF7F6E1BD2D15
SHA-512:	E2F8470C31496D1547CF930DD32805407722F81F6846E4257BF28CE37BF635F8EDA07A19E99FCBE10AAD939E7912FED4ABA098B58CCCC66217F2965BF4D10C73
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........H...H...H...A.Y.K...A.Z.K...A.V.K...A.M.J...H...Q...>...K...>...I...A.].E...A.K.J...>...I...A.W.[...A.J.I...A.O.I...RichH...........PE..d...p..P.........."..........*.....................................................R.......................................................$v..<...............................8....................................................................................text............................... ..h.rdata..<...........................@..H.data...T...........................@....pdata..............................@..HPAGESRP0c9.......:.................. ..`PAGE....~....P...................... ..`PAGESER......`...................... ..`INIT.........p...................... ....rsrc...............................@..B.reloc..............................@..B........................................................................

C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\SET14FA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1721576
Entropy (8bit):	7.978334410477683
Encrypted:	false
SSDEEP:	24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
MD5:	4DA5DA193E0E4F86F6F8FD43EF25329A
SHA1:	68A44D37FF535A2C454F2440E1429833A1C6D810
SHA-256:	18487B4FF94EDCCC98ED59D9FCA662D4A1331C5F1E14DF8DB3093256DD9F1C3E
SHA-512:	B3D73ED5E45D6F2908B2F3086390DD28C1631E298756CEE9BDF26B185F0B77D1B8C03AD55E0495DBA982C5BED4A03337B130C76F7112F3E19821127D2CF36853
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.v...%...%...%.m+%...%.m:%...%...% ..%.m-%...%.m=%...%.m,%...%.m7%...%...%...%.m%...%.m/%...%Rich...%........................PE..d.....[J.........." .........0............................................................@.........................................`................p..l!...`..,....,...............................................................................................text...L........................... ..`.data....J..........................@....pdata..,....`......................@..@.rsrc...l!...p..."..................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\WdfCoinstaller01009.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1721576
Entropy (8bit):	7.978334410477683
Encrypted:	false
SSDEEP:	24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
MD5:	4DA5DA193E0E4F86F6F8FD43EF25329A
SHA1:	68A44D37FF535A2C454F2440E1429833A1C6D810
SHA-256:	18487B4FF94EDCCC98ED59D9FCA662D4A1331C5F1E14DF8DB3093256DD9F1C3E
SHA-512:	B3D73ED5E45D6F2908B2F3086390DD28C1631E298756CEE9BDF26B185F0B77D1B8C03AD55E0495DBA982C5BED4A03337B130C76F7112F3E19821127D2CF36853
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.v...%...%...%.m+%...%.m:%...%...% ..%.m-%...%.m=%...%.m,%...%.m7%...%...%...%.m%...%.m/%...%Rich...%........................PE..d.....[J.........." .........0............................................................@.........................................`................p..l!...`..,....,...............................................................................................text...L........................... ..`.data....J..........................@....pdata..,....`......................@..@.rsrc...l!...p..."..................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\silabenm.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27336
Entropy (8bit):	6.172214959675352
Encrypted:	false
SSDEEP:	384:n6oIhnyUR2OZRy0m1KOd/V3nL7fVRQlQeddvuVyxxTWBU/TJ1mTbCemE:fIZygU31Kw/V3L7f4esv2+/TbobCM
MD5:	7799106FEE728B907A86D9C9751E02D5
SHA1:	F35320E535159D43B598C7C11684DB05BE4196A6
SHA-256:	EE85E8D3CF3819DB28221BFC103DE8DF0E14E1878CECF54E8CD8C161B0E0AF3C
SHA-512:	F91AF958ADF1B808FC6C30AA7FE9C6CF8C5C2A041327693403D9A12A06E7C5084D203433BA2D0917A3FC1A064626BCE89526C5FB4B951F0A4AA07E84D237A99C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."..eL.eL.eL.eM.eL...7.eL...1.eL....eL....eL...!.eL....eL....eL....eL.Rich.eL.........................PE..d......K.........."......J..........................................................$...........................................................(............P.......\...............1...............................................0...............................text...f........................... ..h.rdata..t....0......................@..H.data........@......................@....pdata.......P....... ..............@..HPAGE....M....`.......".............. ..`PAGESENM.............<.............. ..`INIT....d............P.............. ....rsrc................X..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\x64\silabser.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73216
Entropy (8bit):	6.104930566748915
Encrypted:	false
SSDEEP:	1536:0ZsxDp0cAS3xTZDPU+dlLxAoO4lx/CGxMP4TNYyTPfBi3ItZRmU2Eo+u:/xDScAGTFcWQGx/CGxMP4TNYyTPfBi4g
MD5:	447209C314E6E0D26E01962075802B18
SHA1:	DD8AF2E3AA38D2D6971568EBF2CF41848E0091F5
SHA-256:	AB1AC5854EB0EDF66025609CF9CB5639014C264327F4DEE1223BF7F6E1BD2D15
SHA-512:	E2F8470C31496D1547CF930DD32805407722F81F6846E4257BF28CE37BF635F8EDA07A19E99FCBE10AAD939E7912FED4ABA098B58CCCC66217F2965BF4D10C73
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........H...H...H...A.Y.K...A.Z.K...A.V.K...A.M.J...H...Q...>...K...>...I...A.].E...A.K.J...>...I...A.W.[...A.J.I...A.O.I...RichH...........PE..d...p..P.........."..........*.....................................................R.......................................................$v..<...............................8....................................................................................text............................... ..h.rdata..<...........................@..H.data...T...........................@....pdata..............................@..HPAGESRP0c9.......:.................. ..`PAGE....~....P...................... ..`PAGESER......`...................... ..`INIT.........p...................... ....rsrc...............................@..B.reloc..............................@..B........................................................................

C:\Windows\INF\oem0.PNF

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1158 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	5884
Entropy (8bit):	3.2460889393392987
Encrypted:	false
SSDEEP:	96:16T0jnDWLlB9q8oaVBngqczhiJRW65XsRL1/mzenFWhH:sCyZq81zngqIhiJRb5cWzOEp
MD5:	64026D01A971058E168968A009B388A4
SHA1:	88FE1CD729B95B7A80909EEFBD1B7D7ED171FFAB
SHA-256:	59996A95EBA32B12A5C2768695D0B99097B21BA1BFFBABB6C2D2B4B186AD9DE3
SHA-512:	1B7191E9E955382C06CB16019284B1CB1AF91672A30D147A367D134480BB9C0B60C24A45FBB5955233CAAAEB699D8FC2519DAF34E9FB51CAA663313BC39335D8
Malicious:	false
Preview:	................H...X....d..................................h...,.......0.......h.......................C.:.\.W.i.n.d.o.w.s.........................................................................................................\...................................................................\|.......................\|...........................................................................................................................................................................`.......H.......................................................................L...................................................................................................................@...........................................................................................................................................................h.......................t...................................................................................................................................

C:\Windows\INF\oem1.PNF

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1100 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	5740
Entropy (8bit):	3.1977940754895045
Encrypted:	false
SSDEEP:	96:EHv3dP0/4NQVUgk8QaUUMF6LXZRg1lYCncekSDzD:E1vQ6x8lHM4LpjCcWDzD
MD5:	F6522A824FF0E6517592760FAD67B4A2
SHA1:	0BB8E72584D0E26990592F1FF005931F1C982E8B
SHA-256:	DCD864FDF73D20AD3A3259BBFB5B983DA0C27BBC8754BA91D5B03B1F23F2E83B
SHA-512:	E03D62574F82D5827122261B42192FF0BB125A93C0A8172ACEB9F9E6E0FDA03542496E0DBE32AE557B103E6D3043DF4AEDF011A8F125B02EB786C9E3E291D113
Malicious:	false
Preview:	................H..................................H...............(.......H...h...............h.......C.:.\.W.i.n.d.o.w.s.....x...................................................$...............................................................................................................d...(...........................................................................................................................................................................................................................................................x...................................................................$...............................................................................................4...........................0.......................................................................................................................................................................................................p...........................................................

C:\Windows\INF\oem3.PNF

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1210 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	6284
Entropy (8bit):	3.230167692177736
Encrypted:	false
SSDEEP:	96:f4rgQiImiNgAIXSxS6rxvTp181fQ1UvZUuQSCUJ:XImidV3dqZUK/
MD5:	B5D8129EAC382A3E8DCF89EB99CAEFF7
SHA1:	EE1AC4DC8E468A336922231F2E07E5C8F2C64FCF
SHA-256:	1270052B78BE63F9ABB7791DE2E1722807F2050117887C8CE91622032BCADB55
SHA-512:	CCCEB6ACDADC6A8EB3A52D2EE808FFCDE46E1FA744BC38DE4FD4AB5D4FBED942ECD5FC6B229CDC15BD281AFA9281C189E51017A9396873596C324134E4BBD563
Malicious:	false
Preview:	................X........K.}........................h.......p...D.......d... ...h.......................C.:.\.W.i.n.d.o.w.s.............................................................................................................................................................................................................H...........................................8.......................................H.......................................................................................................................................................................................................................................,.......................................................................................................................................................................................................................................................................................................h...............................................8...........

C:\Windows\INF\oem4.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5992
Entropy (8bit):	5.5835373281452805
Encrypted:	false
SSDEEP:	96:KOvOAUHaqX2eMhdhpTCs1ojH4SvDivhacp1t1h0tHXBZYKLcJ0zx:XOAUHaq2eMhdhpTCsuz4SvDivhacpH1+
MD5:	6FA46FEDF1CBE21B587F21286466D8A6
SHA1:	39A9B9E3887960581A5F3E4DAA497F9111B7F74A
SHA-256:	32B8BDF3D6D7907AEC9FBA68B94BEF31FF5EB0597EB73C9B4FFE59B4B3CDAD69
SHA-512:	F003DDDC786885CF42D840840465D37EDE2506CD3BBDC68D7AD10B331F0F0DACDB8529043BCC0043A2632006BADD546E62CFB4CC9FE798013358603C92A7ECE3
Malicious:	false
Preview:	;/++..;..;Module Name:..;..; slabvcp.INF..;..; Copyright 2012, Silicon Laboratories..;..;Abstract:..; Installation INF for Silicon Laboratories CP210x device using KDMF Version 1.9..;..;--/....[Version]..Signature="$WINDOWS NT$"..Class=Ports..ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}..Provider=%Provider%..DriverVer=12/10/2012,6.6.1.0..CatalogFile=slabvcp.cat......; ================= Device section =====================....[Manufacturer]..%MfgName%=SiLabs, NTamd64....[SiLabs]..%USB\VID_10C4&PID_EA60.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA60..%USB\VID_10C4&PID_EA70&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_00..%USB\VID_10C4&PID_EA70&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_01..%USB\VID_10C4&PID_EA71&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_00..%USB\VID_10C4&PID_EA71&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_01..%USB\VID_10C4&PID_EA71&Mi_02.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_02..%USB\VID_

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	55063
Entropy (8bit):	5.313671821483159
Encrypted:	false
SSDEEP:	384:OGdni80C/8g0atRf7yr14ujuNY9AZi3Z/oUtwrP3UQGSE254jav0i8piil:Own95cdyYloiwTyz25cDNl
MD5:	319B2E529C761070C507DAB4E1B66BC3
SHA1:	C750480AB70296C5584662E1EDDCC42D065DA719
SHA-256:	59A90D237BE9C50DDE49554AE583978B7FD3C890E1DF7479479B8D35E0218743
SHA-512:	47ABDAC5DE9333238EC2769E845911A8F2FF62F61C5B0B02A68E40C17E0FBD56164C1BF0782AD1734FA33476A83AB40E54168086DF2243FFC8A4614D0E697F17
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\SET18A5.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	12356
Entropy (8bit):	6.838858924907412
Encrypted:	false
SSDEEP:	192:OeTWTgTeT9TXTqeTc+ECwNGoZBPRY8TE0rr1nYe+PjPurfyLb+vQtjtlAur9ZCs1:j06cFDHcswnnYPLSyLndUHeMMJ
MD5:	FB782004A59BF05EDAFEEE9CEB1AB567
SHA1:	0DDF1D5026BCAC265294F2BA111A85A3B01A7BE4
SHA-256:	6E82E523B5CEC089A9C660B9BD73FC235CC2001D3E0689DB8D637F5455CA8F66
SHA-512:	943C418A7B0C1ACA75C68689E53B53400ADEBDC1544127BD58463CBB17366C66C12ED618D4F5A67A5C15AB9A7C57EADC3CC10FEEC2A797976C69F0FD821C605F
Malicious:	false
Preview:	0.0@..*.H........010.0-...1.0...+......0.....+.....7......0...0...+.....7.......b..sM.b.....8..130122131327Z0...+.....7.....0...0....R0.5.6.3.9.9.F.A.A.C.B.9.F.C.4.9.F.3.C.F.7.8.B.F.C.3.D.9.F.2.F.4.6.3.E.5.0.1.2.E...1...0R..+.....7...1D0B...F.i.l.e.......0w.d.f.c.o.i.n.s.t.a.l.l.e.r.0.1.0.0.9...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........c.....I..x.....c...0....R0.7.6.B.6.4.E.F.3.2.1.0.F.7.5.E.E.2.8.8.3.5.2.7.8.E.6.9.0.A.2.B.1.6.C.4.D.6.4.0...1..s0<..+.....7...1.0,...F.i.l.e........s.i.l.a.b.e.n.m...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0i..+.....7...1[0Y04..+.....7.

C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\SET18B5.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5992
Entropy (8bit):	5.5835373281452805
Encrypted:	false
SSDEEP:	96:KOvOAUHaqX2eMhdhpTCs1ojH4SvDivhacp1t1h0tHXBZYKLcJ0zx:XOAUHaq2eMhdhpTCsuz4SvDivhacpH1+
MD5:	6FA46FEDF1CBE21B587F21286466D8A6
SHA1:	39A9B9E3887960581A5F3E4DAA497F9111B7F74A
SHA-256:	32B8BDF3D6D7907AEC9FBA68B94BEF31FF5EB0597EB73C9B4FFE59B4B3CDAD69
SHA-512:	F003DDDC786885CF42D840840465D37EDE2506CD3BBDC68D7AD10B331F0F0DACDB8529043BCC0043A2632006BADD546E62CFB4CC9FE798013358603C92A7ECE3
Malicious:	false
Preview:	;/++..;..;Module Name:..;..; slabvcp.INF..;..; Copyright 2012, Silicon Laboratories..;..;Abstract:..; Installation INF for Silicon Laboratories CP210x device using KDMF Version 1.9..;..;--/....[Version]..Signature="$WINDOWS NT$"..Class=Ports..ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}..Provider=%Provider%..DriverVer=12/10/2012,6.6.1.0..CatalogFile=slabvcp.cat......; ================= Device section =====================....[Manufacturer]..%MfgName%=SiLabs, NTamd64....[SiLabs]..%USB\VID_10C4&PID_EA60.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA60..%USB\VID_10C4&PID_EA70&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_00..%USB\VID_10C4&PID_EA70&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_01..%USB\VID_10C4&PID_EA71&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_00..%USB\VID_10C4&PID_EA71&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_01..%USB\VID_10C4&PID_EA71&Mi_02.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_02..%USB\VID_

C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	12356
Entropy (8bit):	6.838858924907412
Encrypted:	false
SSDEEP:	192:OeTWTgTeT9TXTqeTc+ECwNGoZBPRY8TE0rr1nYe+PjPurfyLb+vQtjtlAur9ZCs1:j06cFDHcswnnYPLSyLndUHeMMJ
MD5:	FB782004A59BF05EDAFEEE9CEB1AB567
SHA1:	0DDF1D5026BCAC265294F2BA111A85A3B01A7BE4
SHA-256:	6E82E523B5CEC089A9C660B9BD73FC235CC2001D3E0689DB8D637F5455CA8F66
SHA-512:	943C418A7B0C1ACA75C68689E53B53400ADEBDC1544127BD58463CBB17366C66C12ED618D4F5A67A5C15AB9A7C57EADC3CC10FEEC2A797976C69F0FD821C605F
Malicious:	false
Preview:	0.0@..*.H........010.0-...1.0...+......0.....+.....7......0...0...+.....7.......b..sM.b.....8..130122131327Z0...+.....7.....0...0....R0.5.6.3.9.9.F.A.A.C.B.9.F.C.4.9.F.3.C.F.7.8.B.F.C.3.D.9.F.2.F.4.6.3.E.5.0.1.2.E...1...0R..+.....7...1D0B...F.i.l.e.......0w.d.f.c.o.i.n.s.t.a.l.l.e.r.0.1.0.0.9...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........c.....I..x.....c...0....R0.7.6.B.6.4.E.F.3.2.1.0.F.7.5.E.E.2.8.8.3.5.2.7.8.E.6.9.0.A.2.B.1.6.C.4.D.6.4.0...1..s0<..+.....7...1.0,...F.i.l.e........s.i.l.a.b.e.n.m...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0i..+.....7...1[0Y04..+.....7.

