24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 5a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T42f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 0f1124fbf549… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0f1124fbf549…. Threat score 100/100. 0/25 AV engines flagged this file. 1 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0f1124fbf54963be3772aaecce3e607f8783ddfe4bc9299d4b9bf677b076cd33","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","0f1124fbf54963be3772aaecce3e607f8783ddfe4bc9299d4b9bf677b076cd33"],"about":{"@type":"SoftwareApplication","name":"GoblinNest.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"0f1124fbf54963be3772aaecce3e607f8783ddfe4bc9299d4b9bf677b076cd33","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T41a,Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "GoblinNest.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "GoblinNest.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "GoblinNest.exe") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "GoblinNest.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp, 00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp, 00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp")26:Tb08,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "GoblinNest.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "GoblinNest.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "GoblinNest.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "GoblinNest.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "GoblinNest.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "GoblinNest.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "GoblinNest.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "GoblinNest.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "GoblinNest.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "GoblinNest.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp, 00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp, 00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp, 00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp, 00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp")27:T588,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "GoblinNest.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "GoblinNest.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "GoblinNest.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "GoblinNest.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "GoblinNest.exe") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "GoblinNest.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp, 00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp, 00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp, 00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp")28:T401,Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to "PBKDF2-HMAC-SHA512" (Indicator: "HMAC"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to "PBKDF2-HMAC-SHA512" (Indicator: "SHA512"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to "HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to "HMAC-SHA512" (Indicator: "HMAC"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to "HMAC-SHA512" (Indicator: "SHA512"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to "HMAC: can only be used with a block-based hash function" (Indicator: "HMAC"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to "HMAC(" (Indicator: "HMAC"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp")29:T766,"GoblinNest.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{056440FD-8568-48E7-A632-72157243B55B}\PROGID") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{056440FD-8568-48E7-A632-72157243B55B}\PROGID") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{056440FD-8568-48E7-A632-72157243B55B}\PROGID") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{056440FD-8568-48E7-A632-72157243B55B}\PROGID") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\DIRECTUI\DYNAMICSCALING") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\DIRECTUI") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\FLIGHTEDFEATURES") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\FLIGHTEDFEATURES") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "GoblinNest.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS") "GoblinNest.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}")2a:T1242,Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "GoblinNest.exe") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "GoblinNest.exe") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; File: "GoblinNest.exe") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "NCryptFreeObject" (Indicator: "NCryptFreeObject"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "NCryptVerifySignature" (Indicator: "NCryptVerifySignature"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "NCryptSignHash" (Indicator: "NCryptSignHash"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptResolveProviders" (Indicator: "BCryptResolveProviders"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptVerifySignature" (Indicator: "BCryptVerifySignature"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptSignHash" (Indicator: "BCryptSignHash"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptFreeBuffer" (Indicator: "BCryptFreeBuffer"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp")2b:T545,Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "BCryptGenerateKeyPair" (Indicator: "BCryptGenerateKeyPair"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "BCryptImportKeyPair" (Indicator: "BCryptImportKey"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp")2c:T4d3,Found string "EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found string "Groove Private Key Store Error: The OID (ASN.1 Object Identifier) for the following algorithm is unknown: "%s"." (Indicator: "private key"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found string "Groove Private Key Store Error: The following cryptographic algorithm of type "%s" is not supported: "%s"." (Indicator: "private key"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found string "Groove Private Key Store Error: The following OID (ASN.1 Object Identifier) is unknown: "%s"." (Indicator: "private key"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") file/memory contains long string with (Indicator: "private key"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found string ": message too long for this public key" (Indicator: "public key"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found string "InvertibleRSAFunction: computational error during private key operation" (Indicator: "private key"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp")2d:T4aa,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains reference to crypto DLLs Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption2e:T4ec,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "GoblinNest.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "GoblinNest.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "GoblinNest.exe") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "GoblinNest.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp")2f:T40c,Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "GoblinNest.exe") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "GoblinNest.exe") Found reference to API "EnumTimeFormatsEx" (Indicator: "EnumTimeFormats"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "EnumDateFormatsExEx" (Indicator: "EnumDateFormats"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "EnumTimeFormatsW" (Indicator: "EnumTimeFormats"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "EnumDateFormatsExW" (Indicator: "EnumDateFormats"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp")30:T55f,Found system information discovery API: "GetSystemInfo" in file "GoblinNest.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "GoblinNest.exe" Found system information discovery API: "ExpandEnvironmentStringsW" in file "GoblinNest.exe" Found system information discovery API: "GetNativeSystemInfo" in file "GoblinNest.exe" Found system information discovery API: "GetMonitorInfoW" in file "GoblinNest.exe" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp, 00000000-00001172.00000000.201220.4C737000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00001172.00000000.201220.4C737000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00001172.00000000.201220.4C737000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00001172.00000000.201220.4C737000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00001172.00000000.201220.4C737000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00001172.00000000.201220.4C737000.00000002.mdmp"31:T5b8,Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "GoblinNest.exe") Found reference to API "FindWindowExA" (Indicator: "findwindow"; File: "GoblinNest.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "GoblinNest.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "GoblinNest.