24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 6b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T489,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Yogi.Generic Sample dfa93b74300d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample dfa93b74300d…. Malware family: Yogi.Generic. Threat score 100/100. 5/27 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22","keywords":["Malicious","Yogi.Generic","malware analysis","sandbox report","threat intelligence","dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22"],"about":{"@type":"SoftwareApplication","name":"default.dat.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Yogi.Generic","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tf36,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00001144.00000000.161636.8CDD0000.00000004.mdmp, 00000000-00001144.00000000.161636.A6FF0000.00000004.mdmp, 00000000-00001144.00000001.161814.8CDD0000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00001144.00000000.161636.8CDD0000.00000004.mdmp, 00000000-00001144.00000001.161814.8CDD0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00001144.00000000.161636.8CDD0000.00000004.mdmp, 00000000-00001144.00000000.161636.A6FF0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00001144.00000000.161636.8CDD0000.00000004.mdmp, 00000000-00001144.00000001.161814.8CDD0000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" (Source: "00000000-00001144.00000000.161636.A6FF0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" (Source: "00000000-00001144.00000000.161636.A6FF0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\" (Source: "00000000-00001144.00000000.161636.A6FF0000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00001144.00000000.161636.A6FF0000.00000004.mdmp") Found string "ile:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00001144.00000000.161636.A8AC0000.00000004.mdmp") Found string "Verb attribute is equivalent to the verbName parameter of System.Management.Automation.CmdletAttribute constructor." (Source: "00000000-00001144.00000001.161814.9EEF0000.00000004.mdmp") Found string "Noun attribute is equivalent to the nounName parameter of System.Management.Automation.CmdletAttribute constructor." (Source: "00000000-00001144.00000001.161814.9EEF0000.00000004.mdmp") Found string "ConfirmImpact attribute is equivalent to the ConfirmImpact property of System.Management.Automation.CmdletAttribute." (Source: "00000000-00001144.00000001.161814.9EEF0000.00000004.mdmp") Found string "Presence of the ConfirmImpact attribute is equivalent to setting to true the SupportsShouldProcess property of System.Management.Automation.CmdletAttribute." (Source: "00000000-00001144.00000001.161814.9EEF0000.00000004.mdmp") Found string "HelpUri attribute is equivalent to the HelpUri property of System.Management.Automation.CmdletAttribute" (Source: "00000000-00001144.00000001.161814.9EEF0000.00000004.mdmp") Found string "ETSType attribute is equivalent to System.Management.Automation.PSTypeNameAttribute." (Source: "00000000-00001144.00000001.161814.9EEF0000.00000004.mdmp") Found string "" (Source: "00000000-00001144.00000001.161814.9EEF0000.00000004.mdmp") file/memory contains long string(Source: "00000000-00001144.00000001.161814.9EEF0000.00000004.mdmp") Found string "if ($__cmdletization_objectModelWrapper -is [System.Management.Automation.IDynamicParameters])" (Source: "00000000-00001144.00000001.161814.9EEF0000.00000004.mdmp") Found string "([System.Management.Automation.IDynamicParameters]$__cmdletization_objectModelWrapper).GetDynamicParameters()" (Source: "00000000-00001144.00000001.161814.9EEF0000.00000004.mdmp")26:T578,file/memory contains long string(File: "_lzma.pyd") file/memory contains long string(File: "_bz2.pyd") Found string "system.io.compression" (Source: "00000000-00001144.00000000.161636.006B0000.00000004.mdmp, 00000000-00001144.00000000.161636.006C0000.00000004.mdmp") Found string "compressionmode" (Source: "00000000-00001144.00000000.161636.006B0000.00000004.mdmp") Found string "decompressionmethods" (Source: "00000000-00001144.00000000.161636.006B0000.00000004.mdmp") Found string "compressionlevel" (Source: "00000000-00001144.00000000.161636.006B0000.00000004.mdmp") Found string "compressionstrategy" (Source: "00000000-00001144.00000000.161636.006B0000.00000004.mdmp") Found string "compressionmethod" (Source: "00000000-00001144.00000000.161636.006B0000.00000004.mdmp") Found string "compressiontracingswitchlevel" (Source: "00000000-00001144.00000000.161636.006C0000.00000004.mdmp") Found string "compressiontracingswitch" (Source: "00000000-00001144.00000000.161636.006C0000.00000004.mdmp") Found string "system.io.compression" (Source: "00000000-00001448.00000000.162194.006E0000.00000004.mdmp, 