C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5992
Entropy (8bit):	5.5835373281452805
Encrypted:	false
SSDEEP:	96:KOvOAUHaqX2eMhdhpTCs1ojH4SvDivhacp1t1h0tHXBZYKLcJ0zx:XOAUHaq2eMhdhpTCsuz4SvDivhacpH1+
MD5:	6FA46FEDF1CBE21B587F21286466D8A6
SHA1:	39A9B9E3887960581A5F3E4DAA497F9111B7F74A
SHA-256:	32B8BDF3D6D7907AEC9FBA68B94BEF31FF5EB0597EB73C9B4FFE59B4B3CDAD69
SHA-512:	F003DDDC786885CF42D840840465D37EDE2506CD3BBDC68D7AD10B331F0F0DACDB8529043BCC0043A2632006BADD546E62CFB4CC9FE798013358603C92A7ECE3
Malicious:	false
Preview:	;/++..;..;Module Name:..;..; slabvcp.INF..;..; Copyright 2012, Silicon Laboratories..;..;Abstract:..; Installation INF for Silicon Laboratories CP210x device using KDMF Version 1.9..;..;--/....[Version]..Signature="$WINDOWS NT$"..Class=Ports..ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}..Provider=%Provider%..DriverVer=12/10/2012,6.6.1.0..CatalogFile=slabvcp.cat......; ================= Device section =====================....[Manufacturer]..%MfgName%=SiLabs, NTamd64....[SiLabs]..%USB\VID_10C4&PID_EA60.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA60..%USB\VID_10C4&PID_EA70&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_00..%USB\VID_10C4&PID_EA70&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_01..%USB\VID_10C4&PID_EA71&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_00..%USB\VID_10C4&PID_EA71&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_01..%USB\VID_10C4&PID_EA71&Mi_02.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_02..%USB\VID_

C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET17E6.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27336
Entropy (8bit):	6.172214959675352
Encrypted:	false
SSDEEP:	384:n6oIhnyUR2OZRy0m1KOd/V3nL7fVRQlQeddvuVyxxTWBU/TJ1mTbCemE:fIZygU31Kw/V3L7f4esv2+/TbobCM
MD5:	7799106FEE728B907A86D9C9751E02D5
SHA1:	F35320E535159D43B598C7C11684DB05BE4196A6
SHA-256:	EE85E8D3CF3819DB28221BFC103DE8DF0E14E1878CECF54E8CD8C161B0E0AF3C
SHA-512:	F91AF958ADF1B808FC6C30AA7FE9C6CF8C5C2A041327693403D9A12A06E7C5084D203433BA2D0917A3FC1A064626BCE89526C5FB4B951F0A4AA07E84D237A99C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."..eL.eL.eL.eM.eL...7.eL...1.eL....eL....eL...!.eL....eL....eL....eL.Rich.eL.........................PE..d......K.........."......J..........................................................$...........................................................(............P.......\...............1...............................................0...............................text...f........................... ..h.rdata..t....0......................@..H.data........@......................@....pdata.......P....... ..............@..HPAGE....M....`.......".............. ..`PAGESENM.............<.............. ..`INIT....d............P.............. ....rsrc................X..............@..B........................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET1845.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73216
Entropy (8bit):	6.104930566748915
Encrypted:	false
SSDEEP:	1536:0ZsxDp0cAS3xTZDPU+dlLxAoO4lx/CGxMP4TNYyTPfBi3ItZRmU2Eo+u:/xDScAGTFcWQGx/CGxMP4TNYyTPfBi4g
MD5:	447209C314E6E0D26E01962075802B18
SHA1:	DD8AF2E3AA38D2D6971568EBF2CF41848E0091F5
SHA-256:	AB1AC5854EB0EDF66025609CF9CB5639014C264327F4DEE1223BF7F6E1BD2D15
SHA-512:	E2F8470C31496D1547CF930DD32805407722F81F6846E4257BF28CE37BF635F8EDA07A19E99FCBE10AAD939E7912FED4ABA098B58CCCC66217F2965BF4D10C73
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........H...H...H...A.Y.K...A.Z.K...A.V.K...A.M.J...H...Q...>...K...>...I...A.].E...A.K.J...>...I...A.W.[...A.J.I...A.O.I...RichH...........PE..d...p..P.........."..........*.....................................................R.......................................................$v..<...............................8....................................................................................text............................... ..h.rdata..<...........................@..H.data...T...........................@....pdata..............................@..HPAGESRP0c9.......:.................. ..`PAGE....~....P...................... ..`PAGESER......`...................... ..`INIT.........p...................... ....rsrc...............................@..B.reloc..............................@..B........................................................................

C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\SET1865.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1721576
Entropy (8bit):	7.978334410477683
Encrypted:	false
SSDEEP:	24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
MD5:	4DA5DA193E0E4F86F6F8FD43EF25329A
SHA1:	68A44D37FF535A2C454F2440E1429833A1C6D810
SHA-256:	18487B4FF94EDCCC98ED59D9FCA662D4A1331C5F1E14DF8DB3093256DD9F1C3E
SHA-512:	B3D73ED5E45D6F2908B2F3086390DD28C1631E298756CEE9BDF26B185F0B77D1B8C03AD55E0495DBA982C5BED4A03337B130C76F7112F3E19821127D2CF36853
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.v...%...%...%.m+%...%.m:%...%...% ..%.m-%...%.m=%...%.m,%...%.m7%...%...%...%.m%...%.m/%...%Rich...%........................PE..d.....[J.........." .........0............................................................@.........................................`................p..l!...`..,....,...............................................................................................text...L........................... ..`.data....J..........................@....pdata..,....`......................@..@.rsrc...l!...p..."..................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\WdfCoinstaller01009.dll (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1721576
Entropy (8bit):	7.978334410477683
Encrypted:	false
SSDEEP:	24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
MD5:	4DA5DA193E0E4F86F6F8FD43EF25329A
SHA1:	68A44D37FF535A2C454F2440E1429833A1C6D810
SHA-256:	18487B4FF94EDCCC98ED59D9FCA662D4A1331C5F1E14DF8DB3093256DD9F1C3E
SHA-512:	B3D73ED5E45D6F2908B2F3086390DD28C1631E298756CEE9BDF26B185F0B77D1B8C03AD55E0495DBA982C5BED4A03337B130C76F7112F3E19821127D2CF36853
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.v...%...%...%.m+%...%.m:%...%...% ..%.m-%...%.m=%...%.m,%...%.m7%...%...%...%.m%...%.m/%...%Rich...%........................PE..d.....[J.........." .........0............................................................@.........................................`................p..l!...`..,....,...............................................................................................text...L........................... ..`.data....J..........................@....pdata..,....`......................@..@.rsrc...l!...p..."..................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\silabenm.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27336
Entropy (8bit):	6.172214959675352
Encrypted:	false
SSDEEP:	384:n6oIhnyUR2OZRy0m1KOd/V3nL7fVRQlQeddvuVyxxTWBU/TJ1mTbCemE:fIZygU31Kw/V3L7f4esv2+/TbobCM
MD5:	7799106FEE728B907A86D9C9751E02D5
SHA1:	F35320E535159D43B598C7C11684DB05BE4196A6
SHA-256:	EE85E8D3CF3819DB28221BFC103DE8DF0E14E1878CECF54E8CD8C161B0E0AF3C
SHA-512:	F91AF958ADF1B808FC6C30AA7FE9C6CF8C5C2A041327693403D9A12A06E7C5084D203433BA2D0917A3FC1A064626BCE89526C5FB4B951F0A4AA07E84D237A99C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."..eL.eL.eL.eM.eL...7.eL...1.eL....eL....eL...!.eL....eL....eL....eL.Rich.eL.........................PE..d......K.........."......J..........................................................$...........................................................(............P.......\...............1...............................................0...............................text...f........................... ..h.rdata..t....0......................@..H.data........@......................@....pdata.......P....... ..............@..HPAGE....M....`.......".............. ..`PAGESENM.............<.............. ..`INIT....d............P.............. ....rsrc................X..............@..B........................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\x64\silabser.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73216
Entropy (8bit):	6.104930566748915
Encrypted:	false
SSDEEP:	1536:0ZsxDp0cAS3xTZDPU+dlLxAoO4lx/CGxMP4TNYyTPfBi3ItZRmU2Eo+u:/xDScAGTFcWQGx/CGxMP4TNYyTPfBi4g
MD5:	447209C314E6E0D26E01962075802B18
SHA1:	DD8AF2E3AA38D2D6971568EBF2CF41848E0091F5
SHA-256:	AB1AC5854EB0EDF66025609CF9CB5639014C264327F4DEE1223BF7F6E1BD2D15
SHA-512:	E2F8470C31496D1547CF930DD32805407722F81F6846E4257BF28CE37BF635F8EDA07A19E99FCBE10AAD939E7912FED4ABA098B58CCCC66217F2965BF4D10C73
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........H...H...H...A.Y.K...A.Z.K...A.V.K...A.M.J...H...Q...>...K...>...I...A.].E...A.K.J...>...I...A.W.[...A.J.I...A.O.I...RichH...........PE..d...p..P.........."..........*.....................................................R.......................................................$v..<...............................8....................................................................................text............................... ..h.rdata..<...........................@..H.data...T...........................@....pdata..............................@..HPAGESRP0c9.......:.................. ..`PAGE....~....P...................... ..`PAGESER......`...................... ..`INIT.........p...................... ....rsrc...............................@..B.reloc..............................@..B........................................................................

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	3474
Entropy (8bit):	5.366327254621301
Encrypted:	false
SSDEEP:	96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3YpgpN/H:QO00eO00erMwmkB1kAx
MD5:	8C6F34080B4A50183A33FA4CCAA78207
SHA1:	DAF16DC9865A82A8C81F1B06B6CAB1BB148C49CA
SHA-256:	3682366FA5D3D0B77BCBFB5BD91A5DD3865CC3C2CAC090466676BD86431BD7BE
SHA-512:	6B12A550BEDC9FFFE7FC2B78F79142A9CF68D2DE2C012696C48CA43D31E0C5C7636D3BE762848C606AE0E2A5AC12F27EE1CFCEE6445A1EDB63049F8E3F647215
Malicious:	false
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

C:\Windows\assembly\Desktop.ini

Download File

Process:	C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe
File Type:	Windows desktop.ini
Category:	dropped
Size (bytes):	227
Entropy (8bit):	5.2735028737400205
Encrypted:	false
SSDEEP:	6:a1eZBXVNYTF0NwoScUbtSgyAXIWv7v5PMKq:UeZBFNYTswUq1r5zq
MD5:	F7F759A5CD40BC52172E83486B6DE404
SHA1:	D74930F354A56CFD03DC91AA96D8AE9657B1EE54
SHA-256:	A709C2551B8818D7849D31A65446DC2F8C4CCA2DCBBC5385604286F49CFDAF1C
SHA-512:	A50B7826BFE72506019E4B1148A214C71C6F4743C09E809EF15CD0E0223F3078B683D203200910B07B5E1E34B94F0FE516AC53527311E2943654BFCEADE53298
Malicious:	false
Preview:	; ==++==..; ..; Copyright (c) Microsoft Corporation. All rights reserved...; ..; ==--==..[.ShellClassInfo]..CLSID={1D2680C9-0E2A-469d-B787-065558BC7D43}..ConfirmFileOp=1..InfoTip=Contains application stability information...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.968447528561429
TrID:	Win32 Executable (generic) a (10002005/4) 99.70% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PSI-CONF_Setup_v2.76.exe
File size:	46'190'112 bytes
MD5:	4bf5ec6ea419625fd7fbc9d7df84b5f4
SHA1:	4f530013dcc3d2393abb006ca66834f558036c89
SHA256:	9162049d459e334a9721e7e770bf2e1e64d60ebccfbf43d727e8975db6c9df00
SHA512:	08935bdb7b3b60c7540e315b8d368061e2cdb1c28f4f4285e46e1d4ee47cf8f5d2c7ab74ae8ef78ef615ec7055647e4198b86e198c6f670502dc4301b47ee16f
SSDEEP:	786432:/oPA/RHBdUbjSOqr6t3bbDARzx+ais6sqpoj7:/oPsHBdUbYr6tn2zx+aI3pov
TLSH:	D5A722C41C71B3BAD16BA2FCCAB27540821A0234B91CB7DA738295276749F0B4D76D7E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&Tf.b5..b5..b5..E.u.r5...:U.k5..b5...5..E.e.(5..E.f.B5..E.t.c5..E.p.c5..Richb5..........................PE..L....~.J...........

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x403079
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4AF47EB7 [Fri Nov 6 19:53:27 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d2c82993d1a616abe994cabd5db7b4f8

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	02/05/2018 20:00:00 14/05/2021 19:59:59
Subject Chain	CN=Phoenix Contact GmbH & Co. KG, O=Phoenix Contact GmbH & Co. KG, L=Blomberg, S=Nordrhein-Westfalen, C=DE
Version:	3
Thumbprint MD5:	C21D408D642641DC9E3531039A9EABB1
Thumbprint SHA-1:	C4C7CFC624408FC93A1DD6544A82541682910E53
Thumbprint SHA-256:	83D416DEEAFC24EF54542FBFFA6C86FABB5AB66ED89DBA3B05886EB56DD82FB7
Serial:	0A7E5C8B1CAC8FEE5101A80D6746D546

Entrypoint Preview

Instruction
call 00007FAFD86C8970h
jmp 00007FAFD86C588Bh
push ebp
mov ebp, esp
sub esp, 04h
mov dword ptr [ebp-04h], edi
mov edi, dword ptr [ebp+08h]
mov ecx, dword ptr [ebp+0Ch]
shr ecx, 07h
pxor xmm0, xmm0
jmp 00007FAFD86C5A7Ah
lea esp, dword ptr [esp+00000000h]
nop
movdqa dqword ptr [edi], xmm0
movdqa dqword ptr [edi+10h], xmm0
movdqa dqword ptr [edi+20h], xmm0
movdqa dqword ptr [edi+30h], xmm0
movdqa dqword ptr [edi+40h], xmm0
movdqa dqword ptr [edi+50h], xmm0
movdqa dqword ptr [edi+60h], xmm0
movdqa dqword ptr [edi+70h], xmm0
lea edi, dword ptr [edi+00000080h]
dec ecx
jne 00007FAFD86C5A42h
mov edi, dword ptr [ebp-04h]
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 10h
mov dword ptr [ebp-04h], edi
mov eax, dword ptr [ebp+08h]
cdq
mov edi, eax
xor edi, edx
sub edi, edx
and edi, 0Fh
xor edi, edx
sub edi, edx
test edi, edi
jne 00007FAFD86C5AAEh
mov ecx, dword ptr [ebp+10h]
mov edx, ecx
and edx, 7Fh
mov dword ptr [ebp-0Ch], edx
cmp ecx, edx
je 00007FAFD86C5A84h
sub ecx, edx
push ecx
push eax
call 00007FAFD86C59E8h
add esp, 08h
mov eax, dword ptr [ebp+08h]
mov edx, dword ptr [ebp-0Ch]
test edx, edx
je 00007FAFD86C5AB7h
add eax, dword ptr [ebp+10h]
sub eax, edx
mov dword ptr [ebp-08h], eax
xor eax, eax
mov edi, dword ptr [ebp-08h]
mov ecx, dword ptr [ebp-0Ch]
rep stosb
mov eax, dword ptr [ebp+08h]
jmp 00007FAFD86C5AA0h
neg edi
add edi, 10h
mov dword ptr [ebp-10h], edi
xor eax, eax
mov edi, dword ptr [ebp+08h]

Rich Headers

Programming Language:

[ASM] VS2005 build 50727
[ C ] VS2005 build 50727
[C++] VS2005 build 50727
[RES] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb02c	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe000	0x706c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2c0aff0	0x1e30
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xac80	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x180	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x70a4	0x8000	a8dbcac095aef6f1ff0f56e91c5abc15	False	0.552093505859375	data	6.153199000714585	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2882	0x3000	efb6029b9a5f70171975f6b5a16c78ce	False	0.318603515625	data	4.970546321524819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x1928	0x1000	cf8d7dd9f4b828868db85743b8601f51	False	0.21533203125	data	2.2322569522970026	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xe000	0x706c	0x8000	6e74cd70184e9f7f78b013f341f1745f	False	0.46356201171875	data	5.866520937272414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xe2b0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5675675675675675
RT_ICON	0xe3d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.4486994219653179
RT_ICON	0xe940	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.4637096774193548
RT_ICON	0xec28	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.3935018050541516
RT_ICON	0xf4d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7617328519855595
RT_ICON	0xfd78	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6437617260787992
RT_ICON	0x10e20	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.4097560975609756
RT_ICON	0x11488	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6391257995735607
RT_ICON	0x12330	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5276970954356847
RT_GROUP_ICON	0x148d8	0x3e	data	English	United States	0.8064516129032258
RT_VERSION	0x14918	0x2e0	data	English	United States	0.45652173913043476
RT_MANIFEST	0x14bf8	0x473	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4881474978050922