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "GoblinNest.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "GoblinNest.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp, 00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp, 00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "InSendMessageEx" (Indicator: "sendmessage"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp")32:T22aa,"GoblinNest.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001172) "GoblinNest.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001172) "GoblinNest.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000bc2c9e54fb7f00002dfc118984cd000069ee6c68fb7f00006085ef507100000003a33068fb7f00006085ef507100000000000000000000000d0000000000000000009f52fb7f0000c012a552fb7f0000c4a0a452fb7f00001845b052fb7f00000d000000000000001845b052fb7f000000000000000000001000000000000000d9a0a452fb7f00000000000000000000c0772f5c6a020000f8772f5c6a02000028b3b052fb7f0000304f6d68fb7f0000239f3168fb7f0000b08ead64fb7f000020746a68fb7f00000000a664fb7f0000000000000000000001000000000000003f97a452fb7f0000000000000000000000000000000000005045b052 (UID: 00000000-00001172) "GoblinNest.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000d862ef50710000009462ef5071000000c0c7c967fb7f00000000000000000000f284a167fb7f000000000000000000000100000000000000ffffffff00000000ec82a167fb7f0000ffffffff00000000100a00000000000070e6f95d6a0200000100000000000000c0c7c967fb7f0000dc52a167fb7f0000b0d60b5c6a020000c0e6f95d6a020000c018fe5d6a020000c0e6f95d6a020000000000000000000053004f0046005400480000000000000001000000fb7f0000000000000000000050eef95d6a0200000100000000000000c018fe5d6a0200000000000001000000e08efa5d6a02000001000000000000003866ef5071000000c018fe5d (UID: 00000000-00001172) "GoblinNest.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000081c705e6a0200009d2a118984cd0000ad2a118984cd00000000000000000000d853ef50710000000080d0507100000003000000000000009c17f4596a0200000054ef50710000003153ef50710000009c466768fb7f0000000000000000000000000000000000000924135484ad00000054ef50710000006060ef5071000000000000000000000000000000000000006603020000000000708a6d5c6a02000001000000000000004600000000000000619e0268fb7f0000000000000000000002000000030000000200000000000000d5c7591e0100000000000000000000009e020000fb7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00001172) "GoblinNest.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030430b5c6a02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0b47767fb7f0000c0b57767fb7f0000c0ae7f67fb7f0000b06a7867fb7f000000b47767fb7f0000b0a47767fb7f0000f0a97f67fb7f000060a57767fb7f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001172) "GoblinNest.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000020ccf964fb7f00000000000000000000060000000000000000000000000000005076ef50710000008091fd4dfb7f00005bcaf964fb7f0000030000000000000006000000000000000600000000000000607aef50710000008091fd4dfb7f000088c4f964fb7f0000000000000000000006000000000000000d0000000000000069ee6c68fb7f000070d5004efb7f0000926cfd4dfb7f00008091fd4dfb7f00000600000000000000000000000000000040080000000000000500000000000000ad6cfd4dfb7f000000000000eb271c0000000000000400bccd0e118984cd000001000000000000000100000000000000543ffd4dfb7f000007000000 (UID: 00000000-00001172) "GoblinNest.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000309cb05200000000e20103000000000048000000000000006039000000000000c0920d5c6a020000a086ef5071000000f03e72606a0200000000000000000000b086ef507100000068c9ae52fb7f0000f03e72606a020000020000000000000000000000000000001f000f00000000008200000000000000a02ba764fb7f00001f000f0000000000000000000000000001001f00000000004ef7ab64fb7f00004a004c000000000090ef1463fb7f0000180000000000000000000000000000000000000000000000d086ef5071000000e086ef507100000001000000710000000000000000000000040000000000000000000000 (UID: 00000000-00001172) "GoblinNest.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000406676606a02000010000000fb7f0000000000006a020000000000000000000025f4ffff2700000009f8cf517100000060facf51710000000a45a167fb7f000060facf5171000000f03175606a020000c06376606a020000c0ba76606a0200000900000000000000b973da60fb7f00000803085c6a0200002900000000000000480000000000000009f8cf51710000000000085c6a02000032896868fb7f0000040c0008000000000e000000fb7f0000f0a9775e6a02000000000000fb7f0000c06376606a020000091fd267fb7f000009000009000000001120000000000000020000026a02000041f9cf517100000000000000 (UID: 00000000-00001172) "GoblinNest.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000026eca40ef9010000c0efcf517100000004000000000000000071a60ef901000009000000000000000300000000000000a740aa64fb7f00000000000000000000f4f3cf517100000064f2cf5171000000010100000000000080da73606a0200000d000000000000000000000000000000000000000000000043003a005c004d0053004f004300610063006800650000000100000000000000300700000000000000000000000000000000000000000000000000000000000000000000000000008743aa64fb7f00003000000000000000f003000000000000f8f2cf517100000004986868fb7f00000000000000000000000000000000000000000000 (UID: 00000000-00001172) "GoblinNest.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000009dfd00000000000002000000000000000000000000000000c015185c6a02000000000000fb7f00000000185c6a020000888876606a0200002400000000000000c8e6cf5171000000a0ec76606a020000f2e7a454fb7f00002e00300034b00000c00c185c6a0200002000000000000000400000000000000060e8cf517100000000000000000000000000000000000000000000000000000000000000000000000400000000000000400000000000000038000000000000000000085c6a02000032896868fb7f000040000000000000000000000000000000380000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00001172) "GoblinNest.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000026eca40ef9010000c0efcf517100000004000000000000002078a60ef90100000e000000000000000300000000000000a740aa64fb7f00000000000000000000f4f3cf517100000064f2cf5171000000010100000000000060eb73606a02000012000000000000000000000000000000000000000000000043003a005c00500072006f006700720061006d002000460069006c0065007300000000000000000000000000000000000000000000000000000000000000000000000000000000008743aa64fb7f00003000000000000000f003000000000000f8f2cf517100000004986868fb7f00000000000000000000000000000000000000000000 (UID: 00000000-00001172) "GoblinNest.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000009dfd00000000000002000000000000000000000000000000c00f185c6a02000000000000fb7f00000000185c6a020000c03573606a0200002400000000000000c8e6cf5171000000a0ec76606a020000f2e7a454fb7f000038003a0034b00000c00c185c6a0200003e00000000000000500000000000000060e8cf517100000000000000000000000000000000000000000000000000000000000000000000000500000000000000500000000000000042000000000000000000085c6a02000032896868fb7f000040000000000000000000000000000000420000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00001172) "GoblinNest.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000026eca40ef9010000c0efcf517100000004000000000000008076a60ef901000014000000000000000300000000000000a740aa64fb7f0000000000000100000000000000ffffffe70af4cf51710000000101000000000000b0c576606a020000180000000000000000000000990e0202990e74000000000043003a005c00500072006f006700720061006d002000460069006c006500730020002800780038003600290000000000f500000000000000000000000000000054ac98ccf93b00000000000000000000ffffffff0000000001000018000000000b0000000000000004986868fb7f0000000000000000000000000000000000009cb6fc5b (UID: 00000000-00001172)33:T5e6,"GoblinNest.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f023000002000000000000008be0ab64fb7f000048433b606a02000001c99d54fb7f0000000000000000000004000000fb7f000000100000fb7f000004000000000000000100000000000000873b3d4cfb7f000000005f616a020000002000000000000000000000000000000100000000000000b098734cfb7f00001b423d4cfb7f00002089734c (UID: 00000000-00001172) "GoblinNest.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000002089734cfb7f0000000000000000000000200000710000009c0000000600000002000000f023000002000000000000008be0ab64fb7f000048433b606a02000001c99d54fb7f0000000000000000000004000000fb7f000000100000fb7f000004000000000000000100000000000000873b3d4cfb7f000000005f61 (UID: 00000000-00001172) "GoblinNest.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f023000002000000000000008be0ab64fb7f000048433b606a02000001c99d54fb7f0000000000000000000004000000fb7f000000100000fb7f000004000000000000000100000000000000873b3d4cfb7f000000005f616a020000002000000000000054c149933c59dd0101000000000000002089734cfb7f000087563d4cfb7f00002089734c (UID: 00000000-00001172) "GoblinNest.