00000000-00001448.00000001.162395.006C0000.00000004.mdmp") Found string "compressiontracingswitchlevel" (Source: "00000000-00001448.00000000.162194.006E0000.00000004.mdmp") Found string "compressiontracingswitch" (Source: "00000000-00001448.00000000.162194.006E0000.00000004.mdmp")27:T616,Found reference to API "Tcl_CreateThread" (Indicator: "CreateThread"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp")28:T1137,Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""" (Indicator: "add-mppreference"; Source: "00000000-00003216-00000C46-15249286512") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath '%PUBLIC%\Videos\huxepihi'""" (Indicator: "add-mppreference"; Source: "00000000-00003216-00000C46-37447847674") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\""" (Indicator: "add-mppreference"; Source: "00000000-00003216-00000C46-59057113528") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""" (Indicator: "add-mppreference"; Source: "00000000-00003216-00000C46-80138152522") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""" (Indicator: "add-mppreference"; Source: "00000000-00003216-00000C46-102304521236") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""" (Indicator: "add-mppreference"; Source: "00000000-00003216-00000C46-123954714892") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""" (Indicator: "add-mppreference"; Source: "00000000-00003216-00000C46-145775540086") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""" (Indicator: "add-mppreference"; Source: "00000000-00003216-00000C46-167493805104") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"" (Indicator: "add-mppreference"; Source: "00000000-00007616-00000C46-1588088598") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath '%PUBLIC%\Videos\huxepihi'"" (Indicator: "add-mppreference"; Source: "00000000-00007888-00000C46-1356447456") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\"" (Indicator: "add-mppreference"; Source: "00000000-00002988-00000C46-1434778804"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"" (Indicator: "add-mppreference"; Source: "00000000-00000720-00000C46-1420204082"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"" (Indicator: "add-mppreference"; Source: "00000000-00003416-00000C46-1384286884"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"" (Indicator: "add-mppreference"; Source: "00000000-00005124-00000C46-1791966342"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"" (Indicator: "add-mppreference"; Source: "00000000-00008092-00000C46-1451540916"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"" (Indicator: "add-mppreference"; Source: "00000000-00000676-00000C46-1510178018"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath '%PUBLIC%\Videos\huxepihi'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\HAPUBWS\AppData\Local\Temp'"" (Indicator: "add-mppreference"; Source: "00000000-00001144.00000000.161636.8CDD0000.00000004.mdmp 00000000-00001144.00000001.161814.8CDD0000.00000004.mdmp")29:T9e1,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp")2a:T57b,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001144.00000000.161636.4EB08000.00000002.mdmp")2b:T7dc,file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "SHA384"; File: "_bz2.pyd") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_wmi.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "select.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_uuid.pyd") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003572-00000BC0-1467321793") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to "HMAC_CTX_copy" (Indicator: "HMAC"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to "HMAC_CTX_get_md" (Indicator: "HMAC"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to "PKCS5_PBKDF2_HMAC" (Indicator: "HMAC"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22.bin") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00001144.00000000.161636.A6FF0000.00000004.mdmp, 00000000-00001144.00000001.161814.A6FF0000.00000004.mdmp")2c:T86d,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\PROGID") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\PROGID") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\INTERNATIONAL") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\INTERNATIONAL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.3.0.MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.RESOURCES_EN-US_31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.3.0.MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.RESOURCES_EN-US_31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.CONFIGURATION__B03F5F7F11D50A3A") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.CONFIGURATION__B03F5F7F11D50A3A") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32")2d:Ta71,"