Imports

DLL	Import
KERNEL32.dll	SetUnhandledExceptionFilter, lstrcmpiA, lstrcpyA, lstrlenA, _lclose, GetModuleFileNameA, _lread, _llseek, _lopen, _lwrite, _lcreat, CreateDirectoryA, SetCurrentDirectoryA, lstrcatA, FreeLibrary, GetProcAddress, LoadLibraryA, GetDiskFreeSpaceA, UnhandledExceptionFilter, RemoveDirectoryA, DeleteFileA, GetTempPathA, GetCurrentDirectoryA, CloseHandle, GetExitCodeProcess, LocalFree, Sleep, HeapSize, RtlUnwind, LCMapStringW, LCMapStringA, GetStringTypeW, GetCurrentProcess, GetFileAttributesA, TerminateProcess, MultiByteToWideChar, GetStringTypeA, GetModuleHandleA, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, GetLastError, InterlockedDecrement, ExitProcess, HeapFree, HeapAlloc, GetCommandLineA, GetVersionExA, GetProcessHeap, GetStartupInfoA, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, WriteFile, GetStdHandle, InitializeCriticalSection, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, HeapReAlloc, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetLocaleInfoA
USER32.dll	TranslateMessage, DispatchMessageA, PeekMessageA, wsprintfA, LoadCursorA, SetCursor, MessageBoxA, MsgWaitForMultipleObjects
ADVAPI32.dll	GetTokenInformation, OpenProcessToken
SHELL32.dll	ShellExecuteExA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	03:45:34
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe"
Imagebase:	0x400000
File size:	46'190'112 bytes
MD5 hash:	4BF5EC6EA419625FD7FBC9D7DF84B5F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:45:35
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:666146 "__IRAFN:C:\Users\user\Desktop\PSI-CONF_Setup_v2.76.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2246122658-3693405117-2476756634-1003"
Imagebase:	0x400000
File size:	580'096 bytes
MD5 hash:	3FE7C92DBA5C9240B4AB0D6A87E6166A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:45:48
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\Phoenix Contact VCPInstaller.exe"
Imagebase:	0x400000
File size:	638'704 bytes
MD5 hash:	A6EA5C9B61F3DD92B3833AE2DD3FA72F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:46:04
Start date:	08/10/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{86984c43-8b67-194b-9c7f-ab018d349ed2}\slabvcp.inf" "9" "4f7b0f4b7" "0000000000000148" "WinSta0\Default" "0000000000000168" "208" "C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0"
Imagebase:	0x7ff684650000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:46:05
Start date:	08/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{c7f7ce19-85e2-2b4e-af72-83044df6dea6} Global\{7407c8d9-0d94-0b41-8543-eb54da946896} C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.inf C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.cat
Imagebase:	0x7ff6c2f30000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:46:49
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\icacls.exe" "C:\ProgramData\Phoenix Contact\PSIConfSoftware" /grant *S-1-1-0:(OI)M /T
Imagebase:	0xc90000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:46:49
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:46:52
Start date:	08/10/2024
Path:	C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe"
Imagebase:	0xe10000
File size:	5'014'064 bytes
MD5 hash:	8F6908A3C2F22EE306CC55D7CFA08320
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	03:47:00
Start date:	08/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rqco3gp6.cmdline"
Imagebase:	0x400000
File size:	91'256 bytes
MD5 hash:	953344403C93E6FBB8C573273D645242
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:47:00
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:47:00
Start date:	08/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF17E.tmp" "c:\Users\user\AppData\Local\Temp\CSCF17D.tmp"
Imagebase:	0x400000
File size:	41'648 bytes
MD5 hash:	3FDA06F8AA40293397F58A687EEABC1F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.1%
Total number of Nodes:	1205
Total number of Limit Nodes:	25

Executed Functions

Function 004018EE Relevance: 65.0, APIs: 30, Strings: 7, Instructions: 209
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,?,75920440), ref: 0040191F
_memset.LIBCMT ref: 0040192F
GetTempPathA.KERNEL32(00000104,?), ref: 0040193F
lstrlenA.KERNEL32(?), ref: 00401952
lstrcpyA.KERNEL32(?,?,?), ref: 0040196D
lstrlenA.KERNEL32(?), ref: 00401984
lstrcatA.KERNEL32(?,00409308), ref: 00401998
wsprintfA.USER32 ref: 004019C2
wsprintfA.USER32 ref: 004019D7
DeleteFileA.KERNELBASE(?), ref: 004019E9
wsprintfA.USER32 ref: 00401A11
wsprintfA.USER32 ref: 00401A26
DeleteFileA.KERNEL32(?), ref: 00401A32
RemoveDirectoryA.KERNELBASE(?), ref: 00401A3B
GetFileAttributesA.KERNELBASE(?), ref: 00401A44
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00401A5E
lstrcpyA.KERNEL32(?,?), ref: 00401A74
SetCurrentDirectoryA.KERNELBASE(?), ref: 00401A83
lstrcpyA.KERNEL32(?,c:\temp), ref: 00401A95
CreateDirectoryA.KERNEL32(?,00000000), ref: 00401AA0
SetCurrentDirectoryA.KERNEL32(?), ref: 00401AA9
lstrcpyA.KERNEL32(?,Could not determine a temp directory name. Try running setup.exe /T:<Path>), ref: 00401ABB
lstrlenA.KERNEL32(?), ref: 00401ACB
lstrcatA.KERNEL32(?,00409308), ref: 00401AE6
lstrcpyA.KERNEL32(?,?), ref: 00401AFA
lstrcpyA.KERNEL32(?,?), ref: 00401B0A

Part of subcall function 004017B7: lstrlenA.KERNEL32(?,75920440,?,?), ref: 004017E9
Part of subcall function 004017B7: lstrcatA.KERNEL32(?,00409308), ref: 004017F8
Part of subcall function 004017B7: lstrlenA.KERNEL32(?), ref: 004017FF
Part of subcall function 004017B7: _memset.LIBCMT ref: 0040180F
Part of subcall function 004017B7: SetCurrentDirectoryA.KERNEL32(?), ref: 00401848
Part of subcall function 004017B7: CreateDirectoryA.KERNEL32(?,00000000), ref: 00401857

lstrcatA.KERNEL32(?,irsetup.exe), ref: 00401B12
GetDiskFreeSpaceA.KERNELBASE(?,?,?,?,?), ref: 00401B4B
lstrcpyA.KERNEL32(?,You must have at least 2MB of free space on your TEMP drive!), ref: 00401B75
SetCurrentDirectoryA.KERNELBASE(?), ref: 00401B82

Strings

%s%s_%d, xrefs: 004019BC, 00401A0B
c:\temp, xrefs: 00401A89
You must have at least 2MB of free space on your TEMP drive!, xrefs: 00401B6C
Could not determine a temp directory name. Try running setup.exe /T:<Path>, xrefs: 00401AB2
_ir_sf_temp, xrefs: 004019AA, 004019FF
%s\irsetup.exe, xrefs: 004019D1, 00401A20
irsetup.exe, xrefs: 00401B0C

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: Directory$lstrcpy$Currentlstrlen$lstrcatwsprintf$CreateFile$Delete_memset$AttributesDiskFreePathRemoveSpaceTemp
String ID: %s%s_%d$%s\irsetup.exe$Could not determine a temp directory name. Try running setup.exe /T:<Path>$You must have at least 2MB of free space on your TEMP drive!$_ir_sf_temp$c:\temp$irsetup.exe
API String ID: 4152632170-333251792
Opcode ID: 52ab34114c42e72593321ba6722655e5f752b8a9c71bab590b9abc806fb5e6f7
Instruction ID: 7ee467252772e4fce426abee9f8e381d3827667745e30938ba367073bfe6d497
Opcode Fuzzy Hash: 52ab34114c42e72593321ba6722655e5f752b8a9c71bab590b9abc806fb5e6f7
Instruction Fuzzy Hash: FF81DD7290038DAADF21DFA4DD88FDE77BCAB09304F144426E949E7192D778AA04CB64

Function 0040121E Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 122
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 00401249
SetCursor.USER32(00000000), ref: 00401250

Part of subcall function 004013BC: _memset.LIBCMT ref: 004013F9

_memset.LIBCMT ref: 0040126F
lstrlenA.KERNEL32(?), ref: 0040127E
lstrcpyA.KERNEL32(?,?), ref: 00401292
_memset.LIBCMT ref: 004012A9
lstrcpyA.KERNEL32(?,022A1898), ref: 004012CC
lstrlenA.KERNEL32(0000002F), ref: 004012F4
lstrlenA.KERNEL32(0000002F), ref: 0040130E
lstrcmpiA.KERNEL32(0000002F,/~DBG), ref: 00401349
MessageBoxA.USER32(00000000,?,Launcher Error,00000010), ref: 00401398

Strings

/, xrefs: 004012CE
/~DBG, xrefs: 0040133D
Launcher Error, xrefs: 0040138A
:, xrefs: 00401315

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: _memsetlstrlen$Cursorlstrcpy$LoadMessagelstrcmpi
String ID: /$/~DBG$:$Launcher Error
API String ID: 1043042381-896055402
Opcode ID: 7f1eb6b9f832ab0e8fce55c887eeba31c9a19693f184cc65b8fc982c166cdcb2
Instruction ID: af9ad22e8f0fd6e2a19d1e49c982487640ebdbee9e650ff1973c0dea8342019b
Opcode Fuzzy Hash: 7f1eb6b9f832ab0e8fce55c887eeba31c9a19693f184cc65b8fc982c166cdcb2
Instruction Fuzzy Hash: 4B418F71D0021C9AEB20DBA4DD85BEE73BCAB44708F4000B7E509F61A2D7789E898F5D

Function 00401BA3 Relevance: 70.3, APIs: 34, Strings: 6, Instructions: 267
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00401BCF
_memset.LIBCMT ref: 00401BE8
_memset.LIBCMT ref: 00401BF4
wsprintfA.USER32 ref: 00401C2F
lstrlenA.KERNEL32(?), ref: 00401C3F
lstrcatA.KERNEL32(?,00409458), ref: 00401C5B
lstrcatA.KERNEL32(?,?), ref: 00401C68
wsprintfA.USER32 ref: 00401C7A
lstrcatA.KERNEL32(?,00409458), ref: 00401C8F
lstrcatA.KERNEL32(?,?), ref: 00401C9C
wsprintfA.USER32 ref: 00401CAF
lstrcatA.KERNEL32(?,00409458), ref: 00401CC4
lstrcatA.KERNEL32(?,?), ref: 00401CD1
wsprintfA.USER32 ref: 00401CE8
lstrcatA.KERNEL32(?,00409458), ref: 00401CFD
lstrcatA.KERNEL32(?,?), ref: 00401D0A
GetCurrentProcess.KERNEL32(00000008,?), ref: 00401D15
OpenProcessToken.ADVAPI32(00000000), ref: 00401D1C
_malloc.LIBCMT ref: 00401D32
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00004000,?), ref: 00401D4E
wsprintfA.USER32 ref: 00401D80
lstrcatA.KERNEL32(?,00409458), ref: 00401D95
lstrcatA.KERNEL32(?,?), ref: 00401DA2
LocalFree.KERNEL32(?), ref: 00401DA7

Part of subcall function 00402C8F: __lock.LIBCMT ref: 00402CAD
Part of subcall function 00402C8F: ___sbh_find_block.LIBCMT ref: 00402CB8
Part of subcall function 00402C8F: ___sbh_free_block.LIBCMT ref: 00402CC7
Part of subcall function 00402C8F: RtlFreeHeap.NTDLL(00000000,?,0040ADE8,0000000C,0040335F,00000000,0040AE50,0000000C,00403397,?,?,?,00406D9C,00000004,0040AFD0,0000000C), ref: 00402CF7
Part of subcall function 00402C8F: GetLastError.KERNEL32(?,00406D9C,00000004,0040AFD0,0000000C,00404199,?,?,00000000,00000000,00000000,0040229A,00000001,00000214,?,00000000), ref: 00402D08

MessageBoxA.USER32(00000000,?,?,00000000), ref: 00401DCE
_memset.LIBCMT ref: 00401DDD
ShellExecuteExA.SHELL32(?), ref: 00401E1B
lstrcpyA.KERNEL32(?,Could not start the setup), ref: 00401E2E
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00401E75
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00401E8C
GetExitCodeProcess.KERNELBASE(?,?), ref: 00401EA0
CloseHandle.KERNEL32(?), ref: 00401ECA

Strings

__IRAOFF:%u, xrefs: 00401C19
"__IRSID:%s", xrefs: 00401D7A
"__IRCT:%d", xrefs: 00401CA9
"__IRAFN:%s", xrefs: 00401C74
Could not start the setup, xrefs: 00401E25
"__IRTSS:%I64u", xrefs: 00401CE2

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: lstrcat$wsprintf$_memset$Process$FreeMessageToken$CloseCodeCurrentErrorExecuteExitHandleHeapInformationLastLocalMultipleObjectsOpenPeekShellWait___sbh_find_block___sbh_free_block__lock_malloclstrcpylstrlen
String ID: "__IRAFN:%s"$"__IRCT:%d"$"__IRSID:%s"$"__IRTSS:%I64u"$Could not start the setup$__IRAOFF:%u
API String ID: 716674260-3408225167
Opcode ID: 28e997bb70f979d8fe9d69c729d23037c894241dd42b308b55ecd7cdfd490c13
Instruction ID: aa0902048d2b7b52aa85146c659582acf9f7539b45191ba8499a1d8f1e2e922b
Opcode Fuzzy Hash: 28e997bb70f979d8fe9d69c729d23037c894241dd42b308b55ecd7cdfd490c13
Instruction Fuzzy Hash: 96A100B1900208ABDB60EFA4DC89EDB77BCFF48304F40453AFA56E2151DB74A984CB54

Function 00401452 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 184
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lopen.KERNEL32(?,00000000), ref: 00401472
lstrcpyA.KERNEL32(?,Unable to open archive file,?,75920440,00000000,759183C0,00401375), ref: 0040148C
_malloc.LIBCMT ref: 004014A8
lstrcpyA.KERNEL32(?,Unable to allocate memory buffer,?,75920440,00000000,759183C0,00401375), ref: 004014BD

Strings

Could not find total size indicator, xrefs: 00401672
Could not find setup size, xrefs: 004016B1
Unable to allocate memory buffer, xrefs: 004014B4
Could not find compression type indicator, xrefs: 0040162A
Could not find data segment, xrefs: 004015C6
5, xrefs: 004016C0
Unable to open archive file, xrefs: 00401483
Could not find multi-segment indicator, xrefs: 004015BF

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: lstrcpy$_lopen_malloc
String ID: 5$Could not find compression type indicator$Could not find data segment$Could not find multi-segment indicator$Could not find setup size$Could not find total size indicator$Unable to allocate memory buffer$Unable to open archive file
API String ID: 1438438538-2242580901
Opcode ID: 8c92a70ff43eb0f97c881b711984fb85ec55dfca465713ff5efc1291b8a7b7b1
Instruction ID: 7300d7d6e7a32505a693ad9f3eda89eafd1498ff86265379e2744ccfb6f5fc4e
Opcode Fuzzy Hash: 8c92a70ff43eb0f97c881b711984fb85ec55dfca465713ff5efc1291b8a7b7b1
Instruction Fuzzy Hash: 547117718087457BD7308F30AC88ADABAA4AF56328F14473EF4B6651F2C33599458B5D

Function 004016EA Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 67
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 004016F8

Part of subcall function 00402D6C: __FF_MSGBANNER.LIBCMT ref: 00402D8F
Part of subcall function 00402D6C: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00404153,?,00000001,?,00403308,00000018,0040AE50,0000000C,00403397,?), ref: 00402DE4

_llseek.KERNEL32(?,?,00000000), ref: 0040170F
_lread.KERNEL32(?,00000000,?,?,75920440,00401F15,00000000,759183C0,00401375), ref: 0040171E
_lcreat.KERNEL32(?,?), ref: 0040173E
lstrcpyA.KERNEL32(?,Unable to open setup file,?,75920440,00401F15,00000000,759183C0,00401375), ref: 00401758
_lwrite.KERNEL32(?,00000000,?,?,75920440,00401F15,00000000,759183C0,00401375), ref: 0040177D
lstrcpyA.KERNEL32(?,Failed to read setup engine,?,75920440,00401F15,00000000,759183C0,00401375), ref: 0040178E
_lclose.KERNEL32(?), ref: 004017AA