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000f0982f68fb7f0000000100000000000000010000000000000000000000000000e80f6960fb7f000001000000000000000f366860fb7f00000000000000000000e80f6960fb7f00000000000000000000deb16968fb7f00000100000000000000ff376860fb7f000000000000000000000000000000000000f00f6960 (UID: 00000000-00001172)34:T8fb,"GoblinNest.exe" called "GetLocaleInfoW" with parameter "2051" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "66567" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "3153" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "22538" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "23562" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "2151" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "66574" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "263185" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "66615" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "1170" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "3152" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "2121" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "2098" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "4191" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "2080" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "65663" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "329732" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "133124" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "265220" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "267268" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "136196" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "331780" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "135172" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "197636" - (UID: 00000000-00001172) "GoblinNest.exe" called "GetLocaleInfoW" with parameter "263172" - (UID: 00000000-00001172)35:T4e9,Found reference to API "FindWindowExA" (Indicator: "FindWindow"; File: "GoblinNest.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "GoblinNest.exe") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "GoblinNest.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "GoblinNest.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp, 00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp")36:T4f3,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "GoblinNest.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "GoblinNest.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "GoblinNest.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "GoblinNest.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "GoblinNest.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp, 00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001172.00000000.201220.41EB8000.00000002.mdmp, 00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp")37:T483,"GoblinNest.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001172) "GoblinNest.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001172) "GoblinNest.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001172) "GoblinNest.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001172) "GoblinNest.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001172) "GoblinNest.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001172) "GoblinNest.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001172) "GoblinNest.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00001172) "GoblinNest.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf (UID: 00000000-00001172) "GoblinNest.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\MICROS~1\Office14\1033\GrooveIntlResource.dll (UID: 00000000-00001172)38:T1d58,"GoblinNest.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter SetCriticalSectionSpinCount (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter DPA_Create (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter DPA_DestroyCallback (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter GrooveChainGetGlobalInterfacePtrAddress (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter GrooveChainCoCreateInstance (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter EnumDateFormatsExEx (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00001172) "GoblinNest.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00001172)39:T21e7,"SOFTWARE\Wow6432Node\Microsoft\VisualStudio\14.0\Setup\VC" in Source: GoblinNest.exe "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice" in Source: GoblinNest.exe "SOFTWARE\Microsoft\Cryptography" in Source: GoblinNest.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00001172.00000000.201220.41EB8000.00000002.mdmp "Software\Microsoft\Input" in Source: 00000000-00001172.00000000.201220.41EB8000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00001172.00000000.201220.41EB8000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00001172.00000000.201220.41EB8000.00000002.mdmp "Software\Microsoft\Office\14.0\Common\LanguageResources" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\14.0\Common\FilesPaths" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Policies" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Classes" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\Namespace" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\Namespace" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\14.0\Groove\InstallRoot" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "HKEY_LOCAL_MACHINE\" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Microsoft\Office\Groove" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Policies\Microsoft\Office\Groove" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Microsoft\Office Server\14.0\Groove\ManagementServer\Development" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Microsoft\Office Server\14.0\Groove" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\14.0" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Groove Networks, Inc.\Groove" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\14.0\Groove\Development" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\14.0\Groove\GFS" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\14.0\Groove" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\14.0\Common\InstallRoot" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Groove.OldData" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "grooveWindowsRegistryRamp:///HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\14.0\Groove%5cManagementServer%5cDevelopment" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "grooveWindowsRegistryRamp:///HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\14.0\Groove" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\Outlook\Addins\" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Internet Explorer\Toolbar\WebBrowser" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Microsoft\Office\Common" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\Common" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Security" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Policies\Microsoft\Security" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Policies\Microsoft\Office\14.0" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Microsoft\Office Test\Special\Perf" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Windows" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Wow6432Node\Microsoft\PCHealth\ErrorReporting\DW\Installed" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\W" in Source: 00000000-00001172.00000000.201220.512F6000.00000004.mdmp "\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{7Z" in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp 00000000-00001172.00000001.203137.5DF00000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp 00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp 00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp "sSoftware\Wow6432" in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp 00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp "Registry\Machine\Software\Classes\SystemFileAssociations\.log" in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{C100BEA3-D33A-4A4B-BF23-BBEF4663D017}" in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp 00000000-00001172.00000000.201220.5E680000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp "y\Machine\Software\Classes\AppID\GoblinNest.exe" in Source: 00000000-00001172.00000000.201220.5E680000.00000004.mdmp 00000000-00001172.00000002.203412.5E680000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{317D06E8-5F24-433D-BDF7-79CE68D8ABC2}" in Source: 00000000-00001172.00000000.201220.5E680000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}" in Source: 00000000-00001172.00000000.201220.5E680000.00000004.mdmp "istry\Machine\Software\Classes\WOW6432Node\CLSID\{FX" in Source: 00000000-00001172.00000000.201220.5E680000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{12" in Source: 00000000-00001172.00000000.201220.5E680000.00000004.mdmp 00000000-00001172.00000002.203412.5E786000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{39" in Source: 00000000-00001172.00000001.203137.60710000.00000004.mdmp "5574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-<" in Source: 00000000-00001172.00000001.203137.60762000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00+" in Source: 00000000-00001172.00000001.203137.60762000.00000004.mdmp "EGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001172.00000001.203137.6079B000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{AD974AE2-E292-4083-A280-0342D68DAF55}\Instance" in Source: 00000000-00001172.00000001.203137.6079B000.00000004.mdmp "Registry\Machine\Software\Classes\.log\OpenWithProgids" in Source: 00000000-00001172.00000001.203137.6079B000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag" in Source: 00000000-00001172.00000001.203137.6081C000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag" in Source: 00000000-00001172.00000001.203137.6081C000.00000004.mdmp3a:T104f,Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit" Process GoblinNest.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" Process GoblinNest.exe created mutex with name "\BaseNamedObjects\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" Process GoblinNest.exe created mutex with name "Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" Process GoblinNest.exe created mutex with name "Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit" Process GoblinNest.exe created mutex with name "Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer" Process GoblinNest.exe created mutex with name "Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer" Process GoblinNest.exe created mutex with name "Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" Process GoblinNest.exe created mutex with name "Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer" Process GoblinNest.exe created mutex with name "Global\C::Users:Gu6lSRv:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer"3b:T25dc,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00001172.00000000.201220.41EB8000.00000002.mdmp "Software\Microsoft\Input" in Source: 00000000-00001172.00000000.201220.41EB8000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00001172.00000000.201220.41EB8000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00001172.00000000.201220.41EB8000.00000002.mdmp "Software\Microsoft\Office\14.0" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Policies\Microsoft\Office\14.0" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Microsoft\Office Test\Special\Perf" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Windows" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Wow6432Node\Microsoft\PCHealth\ErrorReporting\DW\Installed" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\14.0\Common\LanguageResources" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\14.0\Common\FilesPaths" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Policies" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Classes" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\Namespace" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\Namespace" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\14.0\Groove\InstallRoot" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "HKEY_LOCAL_MACHINE\" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Microsoft\Office\Groove" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Policies\Microsoft\Office\Groove" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Microsoft\Office Server\14.0\Groove\ManagementServer\Development" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Microsoft\Office Server\14.0\Groove" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Groove Networks, Inc.\Groove" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\14.0\Groove\Development" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\14.0\Groove\GFS" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\14.0\Groove" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\14.0\Common\InstallRoot" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Groove.OldData" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "grooveWindowsRegistryRamp:///HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\14.0\Groove%5cManagementServer%5cDevelopment" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "grooveWindowsRegistryRamp:///HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\14.0\Groove" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\Outlook\Addins\" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Internet Explorer\Toolbar\WebBrowser" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "SOFTWARE\Microsoft\Office\Common" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Office\Common" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Security" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Policies\Microsoft\Security" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001172.00000000.201220.4C737000.00000002.mdmp "Software\Microsoft\W" in Source: 00000000-00001172.00000000.201220.512F6000.00000004.mdmp "\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{7Z" in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp "Registry\Machine\Software\Classes\SystemFileAssociations\.log" in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{C100BEA3-D33A-4A4B-BF23-BBEF4663D017}" in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001172.00000000.201220.5DF00000.00000004.mdmp "y\Machine\Software\Classes\AppID\GoblinNest.exe" in Source: 00000000-00001172.00000000.201220.5E680000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{317D06E8-5F24-433D-BDF7-79CE68D8ABC2}" in Source: 00000000-00001172.00000000.201220.5E680000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001172.00000000.201220.5E680000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}" in Source: 00000000-00001172.00000000.201220.5E680000.00000004.mdmp "istry\Machine\Software\Classes\WOW6432Node\CLSID\{FX" in Source: 00000000-00001172.00000000.201220.5E680000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{12" in Source: 00000000-00001172.00000000.201220.5E680000.00000004.mdmp "\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{7Z" in Source: 00000000-00001172.00000001.203137.5DF00000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{39" in Source: 00000000-00001172.00000001.203137.60710000.00000004.mdmp "5574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-<" in Source: 00000000-00001172.00000001.203137.60762000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00+" in Source: 00000000-00001172.00000001.203137.60762000.00000004.mdmp "EGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001172.00000001.203137.6079B000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{AD974AE2-E292-4083-A280-0342D68DAF55}\Instance" in Source: 00000000-00001172.00000001.203137.6079B000.00000004.mdmp "Registry\Machine\Software\Classes\.log\OpenWithProgids" in Source: 00000000-00001172.00000001.203137.6079B000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag" in Source: 00000000-00001172.00000001.203137.6081C000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag" in Source: 00000000-00001172.00000001.203137.6081C000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp "y\Machine\Software\Classes\AppID\GoblinNest.exe" in Source: 00000000-00001172.00000002.203412.5E680000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{12" in Source: 00000000-00001172.00000002.203412.5E786000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00001172.00000002.203412.5EC00000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00001172.00000002.203412.5EC00000.00000002.mdmp "Registry\Machine\Software\Classes\SystemFileAssociations\.exe" in Source: 00000000-00001172.00000002.203412.608C2000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001172.00000002.203412.608C2000.00000004.mdmp3c:T1cbf,"GoblinNest.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb41f10000 "GoblinNest.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb64a60000 "GoblinNest.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb64a60000 "GoblinNest.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb64a60000 "GoblinNest.exe" loaded module "KERNEL32" at base 7ffb67900000 "GoblinNest.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb64a60000 "GoblinNest.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb64a60000 "GoblinNest.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb64a60000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb630f0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 7ffb5e600000 "GoblinNest.exe" loaded module "RPCRT4.DLL" at base 7ffb67650000 "GoblinNest.exe" loaded module "KERNEL32.DLL" at base 7ffb67900000 "GoblinNest.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 7ffb42710000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\COMDLG32.DLL" at base 7ffb673d0000 "GoblinNest.exe" loaded module "COMCTL32.DLL" at base 7ffb53660000 "GoblinNest.exe" loaded module "COMCTL32" at base 7ffb53660000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffb653e0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffb674e0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffb65f80000 "GoblinNest.