Strings

Failed to read setup engine, xrefs: 00401785
Unable to open setup file, xrefs: 0040174F

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: lstrcpy$AllocateHeap_lclose_lcreat_llseek_lread_lwrite_malloc
String ID: Failed to read setup engine$Unable to open setup file
API String ID: 3533767989-2055280143
Opcode ID: e8fadbd7915df802766694df4b9f288f51ac6d4b6114333f0a32ab429962f799
Instruction ID: 98d722e2cf2e9e3f73f88c99db517cb2a37de40e3dc5406cf78bd9bc834089c4
Opcode Fuzzy Hash: e8fadbd7915df802766694df4b9f288f51ac6d4b6114333f0a32ab429962f799
Instruction Fuzzy Hash: 7621AF32000601ABCB216B70DD889D7BBA8EF08364B500A2AF266E70F1C779AD409B24

Function 00402C8F Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 00402CAD

Part of subcall function 0040337E: __mtinitlocknum.LIBCMT ref: 00403392
Part of subcall function 0040337E: __amsg_exit.LIBCMT ref: 0040339E
Part of subcall function 0040337E: EnterCriticalSection.KERNEL32(?,?,?,00406D9C,00000004,0040AFD0,0000000C,00404199,?,?,00000000,00000000,00000000,0040229A,00000001,00000214), ref: 004033A6

___sbh_find_block.LIBCMT ref: 00402CB8
___sbh_free_block.LIBCMT ref: 00402CC7
RtlFreeHeap.NTDLL(00000000,?,0040ADE8,0000000C,0040335F,00000000,0040AE50,0000000C,00403397,?,?,?,00406D9C,00000004,0040AFD0,0000000C), ref: 00402CF7
GetLastError.KERNEL32(?,00406D9C,00000004,0040AFD0,0000000C,00404199,?,?,00000000,00000000,00000000,0040229A,00000001,00000214,?,00000000), ref: 00402D08

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 49706f57f542d74d252cfb4f516af0fc823adc1de5063f78ca8113db7a66416e
Instruction ID: 7d2fc9dee805cc0d0c3b7d2ccac31c4a430e9b4ac6d80d62b1cc486380451822
Opcode Fuzzy Hash: 49706f57f542d74d252cfb4f516af0fc823adc1de5063f78ca8113db7a66416e
Instruction Fuzzy Hash: DA014FB1905316AAEF207BB2AE0AB5E7A64AF40769F20003FF514B61D1CB7C8D40DA5D

Function 00401EEB Relevance: 4.5, APIs: 3, Instructions: 36
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040143D: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00401EF4,00000000,759183C0,00401375), ref: 0040144B

Part of subcall function 00401452: _lopen.KERNEL32(?,00000000), ref: 00401472
Part of subcall function 00401452: lstrcpyA.KERNEL32(?,Unable to open archive file,?,75920440,00000000,759183C0,00401375), ref: 0040148C

Sleep.KERNELBASE(0000000A,00000000,759183C0,00401375), ref: 00401F2F
DeleteFileA.KERNELBASE(?), ref: 00401F3C
RemoveDirectoryA.KERNELBASE(?), ref: 00401F49

Part of subcall function 004018EE: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,?,75920440), ref: 0040191F
Part of subcall function 004018EE: _memset.LIBCMT ref: 0040192F
Part of subcall function 004018EE: GetTempPathA.KERNEL32(00000104,?), ref: 0040193F
Part of subcall function 004018EE: lstrlenA.KERNEL32(?), ref: 00401952
Part of subcall function 004018EE: lstrcpyA.KERNEL32(?,?,?), ref: 0040196D
Part of subcall function 004018EE: lstrlenA.KERNEL32(?), ref: 00401984
Part of subcall function 004018EE: lstrcatA.KERNEL32(?,00409308), ref: 00401998
Part of subcall function 004018EE: wsprintfA.USER32 ref: 004019C2
Part of subcall function 004018EE: wsprintfA.USER32 ref: 004019D7
Part of subcall function 004018EE: DeleteFileA.KERNELBASE(?), ref: 004019E9
Part of subcall function 004018EE: RemoveDirectoryA.KERNELBASE(?), ref: 00401A3B
Part of subcall function 004018EE: GetFileAttributesA.KERNELBASE(?), ref: 00401A44
Part of subcall function 004018EE: CreateDirectoryA.KERNELBASE(?,00000000), ref: 00401A5E
Part of subcall function 004018EE: lstrcpyA.KERNEL32(?,?), ref: 00401A74
Part of subcall function 004018EE: SetCurrentDirectoryA.KERNELBASE(?), ref: 00401A83

Part of subcall function 004016EA: _malloc.LIBCMT ref: 004016F8
Part of subcall function 004016EA: _llseek.KERNEL32(?,?,00000000), ref: 0040170F
Part of subcall function 004016EA: _lread.KERNEL32(?,00000000,?,?,75920440,00401F15,00000000,759183C0,00401375), ref: 0040171E
Part of subcall function 004016EA: _lcreat.KERNEL32(?,?), ref: 0040173E
Part of subcall function 004016EA: lstrcpyA.KERNEL32(?,Unable to open setup file,?,75920440,00401F15,00000000,759183C0,00401375), ref: 00401758
Part of subcall function 004016EA: _lclose.KERNEL32(?), ref: 004017AA

Part of subcall function 00401BA3: _memset.LIBCMT ref: 00401BCF
Part of subcall function 00401BA3: _memset.LIBCMT ref: 00401BE8
Part of subcall function 00401BA3: _memset.LIBCMT ref: 00401BF4
Part of subcall function 00401BA3: wsprintfA.USER32 ref: 00401C2F
Part of subcall function 00401BA3: lstrlenA.KERNEL32(?), ref: 00401C3F
Part of subcall function 00401BA3: lstrcatA.KERNEL32(?,00409458), ref: 00401C5B
Part of subcall function 00401BA3: lstrcatA.KERNEL32(?,?), ref: 00401C68
Part of subcall function 00401BA3: wsprintfA.USER32 ref: 00401C7A
Part of subcall function 00401BA3: lstrcatA.KERNEL32(?,00409458), ref: 00401C8F
Part of subcall function 00401BA3: lstrcatA.KERNEL32(?,?), ref: 00401C9C
Part of subcall function 00401BA3: wsprintfA.USER32 ref: 00401CAF
Part of subcall function 00401BA3: lstrcatA.KERNEL32(?,00409458), ref: 00401CC4
Part of subcall function 00401BA3: lstrcatA.KERNEL32(?,?), ref: 00401CD1

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: lstrcat$Directorywsprintf$File_memsetlstrcpy$lstrlen$CurrentDeleteRemove$AttributesCreateModuleNamePathSleepTemp_lclose_lcreat_llseek_lopen_lread_malloc
String ID:
API String ID: 3101018502-0
Opcode ID: 6ccb0b9a1d72448c07e38ae53780d4fb2866121d80ec7e6f7217f3fb0edf051e
Instruction ID: e9d618fd97bb62092fd479b9b0d9f40fc3511f9c17ed85674704d9f468149a83
Opcode Fuzzy Hash: 6ccb0b9a1d72448c07e38ae53780d4fb2866121d80ec7e6f7217f3fb0edf051e
Instruction Fuzzy Hash: DCF05E32B00A2247CB227375691469E31D69FC0765B15003AF40AB73F2DF7CCD06825D

Function 00404CC3 Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00402F6F,00000001), ref: 00404CD4
HeapDestroy.KERNEL32 ref: 00404D0A

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 59c01f4b7a3e7019d8f7dc6aeec6646361a3b3f5550ff4f03ea1306fca09b57d
Instruction ID: f32a66523d8694f230aef37354e1539df247044dc467fdaf4b082e050822a60e
Opcode Fuzzy Hash: 59c01f4b7a3e7019d8f7dc6aeec6646361a3b3f5550ff4f03ea1306fca09b57d
Instruction Fuzzy Hash: 37E065F5A59302BEFB006B719E0A7263594ABC434EF114436F911F50F6E7788944950C

Function 004025EF Relevance: 3.0, APIs: 2, Instructions: 5
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 004025F3

Part of subcall function 004025C9: GetModuleHandleA.KERNEL32(mscoree.dll,004025F8,?,00402DA5,000000FF,0000001E,00000001,00000000,00000000,?,00404153,?,00000001,?,00403308,00000018), ref: 004025CE
Part of subcall function 004025C9: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004025DE

ExitProcess.KERNEL32 ref: 004025FD

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 1bee4b969ba1474def3b638f624b2c93dc57e376f66ecdd88fd8b614d97ff1e7
Instruction ID: 7211bad87e024f92fa48da503e41711f3ca2c2cf7d5156ec95ab98e0d508d858
Opcode Fuzzy Hash: 1bee4b969ba1474def3b638f624b2c93dc57e376f66ecdd88fd8b614d97ff1e7
Instruction Fuzzy Hash: 31B00271025100BFD7052B11EF1F45D7BA1EF40715F10843DF449550B69B755D54BA1D

Non-executed Functions

Function 00407054 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,0040D248,0040437B,0040D248,Microsoft Visual C++ Runtime Library,00012010), ref: 00407081
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0040709D

Part of subcall function 00402055: TlsGetValue.KERNEL32(00000000,004020CA,00000000,00407062,00000000,00000000,00000314,?,?,?,0040D248,0040437B,0040D248,Microsoft Visual C++ Runtime Library,00012010), ref: 00402062
Part of subcall function 00402055: TlsGetValue.KERNEL32(00000005,?,?,?,0040D248,0040437B,0040D248,Microsoft Visual C++ Runtime Library,00012010), ref: 00402079

GetProcAddress.KERNEL32(00000000,00000000), ref: 004070BA

Part of subcall function 00402055: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040D248,0040437B,0040D248,Microsoft Visual C++ Runtime Library,00012010), ref: 0040208E
Part of subcall function 00402055: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004020A9

GetProcAddress.KERNEL32(00000000,00000000), ref: 004070CF
__invoke_watson.LIBCMT ref: 004070F0

Part of subcall function 0040110A: _memset.LIBCMT ref: 00401196
Part of subcall function 0040110A: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 004011B6
Part of subcall function 0040110A: UnhandledExceptionFilter.KERNEL32(0040D248,?,?,00000000), ref: 004011C0
Part of subcall function 0040110A: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 004011D7
Part of subcall function 0040110A: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 004011DE

Part of subcall function 004020CC: TlsGetValue.KERNEL32(?,00401208), ref: 004020D9
Part of subcall function 004020CC: TlsGetValue.KERNEL32(00000005,?,00401208), ref: 004020F0

Part of subcall function 004020CC: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,00401208), ref: 00402105
Part of subcall function 004020CC: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00402120

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00407104
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0040711C
__invoke_watson.LIBCMT ref: 0040718F

Strings

GetProcessWindowStation, xrefs: 00407116
GetUserObjectInformationA, xrefs: 004070FE
MessageBoxA, xrefs: 00407097
USER32.DLL, xrefs: 0040707C

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentLibraryLoadTerminate_memset
String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 3396755237-1046234306
Opcode ID: 6a18eec6546d92412c9f98295517e1e6d1579552f68d361eb3c8cf7528923419
Instruction ID: ce2cefe5615c95b8383c3f586db4b7863539cc502fa75a73a3859a43c6db0160
Opcode Fuzzy Hash: 6a18eec6546d92412c9f98295517e1e6d1579552f68d361eb3c8cf7528923419
Instruction Fuzzy Hash: 8B41B471D04305AADF10AFE19D8996F7BB8BF04314B20493FE504F32D1EA7DA945CA6A

Function 00405859 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000581C), ref: 0040585E

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 56729f26e9dfaf2f4b0d66d233e4d27a17b1f86d1ab2ab0bbb1d4650813ebe0e
Instruction ID: 3e1057395b3686ae12769642d912d59d9c22ab0711a284310f30ec097f5c95cc
Opcode Fuzzy Hash: 56729f26e9dfaf2f4b0d66d233e4d27a17b1f86d1ab2ab0bbb1d4650813ebe0e
Instruction Fuzzy Hash: 8E9002712A151096DE0037705D0950A6694DAC8706B51C971A441E4095DA7448105A2D

Function 00404219 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcpy_s.LIBCMT ref: 00404285
__invoke_watson.LIBCMT ref: 00404296
GetModuleFileNameA.KERNEL32(00000000,0040D261,00000104), ref: 004042B2
_strcpy_s.LIBCMT ref: 004042C7
__invoke_watson.LIBCMT ref: 004042DA
_strlen.LIBCMT ref: 004042E3
_strlen.LIBCMT ref: 004042F0
__invoke_watson.LIBCMT ref: 0040431D
_strcat_s.LIBCMT ref: 00404330
__invoke_watson.LIBCMT ref: 00404341
_strcat_s.LIBCMT ref: 00404352
__invoke_watson.LIBCMT ref: 00404363
GetStdHandle.KERNEL32(000000F4,?,?,00000000,76EC5E70,00000003,004043E5,000000FC,00402D94,00000001,00000000,00000000,?,00404153,?,00000001), ref: 00404382
_strlen.LIBCMT ref: 004043A3
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,00404153,?,00000001,?,00403308,00000018,0040AE50,0000000C,00403397,?), ref: 004043AD

Strings

Microsoft Visual C++ Runtime Library, xrefs: 00404370
Runtime Error!Program: , xrefs: 00404274
<program name unknown>, xrefs: 004042BC
..., xrefs: 00404301

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: e313403f5cd4c7c12ccf96ccea6d998a04fa90ebcf576f92725f50e3c967b6b2
Instruction ID: 977ff267fa19d8c895206bab4d7de96ed0edba8d8b4cbcb6b4e6d17ff6308ad8
Opcode Fuzzy Hash: e313403f5cd4c7c12ccf96ccea6d998a04fa90ebcf576f92725f50e3c967b6b2
Instruction Fuzzy Hash: B03113F2B0022176E61532626D46F2B324C9B95365F15063BFF06B12D3EA7D9D1180FE

Function 00402421 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 00402427
__mtterm.LIBCMT ref: 00402433

Part of subcall function 00402175: TlsFree.KERNEL32(0000000C), ref: 004021A0
Part of subcall function 00402175: DeleteCriticalSection.KERNEL32 ref: 0040326C
Part of subcall function 00402175: DeleteCriticalSection.KERNEL32(0000000C), ref: 00403296

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00402449
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00402456
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00402463
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00402470
TlsAlloc.KERNEL32 ref: 004024C0
TlsSetValue.KERNEL32(00000000), ref: 004024DB
__init_pointers.LIBCMT ref: 004024E5
__calloc_crt.LIBCMT ref: 0040255A
GetCurrentThreadId.KERNEL32 ref: 0040258A

Strings

KERNEL32.DLL, xrefs: 00402422
FlsSetValue, xrefs: 00402458
FlsFree, xrefs: 00402465
FlsGetValue, xrefs: 0040244B
FlsAlloc, xrefs: 00402443

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2125014093-3819984048
Opcode ID: b149d0bc26f7e5aa45678ebf3d276f0937998fa3ad2a4f5c5102d3025af6004f
Instruction ID: daffe14449f0f88678bb7b28e53ab8a37a68e728b62302c3b78876929663af9d
Opcode Fuzzy Hash: b149d0bc26f7e5aa45678ebf3d276f0937998fa3ad2a4f5c5102d3025af6004f
Instruction Fuzzy Hash: 21312171D01311AAD7207BB5AF0DB0B3BA5AB45358F10453BE918B62F2DBBD844ACA5C

Function 004021B2 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,0040AD80,0000000C,004022C3,00000000,00000000,?,00000000,00404432,00402695,00000001,00402004,?,00000000), ref: 004021C3
GetProcAddress.KERNEL32(?,EncodePointer), ref: 004021F7
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00402207
InterlockedIncrement.KERNEL32(0040C278), ref: 00402229
__lock.LIBCMT ref: 00402231
___addlocaleref.LIBCMT ref: 00402250

Strings

KERNEL32.DLL, xrefs: 004021BE
DecodePointer, xrefs: 004021FF
EncodePointer, xrefs: 004021E9

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1036688887-2843748187
Opcode ID: aaa3b2c6f24ec4ee76c49171f0f35386b2ae32e66a0e46cdeca44f6b3c680345
Instruction ID: d0587f2364e44903440a524c616f496cc770f54ebd71e1471e6da810d90187c4
Opcode Fuzzy Hash: aaa3b2c6f24ec4ee76c49171f0f35386b2ae32e66a0e46cdeca44f6b3c680345
Instruction Fuzzy Hash: 87118270944701DED7209FB6C945B5ABBE0AF01308F10457FE895B22E1CBB89904CF19