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 7ffb41e60000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 7ffb4dad0000 "GoblinNest.exe" loaded module "NTDLL.DLL" at base 7ffb68660000 "GoblinNest.exe" loaded module "USER32.DLL" at base 7ffb68020000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\DUSER.DLL" at base 7ffb52e70000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\THUMBCACHE.DLL" at base 7ffb4d640000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 7ffb60bd0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ffb4df70000 "GoblinNest.exe" loaded module "MSFTEDIT.DLL" at base 7ffb49050000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.GLOBALIZATION.DLL" at base 7ffb539a0000 "GoblinNest.exe" loaded module "OLE32.DLL" at base 7ffb68420000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffb68420000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffb60d90000 "GoblinNest.exe" loaded module "SHELL32.DLL" at base 7ffb65f80000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\XMLLITE.DLL" at base 7ffb5f580000 "GoblinNest.exe" loaded module "OLEAUT32.DLL" at base 7ffb67770000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\UIAUTOMATIONCORE.DLL" at base 7ffb54770000 "GoblinNest.exe" loaded module "UIAUTOMATIONCORE.DLL" at base 7ffb54770000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 7ffb67770000 "GoblinNest.exe" loaded module "ATLTHUNK.DLL" at base 7ffb46e00000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\STRUCTUREDQUERY.DLL" at base 7ffb52d70000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.SEARCH.DLL" at base 7ffb49370000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 7ffb5b530000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\DRPROV.DLL" at base 7ffb5ae80000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\NTLANMAN.DLL" at base 7ffb57cc0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\DAVCLNT.DLL" at base 7ffb57ca0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffb5fe00000 "GoblinNest.exe" loaded module "CSCAPI.DLL" at base 7ffb57500000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.DLL" at base 7ffb4e870000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffb4f370000 "GoblinNest.exe" loaded module "MSCTF.DLL" at base 7ffb674e0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\ACTXPRXY.DLL" at base 7ffb4bcb0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\DLNASHEXT.DLL" at base 7ffb51200000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\NETWORKEXPLORER.DLL" at base 7ffb571e0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\PLAYTODEVICE.DLL" at base 7ffb41df0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\NETWORKITEMFACTORY.DLL" at base 7ffb56e10000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\DEVDISPITEMPROVIDER.DLL" at base 7ffb51250000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\DTSH.DLL" at base 7ffb56e00000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\FIREWALLAPI.DLL" at base 7ffb63a60000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\WPDSHEXT.DLL" at base 7ffb3f910000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\PORTABLEDEVICEAPI.DLL" at base 7ffb5fa00000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\EHSTORSHELL.DLL" at base 7ffb4ca40000 "GoblinNest.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffb64a60000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffb5b450000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\EHSTORAPI.DLL" at base 7ffb50d60000 "GoblinNest.exe" loaded module "%PROGRAMFILES%\MICROS~1\OFFICE14\GROOVEEX.DLL" at base 7ffb4c3d0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffb59240000 "GoblinNest.exe" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\CULTURES\OFFICE.ODF" at base 26a61780000 "GoblinNest.exe" loaded module "%PROGRAMFILES%\MICROS~1\OFFICE14\1033\GROOVEINTLRESOURCE.DLL" at base 26a625e0000 "GoblinNest.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffb64a60000 "GoblinNest.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffb64a60000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\CSCUI.DLL" at base 7ffb4c2c0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffb594e0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 7ffb5dfc0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\FUNDISC.DLL" at base 7ffb4f830000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\FDPROXY.DLL" at base 7ffb4bdf0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\FDWCN.DLL" at base 7ffb4bdd0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\WCNAPI.DLL" at base 7ffb49f20000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\FDWNET.DLL" at base 7ffb50e10000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7ffb500f0000 "GoblinNest.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffb68020000 "GoblinNest.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffb68020000 "GoblinNest.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffb679e0000 "GoblinNest.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 7ffb4dfc0000 "GoblinNest.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7ffb679000003d:T32db,"GoblinNest.exe" touched "FunctionDiscovery Class" (Path: "HKCU\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}") "GoblinNest.exe" touched "SSDP Provider Class" (Path: "HKCU\CLSID\{145B4335-FE2A-4927-A040-7C35AD3180EF}\TREATAS") "GoblinNest.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{5F6C1BA8-5330-422E-A368-572B244D3F87}\TREATAS") "GoblinNest.exe" touched "WCN-Config Function Discovery Provider Class" (Path: "HKCU\CLSID\{375FF002-DD27-11D9-8F9C-0002B3988E81}\TREATAS") "GoblinNest.exe" touched "WCN Discovery Object" (Path: "HKCU\CLSID\{C100BEA3-D33A-4A4B-BF23-BBEF4663D017}\TREATAS") "GoblinNest.exe" touched "WS Discovery Provider Class" (Path: "HKCU\CLSID\{D3DCB472-7261-43CE-924B-0704BD730D5F}\TREATAS") "GoblinNest.exe" touched "WNet Provider Class" (Path: "HKCU\CLSID\{35B1D3BB-2D4E-4A7C-9AF0-F2F677AF7C30}\TREATAS") "GoblinNest.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS") "GoblinNest.exe" touched "File Open Dialog Legacy" (Path: "HKCU\CLSID\{725F645B-EAED-4FC5-B1C5-D9AD0ACCBA5E}\TREATAS") "GoblinNest.exe" touched "MruLongList" (Path: "HKCU\CLSID\{53BD6B4E-3780-4693-AFC3-7161C2F3EE9C}\TREATAS") "GoblinNest.exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "GoblinNest.exe" touched "Microsoft AutoComplete" (Path: "HKCU\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "GoblinNest.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "GoblinNest.exe" touched "Explorer Browser" (Path: "HKCU\CLSID\{71F96385-DDD6-48D3-A0C1-AE06E8B055FB}\TREATAS") "GoblinNest.exe" touched "Browser Progress Aggregator" (Path: "HKCU\CLSID\{104846AB-42B1-4E38-A80D-136F78C3F258}\TREATAS") "GoblinNest.exe" touched "Explorer Navigation Bar" (Path: "HKCU\CLSID\{056440FD-8568-48E7-A632-72157243B55B}\TREATAS") "GoblinNest.exe" touched "Local Icon Cache" (Path: "HKCU\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}\TREATAS") "GoblinNest.exe" touched "TF_ThreadMgr" (Path: "HKCU\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS") "GoblinNest.exe" touched "TF_DisplayAttributeMgr" (Path: "HKCU\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TREATAS") "GoblinNest.exe" touched "TF_CategoryMgr" (Path: "HKCU\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TREATAS") "GoblinNest.exe" touched "TF_InputProcessorProfiles" (Path: "HKCU\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}\TREATAS") "GoblinNest.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "GoblinNest.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "GoblinNest.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "GoblinNest.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "GoblinNest.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INSTANCE\INITPROPERTYBAG") "GoblinNest.exe" touched "DUI Shell View Frame" (Path: "HKCU\CLSID\{BDE9EE7C-329F-4FCF-BA7A-F8C6E9B4579D}\INSTANCE") "GoblinNest.exe" touched "MruPidlList" (Path: "HKCU\CLSID\{42AEDC87-2188-41FD-B9A3-0C966FEABEC1}\TREATAS") "GoblinNest.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "GoblinNest.exe" touched "CommonLayoutDefinition" (Path: "HKCU\CLSID\{C206F324-BB45-4765-93FF-3BCA7306FF2E}\INSTANCE") "GoblinNest.exe" touched "CommonLayoutModifier" (Path: "HKCU\CLSID\{08D5BFBF-FBCA-4322-9F70-CA9F66F8ED6A}\INSTANCE") "GoblinNest.exe" touched "Itemsview" (Path: "HKCU\CLSID\{1EEB5B5A-06FB-4732-96B3-975C0194EB39}\TREATAS") "GoblinNest.exe" touched "Property System" (Path: "HKCU\CLSID\{B8967F85-58AE-4F46-9FB2-5D7904798F4B}\TREATAS") "GoblinNest.exe" touched "UIAutomation Registrar Class" (Path: "HKCU\CLSID\{6E29FABF-9977-42D1-8D0E-CA7E61AD87E6}\TREATAS") "GoblinNest.exe" touched "Structured Query Helper Class" (Path: "HKCU\CLSID\{934D4698-6A59-48F8-9F29-9FB30670320E}\TREATAS") "GoblinNest.exe" touched "Local Thumbnail Cache" (Path: "HKCU\CLSID\{7EFC002A-071F-4CE7-B265-F4B4263D2FD2}\TREATAS") "GoblinNest.exe" touched "Shell Automation Folder View" (Path: "HKCU\CLSID\{62112AA1-EBE4-11CF-A5FB-0020AFE7292D}\INSTANCE") "GoblinNest.exe" touched "ShellTravelLog" (Path: "HKCU\CLSID\{D58960BA-2EF3-4910-9E34-C911B1710180}\TREATAS") "GoblinNest.exe" touched "Shell Name Space ListView" (Path: "HKCU\CLSID\{AE054212-3535-4430-83ED-D501AA6680E6}\TREATAS") "GoblinNest.exe" touched "Home Folder" (Path: "HKCU\CLSID\{679F85CB-0220-4080-B29B-5540CC05AAB6}\SHELLFOLDER") "GoblinNest.