Function 00403A63 Relevance: 10.7, APIs: 7, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

getSystemCP.LIBCMT ref: 00403A7C

Part of subcall function 004039E9: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004039F6
Part of subcall function 004039E9: GetOEMCP.KERNEL32(00000000), ref: 00403A10

setSBCS.LIBCMT ref: 00403A8E

Part of subcall function 004036E4: _memset.LIBCMT ref: 004036F7

IsValidCodePage.KERNEL32(-00000030), ref: 00403AD4
GetCPInfo.KERNEL32(00000000,?), ref: 00403AE7
_memset.LIBCMT ref: 00403AFF
setSBUpLow.LIBCMT ref: 00403BD2

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: Locale_memset$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 2658552758-0
Opcode ID: 3ffe76e785ed77b18db2bdf9be9635eaba7de748bb2b0e6cefc5dea95088c0fa
Instruction ID: 14d67e305c93cdf9398b593b339ab62396b24285d851fb5fe56fe401640062bc
Opcode Fuzzy Hash: 3ffe76e785ed77b18db2bdf9be9635eaba7de748bb2b0e6cefc5dea95088c0fa
Instruction Fuzzy Hash: 2B5105719041159BDB259F65C4802BABFB8EF0530AF14847BE881BF2C2D63CDA42CB98

Function 00402055 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,004020CA,00000000,00407062,00000000,00000000,00000314,?,?,?,0040D248,0040437B,0040D248,Microsoft Visual C++ Runtime Library,00012010), ref: 00402062
TlsGetValue.KERNEL32(00000005,?,?,?,0040D248,0040437B,0040D248,Microsoft Visual C++ Runtime Library,00012010), ref: 00402079
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040D248,0040437B,0040D248,Microsoft Visual C++ Runtime Library,00012010), ref: 0040208E
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004020A9

Strings

KERNEL32.DLL, xrefs: 00402089
EncodePointer, xrefs: 004020A3

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: 7ec080f326d090608d46b92d47248ea3b7ad5c1441d97def4e00f978b1a90d0a
Instruction ID: ffbbc83f1853e406a29b48b9d582fc77ef0920d902b131d7812985dd971395a5
Opcode Fuzzy Hash: 7ec080f326d090608d46b92d47248ea3b7ad5c1441d97def4e00f978b1a90d0a
Instruction Fuzzy Hash: 2CF01D30505317EBC6216BA5EE48A6B7AE8AF40794B050132FD54F62F1DB79CC41CA9D

Function 004020CC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00401208), ref: 004020D9
TlsGetValue.KERNEL32(00000005,?,00401208), ref: 004020F0
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,00401208), ref: 00402105
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00402120

Strings

KERNEL32.DLL, xrefs: 00402100
DecodePointer, xrefs: 0040211A

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 725bea492127d59e7c3fd5809f38717d0bfffe9b4b5170df66e4e858725c1e3f
Instruction ID: 56c1ddf543700fe10ac4dee3adc8000d05a1e584936647a2bd76269d12e1d929
Opcode Fuzzy Hash: 725bea492127d59e7c3fd5809f38717d0bfffe9b4b5170df66e4e858725c1e3f
Instruction Fuzzy Hash: 54F09030502222EBC6119B64DF88B6B3BE8AF44394B040132F904FA2F1CBB8CC01CA9D

Function 004017B7 Relevance: 9.1, APIs: 6, Instructions: 71stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,75920440,?,?), ref: 004017E9
lstrcatA.KERNEL32(?,00409308), ref: 004017F8
lstrlenA.KERNEL32(?), ref: 004017FF
_memset.LIBCMT ref: 0040180F
SetCurrentDirectoryA.KERNEL32(?), ref: 00401848
CreateDirectoryA.KERNEL32(?,00000000), ref: 00401857

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: Directorylstrlen$CreateCurrent_memsetlstrcat
String ID:
API String ID: 4016166197-0
Opcode ID: 0c75975f7d50d9473b92610d386600e1da2694d2e0535a7eb80da118098f3b07
Instruction ID: 1c67e3f6a5459467edd5a1936336ff716f86b8838d0957f50aaa8f6567bd4043
Opcode Fuzzy Hash: 0c75975f7d50d9473b92610d386600e1da2694d2e0535a7eb80da118098f3b07
Instruction Fuzzy Hash: 8A2195739002489AEB31ABB9DC84BDF77B8AB45308F04843BE945F3291DB785A44CB59

Function 00401887 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Advapi32.dll,75918A60,?,00401D6B,?,?), ref: 00401890
GetProcAddress.KERNEL32(00000000,ConvertSidToStringSidA), ref: 004018AE
FreeLibrary.KERNEL32(00000000), ref: 004018C5

Strings

ConvertSidToStringSidA, xrefs: 004018A8
Advapi32.dll, xrefs: 00401889

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Advapi32.dll$ConvertSidToStringSidA
API String ID: 145871493-1798845326
Opcode ID: 06fdf7c426b03b24797886b3274236657ab8838fe9916d75fc19934d7435dbd3
Instruction ID: 3ebdeb85d67ae8d120c0745b8998576b3faa581b84c926dd3c5b0bc40dcaae0d
Opcode Fuzzy Hash: 06fdf7c426b03b24797886b3274236657ab8838fe9916d75fc19934d7435dbd3
Instruction Fuzzy Hash: 3CE09232500A60ABC7227B199D088AFBBE1ABC47517188937F854B12F2D73D4D49CA9A

Function 004038C3 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004022E8: __amsg_exit.LIBCMT ref: 004022F6

__amsg_exit.LIBCMT ref: 004038EF
__lock.LIBCMT ref: 004038FF
InterlockedDecrement.KERNEL32(?), ref: 0040391C
InterlockedIncrement.KERNEL32(022A1670), ref: 00403947

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID:
API String ID: 4129207761-0
Opcode ID: 3f8fdae395bff3663a3760a3b2549a4b28814342492777b7171da30863d1910c
Instruction ID: 208bc24039d85214fe1ecbb8c4c0cac9ce0d32ea323b509791149ff8454b9e0b
Opcode Fuzzy Hash: 3f8fdae395bff3663a3760a3b2549a4b28814342492777b7171da30863d1910c
Instruction Fuzzy Hash: EC01CE72D00612EBDB20AF56994A75E7AA8AF05716F00417BF800732E1C77C6A40DBCD

Function 00402271 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00404432,00402695,00000001,00402004,?,00000000,?,?,?,?,00402116,?,00401208), ref: 00402273

Part of subcall function 00402143: TlsGetValue.KERNEL32(00000000,00402286,?,00000000,00404432,00402695,00000001,00402004,?,00000000,?,?,?,?,00402116), ref: 0040214A
Part of subcall function 00402143: TlsSetValue.KERNEL32(00000000,00000000,00404432,00402695,00000001,00402004,?,00000000,?,?,?,?,00402116,?,00401208), ref: 0040216B

__calloc_crt.LIBCMT ref: 00402295

Part of subcall function 00404186: __calloc_impl.LIBCMT ref: 00404194
Part of subcall function 00404186: Sleep.KERNEL32(00000000), ref: 004041AB

Part of subcall function 004020CC: TlsGetValue.KERNEL32(?,00401208), ref: 004020D9
Part of subcall function 004020CC: TlsGetValue.KERNEL32(00000005,?,00401208), ref: 004020F0

Part of subcall function 004021B2: GetModuleHandleA.KERNEL32(KERNEL32.DLL,0040AD80,0000000C,004022C3,00000000,00000000,?,00000000,00404432,00402695,00000001,00402004,?,00000000), ref: 004021C3
Part of subcall function 004021B2: GetProcAddress.KERNEL32(?,EncodePointer), ref: 004021F7
Part of subcall function 004021B2: GetProcAddress.KERNEL32(?,DecodePointer), ref: 00402207
Part of subcall function 004021B2: InterlockedIncrement.KERNEL32(0040C278), ref: 00402229
Part of subcall function 004021B2: __lock.LIBCMT ref: 00402231
Part of subcall function 004021B2: ___addlocaleref.LIBCMT ref: 00402250

GetCurrentThreadId.KERNEL32 ref: 004022C5
SetLastError.KERNEL32(00000000,?,00000000,00404432,00402695,00000001,00402004,?,00000000,?,?,?,?,00402116,?,00401208), ref: 004022DD

Memory Dump Source

Source File: 00000000.00000002.2849233828.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2849159916.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849276953.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849331360.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849394316.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PSI-CONF_Setup_v2.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: ba585214f8e0f72c07d182b64f8fe7b6f4e85e45979b613268fba1265f33dd44
Instruction ID: bad2434c9c7fcaf8e87f4fd2bf63058e4f25f04e2a6678e341f538f10bb34439
Opcode Fuzzy Hash: ba585214f8e0f72c07d182b64f8fe7b6f4e85e45979b613268fba1265f33dd44
Instruction Fuzzy Hash: 99F0C8325026229BD63137B56E0D65B3A659F007B5B10017FF944B61E2CF78C841C6DD

Analysis Process: PSI-CONF.exePID: 4432, Parent PID: 6524COMMON

Executed Functions

Function 00007FF848F6F35C Relevance: 1.4, Instructions: 1446COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f16d198ed0c4d5c9cf8ac194016e304401cbe368f85693c3274d615fcb0f5a19
Instruction ID: f5ab776c9f58f80b1661fdb513bc93b3e59eaa250e1ac99dd05e618a19479bb5
Opcode Fuzzy Hash: f16d198ed0c4d5c9cf8ac194016e304401cbe368f85693c3274d615fcb0f5a19
Instruction Fuzzy Hash: 37B25D30609A889FEBA5EF28C494BE977E2FF9A301F5440A9D44DCB297CF34A945C741

Function 00007FF848F6D6E9 Relevance: 1.1, Instructions: 1113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3798eea126fe095d2f2c8dc278a2a190ae620fc3cff0ae4f2d22896f507f7278
Instruction ID: b2fb7cd767b767decf380516bf2e74966dacaca3f2fed7fadd754eef9cd0f76b
Opcode Fuzzy Hash: 3798eea126fe095d2f2c8dc278a2a190ae620fc3cff0ae4f2d22896f507f7278
Instruction Fuzzy Hash: 4B72AF30B1DE4A5FEB89BB2C94997687BD1EF5A341F4400B9E44EC72D3DE28AC428745

Function 00007FF848F72FBD Relevance: .8, Instructions: 824COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b4b5c05def3ec8f20bb1d6acf584172a09dfa1d7d8ada1751bc4c5984017806
Instruction ID: b670108047d25f8a03adb598e25e5d2465667ec1c555ea44492786c3211d3507
Opcode Fuzzy Hash: 7b4b5c05def3ec8f20bb1d6acf584172a09dfa1d7d8ada1751bc4c5984017806
Instruction Fuzzy Hash: 91624E30609A889FEBA5EB28C895BE937E2FF99301F5444B9D44DCB297CF34A945C701

Function 00007FF848F73B3E Relevance: .7, Instructions: 708COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d247cb792a35a8eef66a34b240a53ab8978e23cdaff6dc8c9e50a2283798782
Instruction ID: 6eb983481bb4ce0a9dc1ad7a0fc4e2e9e332bc23923d5147d3ee65895a71213c
Opcode Fuzzy Hash: 6d247cb792a35a8eef66a34b240a53ab8978e23cdaff6dc8c9e50a2283798782
Instruction Fuzzy Hash: D5325D30609E489FEB95EB288499BAA77E2FFAD301F4445BDD04EC7297CF34A8458741

Function 00007FF848F62825 Relevance: .6, Instructions: 622COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3afdb540683f56c59677c80795ea081f1f07dcf593ad1d4bfb3f85c2e635d92
Instruction ID: 1289c9daecb18250af52d5f0821d56f4ed134260aa38e5ed73fad1be8ae81322
Opcode Fuzzy Hash: d3afdb540683f56c59677c80795ea081f1f07dcf593ad1d4bfb3f85c2e635d92
Instruction Fuzzy Hash: 9312A270A0CA498FEB95EF2888587B97BE1FF69340F5401BAD44ECB292DF3498428755

Function 00007FF848F62953 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2c5f994990fc242057ddcaab99063228bdc33889d1fc1c0d8c8e5a06270a2b4
Instruction ID: 9e478357dae350fde85b27f2d8d765cb7af79897998b4d9d007f22fde889b9a8
Opcode Fuzzy Hash: f2c5f994990fc242057ddcaab99063228bdc33889d1fc1c0d8c8e5a06270a2b4
Instruction Fuzzy Hash: B1D1B17071CA498FEB95EF2884947697BE1FF69380F5401BAD44ECB292DF38D8428745

Function 00007FF848F6ACD3 Relevance: 4.0, Strings: 2, Instructions: 1494COMMON

Download Yara Rule

Strings

9, xrefs: 00007FF848F6BB87
(, xrefs: 00007FF848F6BB0F

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID: ($9
API String ID: 0-1743955940
Opcode ID: baf84732d2ed561922d63ae7ac2b57e8e3f50824c57f5c4a3d33f793304061ab
Instruction ID: 8f39f89c7be30d532e250b17d9554afd0b2d4d494638e40102f81145db254c29
Opcode Fuzzy Hash: baf84732d2ed561922d63ae7ac2b57e8e3f50824c57f5c4a3d33f793304061ab
Instruction Fuzzy Hash: B8C2426071DF885FEB86EB28C491BA97BE2EF5A340F5404A9E04DCB297CE24AC458751

Function 00007FF848F68E01 Relevance: 3.8, Strings: 3, Instructions: 74COMMON

Download Yara Rule

Strings

H{H, xrefs: 00007FF848F68E9C
8{H, xrefs: 00007FF848F68E4C
{H, xrefs: 00007FF848F68E74

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID: 8{H$H{H${H
API String ID: 0-3763138897
Opcode ID: 30df29cc75c113c21097a48776912c247510925d4ac835af812cfa75f814fb4d
Instruction ID: 9742192d3cf2b05918edbdbd1ae7f643b7410765777ccfcbe42897da6df3545e
Opcode Fuzzy Hash: 30df29cc75c113c21097a48776912c247510925d4ac835af812cfa75f814fb4d
Instruction Fuzzy Hash: FF11AF11F2ED8A6FE7D9BB7818A627C94D1EF58AC5F8051BCD00ED72CBDE1C190A4219

Function 00007FF848F6072A Relevance: 2.8, Strings: 2, Instructions: 305COMMON

Download Yara Rule

Strings

HxH, xrefs: 00007FF848F608EB
XxH, xrefs: 00007FF848F6093F

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID: HxH$XxH
API String ID: 0-958416646
Opcode ID: 4defc7885f5aa2998733c0679a64537b009b3f50e063c5074ab8afc82141672f
Instruction ID: 91f2e9e76cd3f20b0facdaa0e549dafaec0af0c47d714e972c3a9c691e5a1c65
Opcode Fuzzy Hash: 4defc7885f5aa2998733c0679a64537b009b3f50e063c5074ab8afc82141672f
Instruction Fuzzy Hash: 0BA1B130A0D7855FE786EB38C494B657BE1EF9B340F5900EAE489CB293DF289846C751

Function 00007FF848F612E5 Relevance: 1.7, Strings: 1, Instructions: 471COMMON

Download Yara Rule

Strings

X.H, xrefs: 00007FF848F613BB

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID: X.H
API String ID: 0-1184648008
Opcode ID: ec248b63cb3440118a0212855538087450f04a0f60cfc08c4b8a4e15da2839e1
Instruction ID: 482c31bdd50f541c40c01becf780b690ab0940c6b8424db10b6c9d10d71cdfef
Opcode Fuzzy Hash: ec248b63cb3440118a0212855538087450f04a0f60cfc08c4b8a4e15da2839e1
Instruction Fuzzy Hash: 32E1DF30A1DA895FEB69AF2C88567F977D1EF49340F4402BAD40EC72C3DE78A9458385

Function 00007FF848F69B06 Relevance: 1.6, Strings: 1, Instructions: 392COMMON

Download Yara Rule

Strings

X|H, xrefs: 00007FF848F69B46

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID: X|H
API String ID: 0-72341475
Opcode ID: 04da851ce1660a99e3326f436d48b55d36b02ecc38a6bdf8a0427aa22f213a84
Instruction ID: 86cedb99ec5e2f3cfb9326edafc212a537150d8fbe55ab3bcbf2c80bc5498c40
Opcode Fuzzy Hash: 04da851ce1660a99e3326f436d48b55d36b02ecc38a6bdf8a0427aa22f213a84
Instruction Fuzzy Hash: 8CD17920B1DF495FEB86EB288491BA9B7D2EF99740F5404B8E04EC72D7CE28BC458751

Function 00007FF848F6BFC3 Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

9, xrefs: 00007FF848F6C12B

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: fa24068d2e47e82eab45439cf0eb025cf616c767d1648dd195724041eadc2d2e
Instruction ID: 49c294c4cb4fe02c38a3f1c1056212fc3e5e9791c1113f7dd5db1474b491f6d0
Opcode Fuzzy Hash: fa24068d2e47e82eab45439cf0eb025cf616c767d1648dd195724041eadc2d2e
Instruction Fuzzy Hash: B561E730A1DA882FEB81EB3884517E97BD2EF9E345F5505B9E04DC7297DF28A846C341

Function 00007FF848F70AC9 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

9, xrefs: 00007FF848F70B19

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 953f55193bdad948cddeceac141215d2cef1543c46ce3aada6a843d46f746b85
Instruction ID: 2ef22d8165212524ee8ae7afede6fdad63a15285062f8bcd0e1bd33b1fa5661c
Opcode Fuzzy Hash: 953f55193bdad948cddeceac141215d2cef1543c46ce3aada6a843d46f746b85
Instruction Fuzzy Hash: BC518130A0DA898FFB55BB788454BA87BD1EF96345F5400F9D40DCB2E3DE699842C704

Function 00007FF848F6CE4D Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

9, xrefs: 00007FF848F6CEEA

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 2df4b8eedcbb335bf7ad7ef0594ec494f09570cc0b36ba55b31a011882264e8a
Instruction ID: 3df3efbcc20ca1d5231fead04fb0b56826a49ab5fc12136d6d039c72152c6fa7
Opcode Fuzzy Hash: 2df4b8eedcbb335bf7ad7ef0594ec494f09570cc0b36ba55b31a011882264e8a
Instruction Fuzzy Hash: 21419E2090D3C65FE767AB788869BA47FA19F07250F4E40FED089CF0A3D95D884AC761

Function 00007FF848F68610 Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

9, xrefs: 00007FF848F6864B

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 006b475d0d84f2c56f5c0b214edd2ec3f74df52c8db90e69244fd2c5435db3c2
Instruction ID: c7c63e8864dbbacd4d098fbaf8637519064e06cc7d095ba01f89994fb9d13e57
Opcode Fuzzy Hash: 006b475d0d84f2c56f5c0b214edd2ec3f74df52c8db90e69244fd2c5435db3c2
Instruction Fuzzy Hash: E8F0B46090DA880FDB4ABB3848595147FE0DF57384B9900EAD048CF1A3E9159C49C322

Function 00007FF848F666D0 Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

9, xrefs: 00007FF848F6670B

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: b18354ec9e72a945ae2306f9f3749a03a6df50383294f2701296ce8210fd498b
Instruction ID: e019c166c96a8f5f36c9b7fff2a0ec6c73c69c7a914f762daaa5e9ad1e1ea78a
Opcode Fuzzy Hash: b18354ec9e72a945ae2306f9f3749a03a6df50383294f2701296ce8210fd498b
Instruction Fuzzy Hash: 6EF05EA1A0DA884FDB46BB3848589147FE1DF67284F5A00EAD448CF1E3ED599C49C326

Function 00007FF848F664A0 Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

9, xrefs: 00007FF848F664DB

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 48811aa11421d23eb19b1eb540f1ca763e18f72f91c1dfc6ee43308ea397f850
Instruction ID: abdfdf7a511ec40ceb0da668fbcc98531fac9347e8ae60aa417ab1c4f35a2ed0
Opcode Fuzzy Hash: 48811aa11421d23eb19b1eb540f1ca763e18f72f91c1dfc6ee43308ea397f850
Instruction Fuzzy Hash: 46F0BE60A0EAC84FDB46FB3C4858A14BFE0DF17284F5901EAD048CF1E3E9189C49C322

Function 00007FF848F669F0 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

9, xrefs: 00007FF848F66A27

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 278886ecaba4ec25215f6135bd99e9ce0266e8e824eff2069cb4dc9d42748e06
Instruction ID: 4ffe139a76b3aa490f98098342416f39c062e29a047e22ee2dbcc54856871480
Opcode Fuzzy Hash: 278886ecaba4ec25215f6135bd99e9ce0266e8e824eff2069cb4dc9d42748e06
Instruction Fuzzy Hash: 40F0B46090DA884FD746B73884446147FE1DF27284F5A01EAD048DB1E3DA189C49C316

Function 00007FF848F67860 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

9, xrefs: 00007FF848F67897

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: ef17ba94e0241bff54214c7d30112edb2dc8f24dce8a0478cd403f6ddaa5c903
Instruction ID: d83b8c13178e652687ec13f05b1c2f6c556a85bc70f7a69deee19d69951c350d
Opcode Fuzzy Hash: ef17ba94e0241bff54214c7d30112edb2dc8f24dce8a0478cd403f6ddaa5c903
Instruction Fuzzy Hash: 9BF0B46090DAC84FD746B73848046147FA0DF17384FA901EAD048CB1A3DA649C49C316

Function 00007FF848F73A60 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

9, xrefs: 00007FF848F73A71

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 12ba4b6783933a7ddd6f130ef0dc80b38c05354b50f8b3cf1ac9ff9f9e5ea3bb
Instruction ID: 46163722105dd057549db78c71343869c81638239d4c604994b11ca16be7294e
Opcode Fuzzy Hash: 12ba4b6783933a7ddd6f130ef0dc80b38c05354b50f8b3cf1ac9ff9f9e5ea3bb
Instruction Fuzzy Hash: 01E09211E0EA898FF791BB7C440E53869D1AF56685F4800BDD049CF193EDA8DC01C306

Function 00007FF848F6183A Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3328bbfad6550a636ca0d74e7d6a52bbeaf8f99c90d32392a5af0f1657e614ff
Instruction ID: 6fdcd794fe6ec86c589a4ef7a1ed87a69d0d973c5c547aeaedd5511d1a07d235
Opcode Fuzzy Hash: 3328bbfad6550a636ca0d74e7d6a52bbeaf8f99c90d32392a5af0f1657e614ff
Instruction Fuzzy Hash: F932A820B1DE895FEB86EF2884957687BE1EF5A340F5500EAD04DCB2D3DB28AC85C751

Function 00007FF848F61890 Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d193b66161f0a0cecba96efd7b65e6ff422f6a2cfc4ea049b38d32966cbef8eb
Instruction ID: 7e3493bcad978c0e5fbc3d9bb907229a138bb32d975ebcf1bc833f2bee668a7b
Opcode Fuzzy Hash: d193b66161f0a0cecba96efd7b65e6ff422f6a2cfc4ea049b38d32966cbef8eb
Instruction Fuzzy Hash: 9A029520B1DE895FEB86EF288455768BBE1EF5A340F5400EAD44DCB2D3DB28AC85C751

Function 00007FF848F6E47D Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c599b720919f3ed054c9e2bb13ca990669d783493267bf7de5599807f61d7b3
Instruction ID: 87326f3ac5e55eb72e3bab0d8e95ea1b146d2fc555e250619b88aa3c6d0c5e33
Opcode Fuzzy Hash: 9c599b720919f3ed054c9e2bb13ca990669d783493267bf7de5599807f61d7b3
Instruction Fuzzy Hash: 42F15730A1DA896FEB85EB298850BA9B7D1FF49340F9541B9E049CB2D7CF38EC018754

Function 00007FF848F60171 Relevance: .5, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73624cd71c295b1b83d14a39c0b720ca73cb6b2fdc374a2970aec8206bfd083a
Instruction ID: 8b09da24b5c88a3d85122ac6cc8e243c814d0af356fca585b9dab91aca0c72a1
Opcode Fuzzy Hash: 73624cd71c295b1b83d14a39c0b720ca73cb6b2fdc374a2970aec8206bfd083a
Instruction Fuzzy Hash: 2BE10A70A0DA8A5FEB95FB2884557B93BD0EF86380F5401BAE44DDB1D3DF28A8468351

Function 00007FF848F75F55 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c365e1b3ffcc9917f8a5661d116f52991f16ebb0b0a351eb6e4aa1756c0fdab9
Instruction ID: 945670d6ef498b733e26bcfef6ee54449c3b071c9dd86e754f718ff300da7b5f
Opcode Fuzzy Hash: c365e1b3ffcc9917f8a5661d116f52991f16ebb0b0a351eb6e4aa1756c0fdab9
Instruction Fuzzy Hash: C0E16F3070998D9FEB95EB2884A1BEC37D2EF9A341F5400B9D40DCB297CF29AD468751

Function 00007FF848F70634 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5842f2a065885c65f9014a867f6cb1158152ba39132fcb8e5472a35b20c0221a
Instruction ID: b22d9a9fe6d46e45c340ad4a0277c66b4c699d927a783aefd141b443cec74718
Opcode Fuzzy Hash: 5842f2a065885c65f9014a867f6cb1158152ba39132fcb8e5472a35b20c0221a
Instruction Fuzzy Hash: C2E18030A0DA898FEB95FB688499BA977D1FF99341F1404BDE44DCB293DF3898428705

Function 00007FF848F70C51 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1425a646b415611b80d88fa0a34555f99608aaa8e2882217363593830bbb3b3f
Instruction ID: b937f6b5ad673a289163e1cafb1c55f8c9cb5b116fdc223a364db6931429656a
Opcode Fuzzy Hash: 1425a646b415611b80d88fa0a34555f99608aaa8e2882217363593830bbb3b3f
Instruction Fuzzy Hash: B9C1F621E0DE8A5FE789BB7858593797BD1EFA9380F0800FAD44DCB2D3DE18A8058315

Function 00007FF848F60A99 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 517871954c5cb79d12a5ea6ff00c487e3be85a51ccfddefbc5380408cf944556
Instruction ID: f82bf154132c4a30ed81a84b08c450a50dc242d5bae5b9b1671505cfa0cdd739
Opcode Fuzzy Hash: 517871954c5cb79d12a5ea6ff00c487e3be85a51ccfddefbc5380408cf944556
Instruction Fuzzy Hash: D2A1C630B0CA0A5FE798FB2894557B973D1EF99350F5401BAE44ED32D3DE29AC028795

Function 00007FF848F72802 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3501c8749553192bd87235684e36d081422a32274c2a1d5a00010d198c9e91d
Instruction ID: 3b71bf70561639616239e32129c681749092c23c74245955588026d3b104cd31
Opcode Fuzzy Hash: a3501c8749553192bd87235684e36d081422a32274c2a1d5a00010d198c9e91d
Instruction Fuzzy Hash: 8FA17F30B0DE495FEB91EB68849577D77E1EF89341F58057AE04EC72A2DF28A881C702

Function 00007FF848F688B1 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810fdb62a3cfeeb68da47ca670a1c7ac87dec94c7d6a0f66903f11fd146ffddd
Instruction ID: 1bd56c33d0436db644faf920062ba454c7ec42eb3237991b940732484570ac5f
Opcode Fuzzy Hash: 810fdb62a3cfeeb68da47ca670a1c7ac87dec94c7d6a0f66903f11fd146ffddd
Instruction Fuzzy Hash: CD91F121B1DE495FE785FB2C445A6B977D2EF99B41F5401BEE00DC7287CE28AC468382

Function 00007FF848F7066C Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789c7eac0a83ff3e65f1210ffcb888f8cb74e770f8016b0755d632a8048df1ce
Instruction ID: f056f3ddcc3a22fb7705c5903bfa445c7ca88f4a20075c67796181e11f133bb1
Opcode Fuzzy Hash: 789c7eac0a83ff3e65f1210ffcb888f8cb74e770f8016b0755d632a8048df1ce
Instruction Fuzzy Hash: EFA18D30A0DA898FEBA5FB2884597A977D1FF99341F1404BDD44ECB292DF28A8428745

Function 00007FF848F74778 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269213976edfaac7b0d7efcd9b54ea8bfa4f3daf8d592d1a3bc541bc1bfcd76a
Instruction ID: 1c8b4d37b9751bfbf640ed6f17161a31aeb5bf980eb1b815bb34ca34c0ec4516
Opcode Fuzzy Hash: 269213976edfaac7b0d7efcd9b54ea8bfa4f3daf8d592d1a3bc541bc1bfcd76a
Instruction Fuzzy Hash: 91910C7060CA8C8FEBA5EF2C84487E977E1FFA9301F54056AD88DC7292DB349945CB41

Function 00007FF848F6E97F Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ddf9f2e50d5b4da4a97707e8fc2fe239bafc43d2e788b0103eb628a1fa8ceb
Instruction ID: cdcba1cad30d1af32aed93837735ed1cc2e7592eac54a396fee0dd45f473531b
Opcode Fuzzy Hash: 26ddf9f2e50d5b4da4a97707e8fc2fe239bafc43d2e788b0103eb628a1fa8ceb
Instruction Fuzzy Hash: B2913D30709A899FEB86EB38C458BA87BD2EF5A341F5500F9E04DCB1A6DF249C45C751

Function 00007FF848F70349 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca621456cc1d016cb5f93ec614b294bb82ff2f90edeb07349dc3689fbb509c72
Instruction ID: 993c1f6bdb8f167f073dc14632ff0d4f88d4eb7066aff3db88751eb9509e7dc7
Opcode Fuzzy Hash: ca621456cc1d016cb5f93ec614b294bb82ff2f90edeb07349dc3689fbb509c72
Instruction Fuzzy Hash: 4471B27090DA894FE7A5FB688459BB97BE0EF9A341F0500BED84DCB1A3DF2458858705

Function 00007FF848F62136 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47388de27d7713ed8a8b9c6e9a7031c657f2b026f93f36b61072c9d31ae8ded2
Instruction ID: 85f17ebf21ef3fd8c22c71c0c976a8b9fb343d80de91f06d264257c0ff8a5185
Opcode Fuzzy Hash: 47388de27d7713ed8a8b9c6e9a7031c657f2b026f93f36b61072c9d31ae8ded2
Instruction Fuzzy Hash: 32616F31A0CA498FE755EB38C449BA6B7E0FF55341F1445BAE489C72A2EF34E845CB41

Function 00007FF848F60DC9 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a32ff90b8cd6c4da603ee3e95286716e3f8b8dbfac7cf9a47e78776c42497ec
Instruction ID: 96c902ad5df6c1a659765a59e85509e097c3b74c788597acb68755e0f0316228
Opcode Fuzzy Hash: 5a32ff90b8cd6c4da603ee3e95286716e3f8b8dbfac7cf9a47e78776c42497ec
Instruction Fuzzy Hash: CD513931A1CB8A5FE35ABB2854556B97BD1EF86340F1942FAE44DDB1C3DF189C068382

Function 00007FF848F6CA5B Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76d8b698503d5d8faf4add1a4b66dd21b53c434c5e27735927b18576c8a6346
Instruction ID: 84b9250d81c42890978d982615ac6e685693e0085baa445ac63b8371808dd361
Opcode Fuzzy Hash: d76d8b698503d5d8faf4add1a4b66dd21b53c434c5e27735927b18576c8a6346
Instruction Fuzzy Hash: 4D51C031B0DA495FEB85FB2884597B877E2EF99381F5401BAE44DC7293DF28AC428345

Function 00007FF848F660FC Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831b79ff9aa62f4901955b87baac5f7779f5b41baf1e568f314c4e3c17959df5
Instruction ID: 798026a9a22b72709adbe9113d40d830981c810d837a5ea720402cc72cc42492
Opcode Fuzzy Hash: 831b79ff9aa62f4901955b87baac5f7779f5b41baf1e568f314c4e3c17959df5
Instruction Fuzzy Hash: A051803051CA895FD795FB28C088A65FBE0FF69354F5006AAE08DC7163EB24E885CB91

Function 00007FF848F6000B Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe60d52b79b66161c4e7da5f3e885b26fa6fd86c6a8e599fa1b6076e775dae83
Instruction ID: cda8475a169d18baff7e449e5c1c5d578f8d2e44749a6d690db9425fa5516b26
Opcode Fuzzy Hash: fe60d52b79b66161c4e7da5f3e885b26fa6fd86c6a8e599fa1b6076e775dae83
Instruction Fuzzy Hash: 6E41A26294EBC55FE343673418391646FB19F63551B5E11E7C888EF1E3EA1D1C0AC326

Function 00007FF848F623FE Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe8197be172384d0baf205cd057f4d471c8e94df06c3720747fb134eb8e525e
Instruction ID: 2869f9d1030101187ba5eb2292efc0788e81c7bdb3a40d894c154fbb7be93ba6
Opcode Fuzzy Hash: dbe8197be172384d0baf205cd057f4d471c8e94df06c3720747fb134eb8e525e
Instruction Fuzzy Hash: 9A41B331B0DA0D5FEB84BF6884856B837D1FF99381F5401BAE44EC7293DE28E8468755