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "GoblinNest.exe" touched "Updatable Item Set" (Path: "HKCU\CLSID\{AD974AE2-E292-4083-A280-0342D68DAF55}\INSTANCE") "GoblinNest.exe" touched "FormatForDisplay Helper" (Path: "HKCU\CLSID\{82C588E7-E54B-408C-9F8C-6AF9ADF6F1E9}\TREATAS") "GoblinNest.exe" touched "BandProxy" (Path: "HKCU\CLSID\{F61FFEC1-754F-11D0-80CA-00AA005B4383}\TREATAS") "GoblinNest.exe" touched "MRU AutoComplete List" (Path: "HKCU\CLSID\{6756A641-DE71-11D0-831B-00AA005B4383}\TREATAS") "GoblinNest.exe" touched "Background Task Scheduler" (Path: "HKCU\CLSID\{603D3800-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "GoblinNest.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\INSTANCE") "GoblinNest.exe" touched "Property Store over folder final" (Path: "HKCU\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\PROGID") "GoblinNest.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\PROGID") "GoblinNest.exe" touched "Command Folder" (Path: "HKCU\CLSID\{437FF9C0-A07F-4FA0-AF80-84B6C6440A16}\SHELLFOLDER") "GoblinNest.exe" touched "Explorer command store" (Path: "HKCU\CLSID\{F5A8B627-4D46-4D65-92F3-73626AE31971}\TREATAS") "GoblinNest.exe" touched "DLNA Media Servers Data Source" (Path: "HKCU\CLSID\{289AF617-1CC3-42A6-926C-E6A863F0E3BA}\SHELLFOLDER") "GoblinNest.exe" touched "Portable Devices" (Path: "HKCU\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\SHELLFOLDER") "GoblinNest.exe" touched "PortableDeviceManager Class" (Path: "HKCU\CLSID\{0AF10CEC-2ECD-4B92-9581-34F6AE0637F3}\TREATAS") "GoblinNest.exe" touched "Enhanced Storage Data Source" (Path: "HKCU\CLSID\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\SHELLFOLDER") "GoblinNest.exe" touched "EnumEnhancedStorageACT Class" (Path: "HKCU\CLSID\{FE841493-835C-4FA3-B6CC-B4B2D4719848}\TREATAS") "GoblinNest.exe" touched "delegate folder that appears in Computer" (Path: "HKCU\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\SHELLFOLDER") "GoblinNest.exe" touched "CLSID_ConditionAttribute" (Path: "HKCU\CLSID\{18907F3B-9AFB-4F87-B764-F9A4E16A21B8}\PROGID") "GoblinNest.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE") "GoblinNest.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "GoblinNest.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "GoblinNest.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "GoblinNest.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "GoblinNest.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "GoblinNest.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "GoblinNest.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "GoblinNest.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "GoblinNest.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "GoblinNest.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "GoblinNest.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "GoblinNest.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "GoblinNest.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "GoblinNest.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "GoblinNest.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "GoblinNest.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "GoblinNest.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "GoblinNest.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "GoblinNest.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "GoblinNest.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "GoblinNest.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "GoblinNest.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "GoblinNest.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "GoblinNest.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "GoblinNest.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "GoblinNest.exe" touched "Network Item Factory" (Path: "HKCU\CLSID\{41937347-2ABA-4D4C-A4CA-6FE4F11F1BAC}\INSTANCE") "GoblinNest.exe" touched "Detection And Sharing" (Path: "HKCU\CLSID\{1FDA955B-61FF-11DA-978C-0008744FAAB7}\TREATAS") "GoblinNest.exe" touched "HNetCfg.FwPolicy2" (Path: "HKCU\CLSID\{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}\TREATAS") "GoblinNest.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "GoblinNest.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "GoblinNest.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "GoblinNest.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "GoblinNest.exe" touched "Add Network Place" (Path: "HKCU\CLSID\{D4480A50-BA28-11D1-8E75-00C04FA31A86}\SHELLFOLDER") "GoblinNest.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{B77B1CBF-E827-44A9-A33A-6CCFEEAA142A}\TREATAS") "GoblinNest.exe" touched "Sync root make available online verb" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0CA2640D-5B9C-4C59-A5FB-2DA61A7437CF}\INPROCSERVER32") "GoblinNest.exe" touched "Enhanced Storage Icon Overlay Handler Class" (Path: "HKCU\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\INSTANCE") "GoblinNest.exe" touched "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" (Path: "HKCU\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\INSTANCE") "GoblinNest.exe" touched "Groove Explorer Icon Overlay 2 (GFS Stub)" (Path: "HKCU\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\INSTANCE") "GoblinNest.exe" touched "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" (Path: "HKCU\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\INSTANCE") "GoblinNest.exe" touched "Groove Explorer Icon Overlay 3 (GFS Folder)" (Path: "HKCU\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\INSTANCE") "GoblinNest.exe" touched "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" (Path: "HKCU\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\INSTANCE") "GoblinNest.exe" touched "PSOAInterface" (Path: "HKCU\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "GoblinNest.exe" touched "Frequent Places Folder" (Path: "HKCU\CLSID\{3936E9E4-D92C-4EEE-A85A-BC16D5EA0819}\SHELLFOLDER") "GoblinNest.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "GoblinNest.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS")3e:T970,"GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES-VALENCIA") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES-VALENCIA") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: "00010407") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DE-DE") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DE-DE") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DZ-BT") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DZ-BT") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-419") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-419") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-CU") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-CU") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FF-LATN-SN") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FF-LATN-SN") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: "0001040E") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "HU-HU") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "HU-HU") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: "00040411") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "GoblinNest.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: "00010437")3f:T563,"GoblinNest.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}"; Key: ""; Value: "") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}"; Key: ""; Value: "") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}\TREATAS"; Key: ""; Value: "") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}\TREATAS"; Key: ""; Value: "") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}\INPROCSERVER32"; Key: ""; Value: "") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}\INPROCSERVER32"; Key: ""; Value: "") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}\INPROCHANDLER32"; Key: ""; Value: "") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}\INPROCHANDLER32"; Key: ""; Value: "") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}\INPROCHANDLER"; Key: ""; Value: "") "GoblinNest.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}\INPROCHANDLER"; Key: ""; Value: "")40:T931,"GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}"; Key: ""; Value: "") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}\INPROCSERVER32"; Key: ""; Value: "") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}"; Key: "APPID"; Value: "") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "480217A9-F824-4BD4-BBE8-F371CAAF9A0D"; Value: "") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "9DB0FDB5-3B21-440E-A94B-63738A4BE5DE"; Value: "") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C72BE2EC-8E90-452C-B29A-AB8FF1C071FC}\PROGID"; Key: ""; Value: "") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{145B4335-FE2A-4927-A040-7C35AD3180EF}"; Key: ""; Value: "") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{145B4335-FE2A-4927-A040-7C35AD3180EF}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{145B4335-FE2A-4927-A040-7C35AD3180EF}\INPROCSERVER32"; Key: ""; Value: "") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{145B4335-FE2A-4927-A040-7C35AD3180EF}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{DCDE394F-1478-4813-A402-F6FB10657222}\PROXYSTUBCLSID32"; Key: ""; Value: "") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5F6C1BA8-5330-422E-A368-572B244D3F87}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "GoblinNest.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5F6C1BA8-5330-422E-A368-572B244D3F87}\INPROCSERVER32"; Key: ""; Value: "")41:T40b,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Able to detect virtual machine (string) Matched sigs: Able to identify sandbox environment running process Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to detect sandbox (imports API)42:T633,"GoblinNest.exe" trying to access non-existent file "C:\WININET.DLL" "GoblinNest.exe" trying to access non-existent file "C:\WININET.dll" "GoblinNest.exe" trying to access non-existent file "C:\D3D11.DLL" "GoblinNest.exe" trying to access non-existent file "C:\d3d11.dll" "GoblinNest.exe" trying to access non-existent file "C:\WINMM.DLL" "GoblinNest.exe" trying to access non-existent file "C:\WINMM.dll" "GoblinNest.exe" trying to access non-existent file "C:\DXGI.DLL" "GoblinNest.exe" trying to access non-existent file "C:\DBGHELP.DLL" "GoblinNest.exe" trying to access non-existent file "C:\dbghelp.dll" "GoblinNest.exe" trying to access non-existent file "C:\VERSION.DLL" "GoblinNest.exe" trying to access non-existent file "C:\VERSION.dll" "GoblinNest.exe" trying to access non-existent file "C:\MFPLAT.DLL" "GoblinNest.exe" trying to access non-existent file "C:\MFPlat.DLL" "GoblinNest.exe" trying to access non-existent file "C:\MF.DLL" "GoblinNest.exe" trying to access non-existent file "C:\MF.dll" "GoblinNest.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "GoblinNest.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "GoblinNest.exe" trying to access non-existent file "C:\WINMMBASE.dll" "GoblinNest.exe" trying to access non-existent file "C:\DWMAPI.DLL" "GoblinNest.exe" trying to access non-existent file "C:\dwmapi.dll" "GoblinNest.exe" trying to access non-existent file "C:\DBGCORE.DLL" "GoblinNest.exe" trying to access non-existent file "C:\dbgcore.DLL" "GoblinNest.exe" trying to access non-existent file "C:\MFCORE.DLL"43:T408,"GoblinNest.exe" trying to access non-existent file "C:\GOBLINNEST.EXE.LOCAL" "GoblinNest.exe" trying to access non-existent file "C:\GoblinNest.exe.Local\" "GoblinNest.exe" trying to access non-existent file "C:\DATA.WIN" "GoblinNest.exe" trying to access non-existent file "C:\Windows\System32\UXTHEME.DLL.CONFIG" "GoblinNest.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Explorer\ICONCACHETODELETE" "GoblinNest.exe" trying to access non-existent file "C:\DESKTOP.INI" "GoblinNest.exe" trying to access non-existent file "C:\MSOCache\DESKTOP.INI" "GoblinNest.exe" trying to access non-existent file "\Device\NamedPipe\DAV RPC SERVICE" "GoblinNest.exe" trying to access non-existent file "PIPE\DAV RPC SERVICE" "GoblinNest.exe" trying to access non-existent file "C:\Users\Gu6lSRv\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDelete" "GoblinNest.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Network Shortcuts\DESKTOP.INI"44:Tbcd,Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "GoblinNest.exe") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "GoblinNest.exe") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; File: "GoblinNest.exe") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "GoblinNest.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "GoblinNest.exe") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "GoblinNest.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "GoblinNest.exe") Found reference to API "InternetOpen" (Indicator: "InternetOpen"; File: "GoblinNest.exe") Found reference to API "InternetConnect" (Indicator: "InternetConnect"; File: "GoblinNest.exe") Found reference to API "HttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "GoblinNest.exe") Found reference to API "HttpSendRequest" (Indicator: "HttpSendRequest"; File: "GoblinNest.exe") Found reference to API "InternetReadFileExA" (Indicator: "InternetReadFile"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "HttpSendRequestExW" (Indicator: "HttpSendRequest"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp")45:T4de,Found reference to API "FindNextUrlCacheEntryW" (Indicator: "FindNextUrlCacheEntry"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "FindFirstUrlCacheEntryW" (Indicator: "FindFirstUrlCacheEntry"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "FindNextUrlCacheEntryA" (Indicator: "FindNextUrlCacheEntry"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "FindFirstUrlCacheEntryA" (Indicator: "FindFirstUrlCacheEntry"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "FindNextUrlCacheEntryExA" (Indicator: "FindNextUrlCacheEntry"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "FindNextUrlCacheEntryExW" (Indicator: "FindNextUrlCacheEntry"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "FindFirstUrlCacheEntryExA" (Indicator: "FindFirstUrlCacheEntry"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "FindFirstUrlCacheEntryExW" (Indicator: "FindFirstUrlCacheEntry"; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp")46:T684,Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "GoblinNest.exe") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "GoblinNest.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "GoblinNest.exe") Found reference to API "gethostname" (Indicator: "gethostname"; File: "GoblinNest.exe") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "GoblinNest.exe") Found reference to API "Specifies that the PenInputPanel object does not accept input.n" (Indicator: " accept "; Source: "00000000-00001172.00000000.201220.41EEA000.00000002.mdmp") Found reference to API "When passed TRUE, the PenInputPanel object attempts to send text to the attached control through the Text Services Framework (TSF) and enables the use of the correction user interface.WW" (Indicator: " send "; Source: "00000000-00001172.00000000.201220.41EEA000.00000002.mdmp") Found reference to API "File System Bind Data" (Indicator: " bind "; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "No more parts in URL bind context." (Indicator: " bind "; Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found reference to API "Can not set property at runtime.rCan't move focus to the control because it is invisible, not enabled, or of a type that does not accept the focus." (Indicator: " accept "; Source: "00000000-00001172.00000002.203412.5EC00000.00000002.mdmp") Found reference to API "and will send the form data without encrypting it for privacy." (Indicator: " send "; Source: "00000000-00001172.00000002.203412.5EC00000.00000002.mdmp")47:T2f1a,Heuristic match: "smfmutwb1@8imfmu.com" Heuristic match: "8imfmuiwb1@8imfmu.co" Heuristic match: "8imfmuiwb1@8imfmu.com" Heuristic match: "sets or retrieves which panel is currently active in the pen input panel.wf" Heuristic match: "specifies the stroke or collection of strokes to remove from the given collection of strokes.ws" Heuristic match: "provides the best tradeoff between save-time and storage for the typical application.ws" Pattern match: "http://schemas.xmlsoap.org/soap/envelope/" Pattern match: "http://schemas.xmlsoap.org/soap/encoding/" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://www.w3.org/2001/xmlschema" Pattern match: "http://components.groove.net/groove/components/systemcomponents/systemcomponents.osd?package=net.groove.groove.systemcomponents.groovesystemresources_rbd&version=0" Pattern match: "http://schemas.xmlsoap.org/soap/encoding/:arraytype" Pattern match: "http://schemas.xmlsoap.org/soap/envelope/:body" Pattern match: "http://www.w3.org/1999/xmlschema-instance" Pattern match: "http://www.w3.org/1999/xmlschema" Pattern match: "http://schemas.xmlsoap.org/soap/envelope/:fault" Pattern match: "http://www.w3.org/1999/xmlschema-instance:type" Pattern match: "http://webservices.groove.net/groove/2.0/gfs/" Pattern match: "http://webservices.groove.net/groove/2.0/accounts/" Pattern match: "http://tempuri.org" Pattern match: "http://www.groove.net/groove/2.0/gfs#deletesession" Pattern match: "http://www.groove.net/groove/2.0/gfs#removechatview" Pattern match: "http://www.groove.net/groove/2.0/gfs#getchatupdate" Pattern match: "http://www.groove.net/groove/2.0/gfs#execchatcommand" Pattern match: "http://www.groove.net/groove/2.0/gfs#addchatentry" Pattern match: "http://www.groove.net/groove/2.0/gfs#showsyncstatus" Pattern match: "http://www.groove.net/groove/2.0/gfs#showproperties" Pattern match: "http://www.groove.net/groove/2.0/gfs#editdownloadsettings" Pattern match: "http://www.groove.net/groove/2.0/gfs#editalertsettings" Pattern match: "http://www.groove.net/groove/2.0/gfs#setupmultiplecomputers" Pattern match: "http://www.groove.net/groove/2.0/gfs#getdownloadstatus" Pattern match: "http://www.groove.net/groove/2.0/gfs#downloadfiles" Pattern match: "http://www.groove.net/groove/2.0/gfs#getmemberlist" Pattern match: "http://www.groove.net/groove/2.0/gfs#removesessionview" Pattern match: "http://www.groove.net/groove/2.0/gfs#addsessionview" Pattern match: "http://www.groove.net/groove/2.0/gfs#getdisplayinfo" Pattern match: "http://www.groove.net/groove/2.0/gfs#getsessioninfo" Pattern match: "http://www.groove.net/groove/2.0/gfs#createsession" Pattern match: "http://webservices.groove.net/groove/2.0/core/" Pattern match: "http://www.groove.net/groove/2.0/account#read2" Pattern match: "http://www.groove.net/groove/2.0/account#read" Pattern match: "http://webservices.groove.net/wsdl/2.0/grooveaccounts.wsdl" Pattern match: "http://%ls%ls" Pattern match: "http://%ls:%d%ls" Heuristic match: "urn:groove.net" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=20&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=19&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=18&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=17&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=16&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=15&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=14,1&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=14&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=13,1&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=13&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=12&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=11&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=10&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=9&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=8&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=7&factory=open" Pattern match: "http://www.groove.net/groove/2.0/local#launchfile" Pattern match: "http://webservices.groove.net/groove/2.0/local#openaddcontact" Pattern match: "http://webservices.groove.net/groove/2.0/local#opentoolproperties" Pattern match: "http://webservices.groove.net/groove/2.0/local#openspaceproperties" Pattern match: "http://www.groove.net/groove/2.0/local#openlicenses" Pattern match: "http://www.groove.net/groove/2.0/local#openaboutgroove" Pattern match: "http://www.groove.net/groove/2.0/local#openaccountsetupwizard" Pattern match: "http://www.groove.net/groove/2.0/local#opencreatespacewizard" Pattern match: "http://www.groove.net/groove/2.0/local#openvcardeditor" Pattern match: "http://www.groove.net/groove/2.0/local#opencontactproperties" Pattern match: "http://www.groove.net/groove/2.0/local#openpreferences" Pattern match: "http://www.groove.net/groove/2.0/local#openmessagehistory" Pattern match: "http://www.groove.net/groove/2.0/local#opencommunicationsmanager" Pattern match: "http://www.groove.net/groove/2.0/local#openlaunchbar" Pattern match: "http://www.groove.net/groove/2.0/local#sendinvitationalert" Pattern match: "http://www.groove.net/groove/2.0/local#sendinvitationtochat" Pattern match: "http://www.groove.net/groove/2.0/local#sendinvitation" Pattern match: "http://www.groove.net/groove/2.0/local#sendinstantmessage" Pattern match: "http://www.groove.net/groove/2.0/local#view" Pattern match: "http://webservices.groove.net/groove/2.0/local/" Pattern match: "http://webservices.groove.net/wsdl/2.0/groovelocal.wsdl" Pattern match: "http://www.groove.net/groove/2.0/contacts#fetch" Pattern match: "http://www.groove.net/groove/2.0/contacts#search" Pattern match: "http://www.groove.net/groove/2.0/contacts#readavailabledirectories" Pattern match: "http://www.groove.net/groove/2.0/contacts#read" Pattern match: "http://www.groove.net/groove/2.0/contacts#create" Pattern match: "http://webservices.groove.net/groove/2.0/contacts/" Pattern match: "http://webservices.groove.net/wsdl/2.0/groovecontacts.wsdl" Pattern match: "http://www.groove.net/groove/2.0/members#exittool" Pattern match: "http://www.groove.net/groove/2.0/members#entertool" Pattern match: "http://www.groove.net/groove/2.0/members#exitspace" Pattern match: "http://www.groove.net/groove/2.0/members#enterspace" Pattern match: "http://www.groove.net/groove/2.0/members#delete" Pattern match: "http://www.groove.net/groove/2.0/members#read" Pattern match: "http://www.groove.net/groove/2.0/members#create" Pattern match: "http://webservices.groove.net/groove/2.0/members/" Pattern match: "http://webservices.groove.net/wsdl/2.0/groovemembers.wsdl" Heuristic match: "1uk .uk" Pattern match: "http://www.virtualbox.org" Pattern match: "http://go.microsoft.com/fwlink/?linkid=215117" Pattern match: "http://go.microsoft.com/fwlink/?linkid=223554" Pattern match: "http://support.microsoft.com/kb/4023057" Pattern match: "http://www.cacetech.com" Pattern match: "http://www.winpcap.org" Pattern match: "http://www.autoitscript.com/autoit3" Pattern match: "https://www.wireshark.org" Pattern match: "https://ask.wireshark.org/" Pattern match: "https://www.wireshark.org/download.html" Pattern match: "http://www.adobe.com/support/main.html" Pattern match: "http://www.adobe.com/products/acrobat/readstep.html" Pattern match: "http://www.adobe.com" Pattern match: "http://java.com/help" Pattern match: "http://java.com" Pattern match: "http://java.sun.com" Pattern match: "https://support.mozilla.org" Pattern match: "https://www.mozilla.org" Pattern match: "https://www.mozilla.org/firefox/64.0/releasenotes" Pattern match: "https://www.msn.com/favicon.ico" Pattern match: "https://npcap.com/#download" Pattern match: "https://npcap.com/" Pattern match: "www.onet[1].xml" Pattern match: "ns.adobe.com/xmp/identi" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://purl.org/dc/elements/1.1/" Pattern match: "http://ns.adobe.com/xap/1.0/" Pattern match: "http://ns.adobe.com/xmp/identifier/qual/1.0/" Pattern match: "http://ns.adobe.com/xap/1.0/rights/" Pattern match: "http://ns.adobe.com/xap/1.0/mm/" Pattern match: "http://ns.adobe.com/xap/1.0/bj/" Pattern match: "http://ns.adobe.com/xap/1.0/t/pg/" Pattern match: "http://ns.adobe.com/pdf/1.3/" Pattern match: "http://ns.adobe.com/photoshop/1.0/" Pattern match: "http://ns.adobe.com/tiff/1.0/" Pattern match: "http://ns.adobe.com/exif/1.0/" Pattern match: "http://ns.adobe.com/xap/1.0/stype/dimensions#" Pattern match: "http://ns.adobe.com/xap/1.0/g/img/" Pattern match: "http://ns.adobe.com/xap/1.0/stype/resourceevent#" Pattern match: "http://ns.adobe.com/xap/1.0/stype/resourceref#" Pattern match: "http://ns.adobe.com/xap/1.0/stype/version#" Pattern match: "http://ns.adobe.com/xap/1.0/stype/job#" Pattern match: "http://ns.adobe.com/exif/1.0/aux/" Pattern match: "http://ns.adobe.com/camera-raw-settings/1.0/" Pattern match: "http://ns.adobe.com/xmp/1.0/dynamicmedia/" Pattern match: "http://iptc.org/std/iptc4xmpcore/1.0/xmlns/" Pattern match: "http://ns.microsoft.com/photo/1.0/" Pattern match: "http://ns.microsoft.com/photo/1.2/" Pattern match: "http://ns.microsoft.com/photo/1.2/t/regioninfo#" Pattern match: "http://ns.microsoft.com/photo/1.2/t/region#" Heuristic match: "gxc.gg" Heuristic match: "api.gxc.gg" Heuristic match: "st.exefmu.com" Heuristic match: "b1@8imfmu.com" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Heuristic match: "bjhjf5wox@gbjhjf.com" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104.&click"48:T2156,Found URL "http://schemas.xmlsoap.org/soap/envelope/accept-languagehttp://schemas.xmlsoap.org/soap/encoding/http://www.w3.org/2001/xmlschema-instancesoap:bodyhttp://www.w3.org/2001/xmlschemapostsoapactioncontent-typesoap:envelopesoap:headertruefalseyyyy-mm-dd't'hh:mm:ss'z'yyyy-mm-dd't'hh:mm:ssselectionlanguagexpathurn:groove.net:cert_accountguid_digest_origrootfolderpath_path_rootfolderpath_sessionid_shareobjectid_shareobjectname_stubfilepath_userguid_watermarkepubkeyepkalgoencryptedkeycsmkeykeyidencalgospubkeyspkalgosigalgourn:groove.net:auth" - Source: "00000000-00001172.00000000.201220.4C737000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001172.00000000.201220.5C080000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00001172.00000000.201220.5DF00000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00001172.00000000.201220.5DF00000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00001172.00000000.201220.5DF00000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00001172.00000000.201220.5DF00000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00001172.00000000.201220.5DF00000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00001172.00000000.201220.5DF00000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00001172.00000000.201220.5DF00000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00001172.00000000.201220.5DF00000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00001172.00000000.201220.5DF00000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00001172.00000000.201220.5DF00000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00001172.00000000.201220.5DF00000.00000004.mdmp") Found URL "https://www.msn.com/favicon.icoc:\windows\system32\cscript.exe!c:\windows\system32\srchadmin.dll" - Source: "00000000-00001172.00000000.201220.5DF00000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00001172.00000000.201220.5DF00000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp") Found URL "https://www.msn.com/favicon.icoc:\windows\system32\cscript.exe!c:\windows\system32\srchadmin.dll" - Source: "00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00001172.00000002.203412.5DFC9000.00000004.mdmp") Found URL "https://npcap.com/