Function 00007FF848F6CB7F Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 930ea76e33f22876408a943b35cb3e3812be573ac8b06d01f1bdd33e00881bc7
Instruction ID: e7dc700691620427bac002f402a7601257b89708d99996bfb9d0ad62aa513f1c
Opcode Fuzzy Hash: 930ea76e33f22876408a943b35cb3e3812be573ac8b06d01f1bdd33e00881bc7
Instruction Fuzzy Hash: F051E231B1CB494FEB58AB2C94A56B8B7D1EF58341F4441BAE44EC72D3DF28AC428749

Function 00007FF848F6CBD0 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2590cadd9babcbafaba33fa6733a9897feace78594d772f90d2fe742ce3bfef
Instruction ID: da223177ddbc8984e24f8bbbd26f4814477bc936b45f6864be4a8645e0f1be9d
Opcode Fuzzy Hash: a2590cadd9babcbafaba33fa6733a9897feace78594d772f90d2fe742ce3bfef
Instruction Fuzzy Hash: B3510431B0DA495FE789AB2C98592B8B7D1FF49741F4400BAE44EC72D3EF28AC428745

Function 00007FF848F6A23C Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fcde27f0bbb7fa005680da6876f254c81875acc26c0f533db3922bd444716d3
Instruction ID: 85545a33b0016a2279bbf233b3fe938887e2728167cf951b3307f1841b5ce0e3
Opcode Fuzzy Hash: 3fcde27f0bbb7fa005680da6876f254c81875acc26c0f533db3922bd444716d3
Instruction Fuzzy Hash: DA516C20B1DF485FE785E72884917A9B7D2EF89740F9004B9E04EC72D7CE68BC458755

Function 00007FF848F6CBE2 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c8b39acf93a80d2097f1cc6d2c439373455463368392881c47a64c5ee0d660
Instruction ID: a99100bea5f324ea0f941c913b42e05c9b2df2d7015b3893c5ba97796737bb69
Opcode Fuzzy Hash: 08c8b39acf93a80d2097f1cc6d2c439373455463368392881c47a64c5ee0d660
Instruction Fuzzy Hash: CB411531B0CA495FE789AB2C98596B8B7D1FF58740F5400BAE44EC72D3DF28AC428345

Function 00007FF848F61021 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c7b8440c70a89326bb9998a785beca72f753abfca888fd068bf5225d0ff5f7
Instruction ID: 5d2fb0554be2b1d9097fb62172b2ba9b1a691f9b1bc2edc7cc0676ba0e57247b
Opcode Fuzzy Hash: 11c7b8440c70a89326bb9998a785beca72f753abfca888fd068bf5225d0ff5f7
Instruction Fuzzy Hash: DB41D13060958A9FDB46EF24C4A1AE1BBA0FF69300F1601F6D449CB097EF68EC06C791

Function 00007FF848F65259 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94e7634713387ddb0008e590807bded6e48f1c49e7d31dc2fce9c369846573d1
Instruction ID: 2f4c5ff1c435b1bdfdc8d8bdd24f553b4824447109a659abe6ff6be89b7a00c5
Opcode Fuzzy Hash: 94e7634713387ddb0008e590807bded6e48f1c49e7d31dc2fce9c369846573d1
Instruction Fuzzy Hash: 3D41E310B1EA891FDB85FB3C48657797BD1DF6A280B4940FAE04DCB2D3DD18AC458362

Function 00007FF848F65FCD Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a0a55cdf42e445517a527cf3c583c521c1c02b22a860138d0ba3617ac7bfe1
Instruction ID: 605f4c86876ecd45d70b76884b92b5872e8a5c8017d7d6d91c28df69fb88be0a
Opcode Fuzzy Hash: f9a0a55cdf42e445517a527cf3c583c521c1c02b22a860138d0ba3617ac7bfe1
Instruction Fuzzy Hash: B0311670A0DA4A5FE345AB288405779B7D1EF49340F6841B9D04DC72D3EF38EC42834A

Function 00007FF848F60359 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc6773a188202a29f1270ed3cea35cc0be9a73a4841db8dbed7c2c33c3e6f47
Instruction ID: e01839fbafd2fa0da5e2e3e0ff53eaccbfca8d5962553f7332a07a9319feee15
Opcode Fuzzy Hash: 6cc6773a188202a29f1270ed3cea35cc0be9a73a4841db8dbed7c2c33c3e6f47
Instruction Fuzzy Hash: 6E31C221E0D90B5EF6A4B72954526BC26C1FFC5391F64227AE84EE31C3DF1CA843924A

Function 00007FF848F68718 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0774d0483a0432becec33648744b25b72cc07efa3b189c6cc38e25fd2e085848
Instruction ID: aa0d8118483e24e7cd56058941b3c82d280b0fa1893ef9436775da3d4ef8d76f
Opcode Fuzzy Hash: 0774d0483a0432becec33648744b25b72cc07efa3b189c6cc38e25fd2e085848
Instruction Fuzzy Hash: 38314D31A18B098F9B84EF2CC0855AAB7E1FFA8741F14053EE48DC7291DF25E945CB82

Function 00007FF848F64279 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef550721cf8ba3ec78f460fc6279018d2469301df882d14227059dbe9b634033
Instruction ID: 48a82a35c7ab2bd5ec6479bd96dc2cc35e7ca3d13c601cc9f93c6459d26b37b6
Opcode Fuzzy Hash: ef550721cf8ba3ec78f460fc6279018d2469301df882d14227059dbe9b634033
Instruction Fuzzy Hash: AE31612071DB894FEB85FB3C8855B647BE1EF6A344B5940F6E049CB2E3D928DC458722

Function 00007FF848F68739 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88cc1d5fd6b1f09ca4e817e3f0abc98e7beb0d9081ec298f1ef7e78032a0a826
Instruction ID: 1ca8fd3c9ea589b98e876b32908fe1bbc50c2f7ba2580fc031f32b0dede26066
Opcode Fuzzy Hash: 88cc1d5fd6b1f09ca4e817e3f0abc98e7beb0d9081ec298f1ef7e78032a0a826
Instruction Fuzzy Hash: 62314D31A08A099FDB85FB2CC0856AAB7D1FFA9741F14053EE44DC7292DF25E945C781

Function 00007FF848F63AD9 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9edbc674b1fccd8daa76fdcc969d7ae2ff100180ca9180ab5dd2078996611829
Instruction ID: 56d7e8cefc85448b6710830a4dd92ed729e912b846b44ad3ecae618b80438a12
Opcode Fuzzy Hash: 9edbc674b1fccd8daa76fdcc969d7ae2ff100180ca9180ab5dd2078996611829
Instruction Fuzzy Hash: BD31542071DA894FDB85EB3C8865B54BBE1EF5A340F5940F6E04DCB2A3D928DC458722

Function 00007FF848F635B9 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d24271c654e285ec02364e411fe10a1cc49c25130c3c56e47cc185d157acbaf5
Instruction ID: 250e614c22fd443c5875fff9bd0e8da9c1ea47e9b82da95de63ef16ba80289f2
Opcode Fuzzy Hash: d24271c654e285ec02364e411fe10a1cc49c25130c3c56e47cc185d157acbaf5
Instruction Fuzzy Hash: 2A31842071DA894FEB85EB3C8859B557BE1EF5A340F1940F6D04DCB2A3D928DC458762

Function 00007FF848F64509 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05106446d9e392312b7020ce58abffab701fa42fa836e1131775a9533ee108d1
Instruction ID: aeb6ba30c4830c8da1688f719b063c05c93f19685c6b4cbafbd5cb9b8ce5b261
Opcode Fuzzy Hash: 05106446d9e392312b7020ce58abffab701fa42fa836e1131775a9533ee108d1
Instruction Fuzzy Hash: 9631A52071DA894FDB85FB3C8859B657BE1EF9A340F1940F6D04DCB6A3D928DC498722

Function 00007FF848F63D69 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26fd09d1443c65c5528d01b6af97e4745a519dcaa0c514ec071bfb96911b218e
Instruction ID: 5c08906a9d0cf9d56b0a1ab88529204d92031f8ac9526297d77427a05fed5b30
Opcode Fuzzy Hash: 26fd09d1443c65c5528d01b6af97e4745a519dcaa0c514ec071bfb96911b218e
Instruction Fuzzy Hash: 7231922070DA885FDB86FB3C8859B647BE1EF5A341B1940F6D04DCB2A3D928DC458762

Function 00007FF848F63849 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78f718eb0a74b34f0fe0cbc7d2eb5ee5b6f4d0d645b51d0cfa6a3424b1613a6
Instruction ID: cf6b1b06cebc604b7730f3e5563f15c46956d0496438ad0ccfd5c73abb3b890c
Opcode Fuzzy Hash: d78f718eb0a74b34f0fe0cbc7d2eb5ee5b6f4d0d645b51d0cfa6a3424b1613a6
Instruction Fuzzy Hash: CF31822071DB885FDB85FB3C8855B647BE1EF5A340F5A40F6E049CB2A7D928DC488722

Function 00007FF848F63329 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb6486177e35879a5b04d3271f8a6e319784a97dbd8edb78f3cc064501fd9f97
Instruction ID: 9ada6f14ebf52bce6743a6bdd029f81e9a6d0d2bd229ced6dfb82743f52c2c3a
Opcode Fuzzy Hash: eb6486177e35879a5b04d3271f8a6e319784a97dbd8edb78f3cc064501fd9f97
Instruction Fuzzy Hash: C831842071DA894FDB85EB3C8869B547BE1EF5A340F5940F6D04DCB2A3D928EC49C722

Function 00007FF848F65CB9 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f9dffe48400f8d93f295cd4716ea7a52ce2b9ea2e0a81639408036dc10c96f8
Instruction ID: 968363260b245c9ea2a9f2a5e8619727188e769b0d8545a8d67914377130d40f
Opcode Fuzzy Hash: 5f9dffe48400f8d93f295cd4716ea7a52ce2b9ea2e0a81639408036dc10c96f8
Instruction Fuzzy Hash: 1531632071DA894FDB45FB3C8869B64BBE1EF5B344B5940F6D04DCB2A3D928DC488722

Function 00007FF848F63FE9 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b190207b813e02bc21279415313f24f3a508dad07e006d74daf1a8d327245b57
Instruction ID: b2e5b285d58decf3570165bfce55502e18a0c530d1c556e524be2761ee60ec72
Opcode Fuzzy Hash: b190207b813e02bc21279415313f24f3a508dad07e006d74daf1a8d327245b57
Instruction Fuzzy Hash: 7831762071DA895FDB85FB3C8855B647BE1EF9A340B5A40F6D04DCB2A3D928DC44C762

Function 00007FF848F62E2A Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60b6f3e67728b141cf32ec5a6e069b20ef73422ec550f639e4c51e5709b0bd2
Instruction ID: 9e16a7823d4b07e63caf7d1dcff4a16dd7771adee36165cff8ca1bb704e07ca3
Opcode Fuzzy Hash: d60b6f3e67728b141cf32ec5a6e069b20ef73422ec550f639e4c51e5709b0bd2
Instruction Fuzzy Hash: 6831922060DBC95FD746AB388865A547FE1EF5B350F4A40F6D089CF1E3DA289C09C362

Function 00007FF848F6EC05 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e93f0bfac2d77cbf69fc4953d4fd1fb7fa283a238deed7e0aca30421310e012d
Instruction ID: 722cb95a71533b3b767eba8224db98a3dd85dcce8b73b41d8f1151efa003802b
Opcode Fuzzy Hash: e93f0bfac2d77cbf69fc4953d4fd1fb7fa283a238deed7e0aca30421310e012d
Instruction Fuzzy Hash: D6410E307099499FEB85EB79C4987A87BD2EF8A341F5440F9E40DCB2A6CF389881C751

Function 00007FF848F64FD8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f8a75d3c230d2d3263a151fb2b049abe7daf82446b480e4228fceb52660b9dc
Instruction ID: 37ccf281bb6417d428613ad010ef22e9235a5827624f05cc926017a56b32bbf0
Opcode Fuzzy Hash: 0f8a75d3c230d2d3263a151fb2b049abe7daf82446b480e4228fceb52660b9dc
Instruction Fuzzy Hash: 68317220B1DA895FDB85FB3C8865B247BE1EF6A340F5540F6D00DCB2E3D9249C448722

Function 00007FF848F65A69 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11465ff0af8758c25f1416195a85a43f588fcf970e382fb3f8942bd0480d33c7
Instruction ID: 6d324e66e892ae6b4b4a2b8dcad4a802df341d8862f763f1c9e22073ba515863
Opcode Fuzzy Hash: 11465ff0af8758c25f1416195a85a43f588fcf970e382fb3f8942bd0480d33c7
Instruction Fuzzy Hash: D3217410B1DB891FEB46EB3C8865A547BE1DF5A350B4941F7E049CF2E3DD18AC488726

Function 00007FF848F72B1E Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a210632d9cb669d31d23d31b3f7ed94df6620bde4261b4c60d51ea901b41a28
Instruction ID: 8aca141052604da1f3c4589518b1f37dbedc1b36a3c7702146c54a0f06195387
Opcode Fuzzy Hash: 5a210632d9cb669d31d23d31b3f7ed94df6620bde4261b4c60d51ea901b41a28
Instruction Fuzzy Hash: E621D621B0EE8B5FFB566BB818953342BD0DF552A2F0400BAC54ACB1E3DE5C98458341

Function 00007FF848F64789 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faed976ea20545c4eacaa1d854892636634d64cec3e2bd6b43b6caaa7d5f4e0b
Instruction ID: 3a761867090882a8679bedd966b821a2922c5c47e98ff012346a1083eb26f1d0
Opcode Fuzzy Hash: faed976ea20545c4eacaa1d854892636634d64cec3e2bd6b43b6caaa7d5f4e0b
Instruction Fuzzy Hash: 7321602071DB884FEB46AB3D8865A54BBE1EF5B350F4941F7E049CB2E3D9189C498326

Function 00007FF848F61171 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c873b8b3ed5ed22c955384e50a461d1d7cab7ebe8721ce034dc85b0ead99ad9
Instruction ID: 622d6c92ff571c59a47d5bc580b5c1ad7794a48b107edf84666285a01d67f43e
Opcode Fuzzy Hash: 0c873b8b3ed5ed22c955384e50a461d1d7cab7ebe8721ce034dc85b0ead99ad9
Instruction Fuzzy Hash: 7621F120A0DBC95FD742EB2884547697FE1EF8A280F1941EBD048CB2E3DE389D058751

Function 00007FF848F72964 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23612c86708ffdab7b3cf4dc900c5ca8c5721f6b140a64fc73797c06d74ec9bb
Instruction ID: b71de0427ff011de47a742b4567a81fad107b8ee566454db9a3721855b5b0c4b
Opcode Fuzzy Hash: 23612c86708ffdab7b3cf4dc900c5ca8c5721f6b140a64fc73797c06d74ec9bb
Instruction Fuzzy Hash: 11213030719E054FEB94EB6C9494778B7D1EF9D351F5805B9E04EC7292DF28A881C702

Function 00007FF848F74C1D Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c4e70359be09b2fcb7a20e4e187b8dd2ba114be2264903738bbab4073067a5
Instruction ID: f3d5759826e0a8df7867b32e452daafa8311714409e5bfb87a474631aa683260
Opcode Fuzzy Hash: 93c4e70359be09b2fcb7a20e4e187b8dd2ba114be2264903738bbab4073067a5
Instruction Fuzzy Hash: 26110831A0CE8A2FE7AAAB3C54952F5BBE1EF65751F0802BAD04DC71C3DB0498458395

Function 00007FF848F66388 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ee4a2000354b578dbbf95f52157ad8bba6243657b9e1f4a10562234ba49498
Instruction ID: 4a7bcc4553636f048fdea4730eac91eded33367b66a2a65f8ffbac67f2cef367
Opcode Fuzzy Hash: 07ee4a2000354b578dbbf95f52157ad8bba6243657b9e1f4a10562234ba49498
Instruction Fuzzy Hash: AC11E331B0CA895FDB45EF1C984A7B87BE0EF59351F1441FBE80CCB292DA24AC158792

Function 00007FF848F6ED9D Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca75ef2bbaee8b676825385cd0ef78b8454f2d678906068ed0fff6e7da603bda
Instruction ID: 04207780f54b1d09919bf8afcdb816498065e38b0c90c7c1fdf341b448c9e745
Opcode Fuzzy Hash: ca75ef2bbaee8b676825385cd0ef78b8454f2d678906068ed0fff6e7da603bda
Instruction Fuzzy Hash: 6B01042160E9880FC74ABB285C85AB67B90DB69251F0501FBD40DCB2D3DD589809C364

Function 00007FF848F72D3D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709ffd7af94b975f0341b41708335eee9df1d2562b438e3c90c4f236fb378bb6
Instruction ID: 614e6a39670d1aa01cc2cc38b3a425effffcc04c1276c03906f87df7d0fcf937
Opcode Fuzzy Hash: 709ffd7af94b975f0341b41708335eee9df1d2562b438e3c90c4f236fb378bb6
Instruction Fuzzy Hash: 9C01B530A0D9896FE746AB3484917E43B91EF9A351F8800F6D44DCE1D7DE695446C350

Function 00007FF848F61E9C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a517d5aa439902848e40f2fbb9a2346943a184dedd0004c4d5b3caf09b6be7
Instruction ID: 5d4648aba46ce0fef5a43a90116fb777168a9437537218b09d28440bc2509905
Opcode Fuzzy Hash: 77a517d5aa439902848e40f2fbb9a2346943a184dedd0004c4d5b3caf09b6be7
Instruction Fuzzy Hash: DC114434608A4D8FDF81FF1C8498AA937E5FF59351B4505B6E80EC7292CB38D8458751

Function 00007FF848F62577 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1cfed1eb205994e614a4751f332048f029e84179271b795cb702031aedb3ca
Instruction ID: e539a75a06c5061a9e7392f8db363cb44e5dda15e631a7b7f37519920f10480a
Opcode Fuzzy Hash: 3c1cfed1eb205994e614a4751f332048f029e84179271b795cb702031aedb3ca
Instruction Fuzzy Hash: 1011C86180D7C96ED7235B7884656E97FA0EF17250F0941EAD4898F0D3DF2C9A0A8792

Function 00007FF848F71078 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8188bebbfc3682d0a8e135c9ea2a2cc27f15e388e7bcef2a190884c660f76d9f
Instruction ID: 82225b0f42aa154d6519c58af1ee991b0908a0eeb1a0ae5c84cc596b5ecac863
Opcode Fuzzy Hash: 8188bebbfc3682d0a8e135c9ea2a2cc27f15e388e7bcef2a190884c660f76d9f
Instruction Fuzzy Hash: 07119270A1CA8D8FEB60EF1C98467E93BE4FF48359F50017AE80DC2181DB788559CB85

Function 00007FF848F748B9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa0213042a10c9afff272a17eeb951a9b5e0e202d3a74f10ad1b0a61696255c
Instruction ID: e5451763c6828c551c6966a35b46a93710e555fa8d61f83301e09c1a27711ad3
Opcode Fuzzy Hash: 1fa0213042a10c9afff272a17eeb951a9b5e0e202d3a74f10ad1b0a61696255c
Instruction Fuzzy Hash: 20012930718A4D8FDBA4EF58C089BF973D1EBA8701F14497AD04EC7256DF75A8868B41

Function 00007FF848F6D4A4 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca8a9fd38b957c10699d7932245be09af2584932e1e75dd35e74049d07c759c
Instruction ID: 5e16d018d2bf9fca5c49b6fb0f753bd8c84d4cfba7bda5654504217c954f84fe
Opcode Fuzzy Hash: fca8a9fd38b957c10699d7932245be09af2584932e1e75dd35e74049d07c759c
Instruction Fuzzy Hash: 49018110B0E64A1EEF987A3D1CE133825828F95166F8415BBD44ECB1DBDCADD8160310

Function 00007FF848F6EE3D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5679ba6ba2650c9e3ea5fc73ba5e59a362417649e7246b01a3ef1b0626b134
Instruction ID: 1f91fc73e4d695dfc3f0bf419bd348b30806f849c7bb6ddda3d63671498504c1
Opcode Fuzzy Hash: 0a5679ba6ba2650c9e3ea5fc73ba5e59a362417649e7246b01a3ef1b0626b134
Instruction Fuzzy Hash: BEF0C201F1E9C91FE79AA33C18662B8AE92DF9A551B8941FAD00CC72D7DD4C5C4B8391

Function 00007FF848F62709 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f099f2270c3f87aa9601179c162e319765bb76fe81fdfa8f09a7ea139770356
Instruction ID: 7f4c60b73ffcc3a354cc9b401dba51ab7fc4be94eb3c870d9fe0ae5a6bcb184f
Opcode Fuzzy Hash: 9f099f2270c3f87aa9601179c162e319765bb76fe81fdfa8f09a7ea139770356
Instruction Fuzzy Hash: FA01F212F0AE4E0FE696EB2C5855678BBC1EF89681B4500FBC00CC7297DE68AC468346

Function 00007FF848F6BCF7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 172f6ecb3077f7f3f2704c700d984abeebbb365d8241143ef35b8dc66b2df24b
Instruction ID: e808111d7d1beb40f41ba49fe45669c3ac7a64732f4f14db8fc996e2e2b86d3c
Opcode Fuzzy Hash: 172f6ecb3077f7f3f2704c700d984abeebbb365d8241143ef35b8dc66b2df24b
Instruction Fuzzy Hash: AF014421B1EE595EF395E27894523F977C2DF86756F4444BAD04EC5183DF6928838340

Function 00007FF848F6D661 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef9ca5d5fcf356a6ef702ff745c772312b34bdb9efc1740a477283a3d38edf27
Instruction ID: 367ef6c78a6260b0fff1d26b41fb2b4dfe3224efcaba45efbb80305fc0a9cfc1
Opcode Fuzzy Hash: ef9ca5d5fcf356a6ef702ff745c772312b34bdb9efc1740a477283a3d38edf27
Instruction Fuzzy Hash: 18015A70618B489FD785DB28C889F657BF0FF99310F4A45AAE489C73A2CB34A844CB51

Function 00007FF848F763F9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6db477f98215ebb54c7bd46ec0ad0dbe8ec5b2541d417e861fa9e6e5cfbaed
Instruction ID: a8dd792b0eea72f40e692d00809c914ae32ede642e64794f9c93b50f24d954dd
Opcode Fuzzy Hash: 3a6db477f98215ebb54c7bd46ec0ad0dbe8ec5b2541d417e861fa9e6e5cfbaed
Instruction Fuzzy Hash: 1001629060E7C95FD753A73884A46647FE19F17201F4E40E6E488CF1A3DD198D9AC762

Function 00007FF848F76471 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea76db6a92b6711b40aa912ffc3ff2bdfe5292b395f0891f711f1c81b8e1b089
Instruction ID: 2156f87a43e36aa529f141d3aeff9643acbdb00b81ca8963c3b7916a14dd0a98
Opcode Fuzzy Hash: ea76db6a92b6711b40aa912ffc3ff2bdfe5292b395f0891f711f1c81b8e1b089
Instruction Fuzzy Hash: 92F02BA2A0EE9B0FFB9E772968A12743B90AF55152F4C00BBD448CA1C6DF1CDC198354

Function 00007FF848F764D9 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b21a659ff6d158edc1ae981b0520b8d224a57df36ae2add42f2306e14fa02817
Instruction ID: 21841eb63215b7708dc0080fac478cf3daa7bfaa089d372ad3f3c714aa15ca46
Opcode Fuzzy Hash: b21a659ff6d158edc1ae981b0520b8d224a57df36ae2add42f2306e14fa02817
Instruction Fuzzy Hash: 86F0BE2140EAC80FF346A76488A5BE03FD0DF4B240F5D00F9D0888E083D71F5886C351

Function 00007FF848F62D35 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b9eba0a5bc05fa4c290983b982f99be2c1c6fceae38a31dba95404be4887f9
Instruction ID: 725307927b966368d6a8de8e69e20dc86f6e96b1c0ba329b8fb6080c832d1c6e
Opcode Fuzzy Hash: 07b9eba0a5bc05fa4c290983b982f99be2c1c6fceae38a31dba95404be4887f9
Instruction Fuzzy Hash: 51F09031A0C6498EEB28AF04AC427F87390EF05390F001136D84E5B592EF35721686CB

Function 00007FF848F72F60 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98fe27544d79cf44739e900c66598b692e2485c5b12e212354b4c912a8bd689f
Instruction ID: 9f24af57a38fe37d36aad8f16e16f30e4b2a284a6b27b936db00da0357d67990
Opcode Fuzzy Hash: 98fe27544d79cf44739e900c66598b692e2485c5b12e212354b4c912a8bd689f
Instruction Fuzzy Hash: 90F03011F1DC4A1FF6E5FA7814A56BC8195EB98784F8440BCD40ED22CBED1C98060218

Function 00007FF848F6885D Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b820e87bfdbf7f435e5e6c498a44684f3ca1e36aa93dd2ff48fe8b74f87538
Instruction ID: 5d929b63be62fd9b0500374c8207a54344ff453c0d8f93c343ca335c89fecb0b
Opcode Fuzzy Hash: 04b820e87bfdbf7f435e5e6c498a44684f3ca1e36aa93dd2ff48fe8b74f87538
Instruction Fuzzy Hash: E1F0B81090E6C50AEB6B6B7888A16A0BF809F0B201F8D10EDC0C98E1D3DA898885C302

Function 00007FF848F73A1C Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd119f6a29775fcc8c532ce3f44ebdf3e6ce60398b6efafdee18f3a8d06623d
Instruction ID: 47383fe4a238cde341da6152f9c6244195c00a8337da808b18f18e73ab289118
Opcode Fuzzy Hash: cfd119f6a29775fcc8c532ce3f44ebdf3e6ce60398b6efafdee18f3a8d06623d
Instruction Fuzzy Hash: 4EE0ED20A1DC8A5EF685FB68445967C55D1EF89681F8400B9D00DCB2D3CF1858419705

Function 00007FF848F75D0D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda43d1b1ae44124cdfff02f7c9759fe5405fbf4e736299c81f537304f92fcd0
Instruction ID: d9146bb27d9a4e464d55821c6b3e094bbb05ea196f0b101c5839a1e0a23ce1d7
Opcode Fuzzy Hash: fda43d1b1ae44124cdfff02f7c9759fe5405fbf4e736299c81f537304f92fcd0
Instruction Fuzzy Hash: D1E04620A0C84A6EFA94B738448A6BC1282AFA9396F540D76D80DC62C3CE5DB4862219

Function 00007FF848F65410 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e37b0f502d292361582c3c9a1ed32c6420e824e42dddc874d86149e289d8b47
Instruction ID: d1d11fe5857c64e827d2720fd630c2985c97dae76dd98072f9dd63e92d6d5742
Opcode Fuzzy Hash: 3e37b0f502d292361582c3c9a1ed32c6420e824e42dddc874d86149e289d8b47
Instruction Fuzzy Hash: D5E04F2060DB898FD746AB2894545147BF09F27341B9A00E2D088CB1A3D914AC458321

Function 00007FF848F64B39 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d058f2c15ca7834420a976f7d4adcf7f3e98927803b1e0e62e1e598fec1edc5
Instruction ID: 891e9b4a0d4549362be708e058ce62985767c0dad598c32f677fbee85b8c4140
Opcode Fuzzy Hash: 3d058f2c15ca7834420a976f7d4adcf7f3e98927803b1e0e62e1e598fec1edc5
Instruction Fuzzy Hash: 0CE08C60A0DA8C8FDB4AEB2894145147FF0DF27340B9A01E3D088CF2A3D9249C888322

Function 00007FF848F6BF69 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6e0258d1b3e3930e1fb342c77b36bd880991a23e1913f884ca11d705805959
Instruction ID: 85951df9ab3a649946e7aa3c6fcdff40be5c32f508d7d3f6ab8f46c2a853917c
Opcode Fuzzy Hash: 2e6e0258d1b3e3930e1fb342c77b36bd880991a23e1913f884ca11d705805959
Instruction Fuzzy Hash: 62D05E21F2DC4B1FE6D8BB7C186527801C5FBAD685F4442BE810FDA2CFED68180A0204

Function 00007FF848F6F2FE Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f7915539563e3986627efc9e11c64d019b50eb0f7c62a47b9f6468f01e6913
Instruction ID: 66d2e85c35f52e8de54d8b9fa22b7d18454aa226484e26f52bb088487ea5faf3
Opcode Fuzzy Hash: a7f7915539563e3986627efc9e11c64d019b50eb0f7c62a47b9f6468f01e6913
Instruction Fuzzy Hash: 39D01721E1D94B6FE6C8BA3824A667859D1EF58AC6F844178980ED62CBEE58680A0215

Function 00007FF848F60A6D Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e84c1f006d8f522914755ae2a1445a48260648601e1931b7e810b9766398fd31
Instruction ID: d9f7135338359cc4f739a62a0f04a3eda8fa0c7b46178e72b68acc246206b9da
Opcode Fuzzy Hash: e84c1f006d8f522914755ae2a1445a48260648601e1931b7e810b9766398fd31
Instruction Fuzzy Hash: 0AD0A75074A94C4FCB46A31A94401282B90DF9A24175900B3D04CCF253CA589C45C321

Function 00007FF848F676E5 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eb1d8e5dffc00e0c6d13a4bfd8ebbad64323f0c9785c1ce571827330763b2e4
Instruction ID: 114e8aeb00cb10c63dffa9e17455714443b01db3cf368aefd168f4a21e884005
Opcode Fuzzy Hash: 8eb1d8e5dffc00e0c6d13a4bfd8ebbad64323f0c9785c1ce571827330763b2e4
Instruction Fuzzy Hash: 32D0928284F7C60FD71726742D662547F309F53291F8B01D7D484CE0E3E84E0AAA8363

Function 00007FF848F66875 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3949d29665725270e01a7f37418a181106144e66e97909db046f27f01647a872
Instruction ID: adc49aff4769bde0e7a1253d1f99a06d559a2fabd9f8f0e7ad9c15347cc53ac1
Opcode Fuzzy Hash: 3949d29665725270e01a7f37418a181106144e66e97909db046f27f01647a872
Instruction Fuzzy Hash: 48E0489188F3D51ECB1363791D256947F319F67250F8E41EBC188CA1E3E88A496A8322

Non-executed Functions

Function 00007FF848F69557 Relevance: 13.0, Strings: 10, Instructions: 455COMMON

Download Yara Rule

Strings

hzH, xrefs: 00007FF848F697E8
XzH, xrefs: 00007FF848F697C0
hyH, xrefs: 00007FF848F69568
zH, xrefs: 00007FF848F69928
xzH, xrefs: 00007FF848F69810
HzH, xrefs: 00007FF848F69798
8zH, xrefs: 00007FF848F69770
xyH, xrefs: 00007FF848F69590
(zH, xrefs: 00007FF848F69748
yH, xrefs: 00007FF848F696A8

Memory Dump Source

Source File: 0000000C.00000002.3512126752.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f60000_PSI-CONF.jbxd

Similarity

API ID:
String ID: (zH$8zH$HzH$XzH$hyH$hzH$xyH$xzH$yH$zH
API String ID: 0-2254922799
Opcode ID: c12ec79271517e4892de18c94b4cfff3015b38be0b18fdb1ff86b5318636b1a3
Instruction ID: ef7cf2780d633ac07ea4371cdfcbf9754452891e2f7a924aea8a7eb9b06c7cb4
Opcode Fuzzy Hash: c12ec79271517e4892de18c94b4cfff3015b38be0b18fdb1ff86b5318636b1a3
Instruction Fuzzy Hash: DAD14C41F1DD5A5FEBCABB7814A627C94D2EF88686F8051BCE00ED72CBEF1C59064219

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{2980290e-e66e-1341-aacb-9a72a3cc8330}\slabvcp.cat VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PCID1081818.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PCID1081818.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\PCID2313106.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\PCID2313106.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\PCID2313449.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313449\PCID2313449.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\PCID2313533.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313533\PCID2313533.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\PCID2313559.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313559\PCID2313559.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\PCID2313643.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313643\PCID2313643.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\PCID2313656.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313656\PCID2313656.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\PCID2313669.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313669\PCID2313669.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\PCID2702184.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702184\PCID2702184.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\PCID2702863.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702863\PCID2702863.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\PCID2702878.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2702878\PCID2702878.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\PCID2708517.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2708517\PCID2708517.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901540\PCID2901540.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\PCID2901541.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2901541\PCID2901541.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2904909\PCID2904909.dll VolumeInformation
Source: C:\Program Files (x86)\Phoenix Contact\PSI-CONF\PSI-CONF.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PSI-CONF_Setup_v2.76.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\DriverUninstaller.exe

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\slabvcp.cat

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\slabvcp.inf

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\WdfCoInstaller01009.dll

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabenm.sys

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x64\silabser.sys

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\WdfCoInstaller01009.dll

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabenm.sys

C:\Program Files (x86)\Phoenix Contact\Drivers\USB to UART Interface\x86\silabser.sys

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\BugReportCreator.exe

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\ICSharpCode.SharpZipLib.dll

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\BugReportGenerator\de\BugReportCreator.resources.dll

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\ModbusLib.dll

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PCID1081818.dll

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\PhoenixResourceManager.dll

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\de\PCID1081818.resources.dll

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID1081818\modbconf.xml

C:\Program Files (x86)\Phoenix Contact\PSI-CONF\Devices\PCID2313106\Firmware\Device\psiprog-1.57.exe

Windows Analysis Report
PSI-CONF_Setup_v2.76.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre