Windows Analysis Report
ikvNEF5d2Z

System process connects to network (likely due to code injection or exploit)

Source: Yara match	File source: 00000002.00000003.321553577.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.267642045.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.274029943.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.261454717.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.269643903.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.297404495.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.292337146.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.277053411.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.269043278.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.396642532.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.264700847.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.280507761.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.267145571.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.298272650.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.311756165.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.265795087.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.264618023.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.319014674.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.295125426.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.314754724.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.270691540.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.270084280.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.273346326.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.317474031.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.304327995.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266413828.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.269326182.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.305135210.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.261968567.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.320094818.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.271220559.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.265620836.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.305936677.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.276312756.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.293963524.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.309363516.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.262421311.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.411869520.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.265218608.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.261647380.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.302975794.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.273106192.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.282267699.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.287602431.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.275791438.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.262765450.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.268258493.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.263740751.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.299841707.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.351326851.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.265359115.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.271492952.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.262406305.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.278543970.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.407235069.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.262811825.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.437622717.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.293411402.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.491241630.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.265793313.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.719810116.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.280994457.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.297638852.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.415117148.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.416746789.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.298094562.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.268018419.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.278246832.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.264969343.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.272087960.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.307033359.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.270822392.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.317906358.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.267338480.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.263723615.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.267270096.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.272354753.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.272644834.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.312571750.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.290176337.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.291011198.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.454332371.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.267942385.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.299224080.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.306791775.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.274845604.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.295599262.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.263807736.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.292690922.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.272047247.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.274007377.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 6576, type: MEMORYSTR

Source: unknown	HTTPS traffic detected: 13.225.235.76:443 -> 192.168.2.3:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.235.76:443 -> 192.168.2.3:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.235.76:443 -> 192.168.2.3:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.235.76:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.235.76:443 -> 192.168.2.3:49730 version: TLS 1.2

Source: ikvNEF5d2Z.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Networking

Source: C:\Windows\System32\rundll32.exe	Network Connect: 13.225.235.76 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: dsedertyhuiokle.top
Source: C:\Windows\System32\rundll32.exe	Domain query: aws.amazon.com

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.3:57421 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.3:56189 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.3:53630 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.3:58716 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.3:52540 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.3:51906 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.3:63030 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.3:58709 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.3:58003 -> 8.8.8.8:53

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.596703814.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.271748761.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.308953752.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.584687079.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.606707113.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.436932747.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.640079577.00000000031F3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540374709.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.688886269.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.664007022.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.485626547.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.561614138.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.571114783.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.516138581.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.444882193.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.598846426.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.260394744.00000000031B1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.444522972.00000000031E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.443202564.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.490685792.00000000031F4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.306595069.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.375560811.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.443054392.00000000031E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.633984491.00000000031D4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.422935988.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.465004777.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559793712.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.550654504.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <a class="lb-txt-none lb-txt-p-chromium lb-none-pad lb-none-v-margin lb-txt" style="padding-right:5px;" href="https://www.facebook.com/amazonwebservices" target="_blank" rel="noopener" title="Facebook"> <i class="icon-facebook"></i></a> equals www.facebook.com (Facebook)
Source: loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.596703814.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.271748761.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.308953752.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.584687079.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.606707113.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.436932747.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.640079577.00000000031F3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540374709.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.688886269.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.664007022.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.485626547.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.561614138.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.571114783.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.516138581.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.444882193.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.598846426.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.260394744.00000000031B1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.444522972.00000000031E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.443202564.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.490685792.00000000031F4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.306595069.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.375560811.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.443054392.00000000031E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.633984491.00000000031D4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.422935988.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.465004777.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559793712.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.550654504.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <a class="lb-txt-none lb-txt-p-chromium lb-none-pad lb-txt" style="padding-right:5px;" href="https://www.youtube.com/user/AmazonWebServices/Cloud/" target="_blank" rel="noopener" title="YouTube"> <i class="icon-youtube"></i></a> equals www.youtube.com (Youtube)
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <meta http-equiv="Content-Security-Policy" content="default-src 'self' data: https://a0.awsstatic.com; connect-src 'self' https://112-tzm-766.mktoresp.com https://112-tzm-766.mktoutil.com https://a0.awsstatic.com https://a0.p.awsstatic.com https://a1.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://amazonwebservicesinc.tt.omtrdc.net https://api.regional-table.region-services.aws.a2z.com https://api.us-west-2.prod.pricing.aws.a2z.com https://aws.amazon.com https://aws.demdex.net https://b0.p.awsstatic.com https://c0.b0.p.awsstatic.com https://calculator.aws https://cm.everesttech.net https://csml-plc-prod.us-west-2.api.aws/plc/csml/logging https://d0.awsstatic.com https://d1.awsstatic.com https://d1fgizr415o1r6.cloudfront.net https://d2c.aws.amazon.com https://d3borx6sfvnesb.cloudfront.net https://dc.ads.linkedin.com https://dftu77xade0tc.cloudfront.net https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://i18n-string.us-west-2.prod.pricing.aws.a2z.com https://prod-us-west-2.csp-report.marketing.aws.dev https://prod.log.shortbread.aws.dev https://prod.tools.shortbread.aws.dev https://s0.awsstatic.com https://s3.amazonaws.com/aws-messaging-pricing-information/ https://s3.amazonaws.com/public-pricing-agc/ https://spot-bid-advisor.s3.amazonaws.com https://target.aws.amazon.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://vs.aws.amazon.com https://wrp.dse.marketing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https://aws.demdex.net https://c0.b0.p.awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://*.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://aws.amazon.com https://aws.demdex.net https://awsmedia.s3.amazonaws.com https://cm.everesttech.net https://d1.awsstatic.com https://d1d1et6laiqoh9.cloudfront.net https://d2908q01vomqb2.cloudfront.net https://d2cpw7vd6a2efr.cloudfront.net https://i equals www.linkedin.com (Linkedin)
Source: loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: et https://d2c.aws.amazon.com https://d3borx6sfvnesb.cloudfront.net https://dc.ads.linkedin.com https://dftu77xade0tc.cloudfront.net https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://i18n-string.us-west-2.prod.pricing.aws.a2z.com https://prod-us-west-2.csp-report.marketing.aws.dev https://prod.log.shortbread.aws.dev https://prod.tools.shortbread.aws.dev https://s0.awsstatic.com https://s3.amazonaws.com/aws-messaging-pricing-information/ https://s3.amazonaws.com/public-pricing-agc/ https://spot-bid-advisor.s3.amazonaws.com https://target.aws.amazon.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://vs.aws.amazon.com https://wrp.dse.marketing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https://aws.demdex.net https://c0.b0.p.awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://*.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://aws.amazon.com https://aws.demdex.net https://awsmedia.s3.amazonaws.com https://cm.everesttech.net https://d1.awsstatic.com https://d1d1et6laiqoh9.cloudfront.net https://d2908q01vomqb2.cloudfront.net https://d2cpw7vd6a2efr.cloudfront.net https://i equals www.linkedin.com (Linkedin)
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: isor.s3.amazonaws.com https://target.aws.amazon.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://vs.aws.amazon.com https://wrp.dse.marketing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https://aws.demdex.net https://c0.b0.p.awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://*.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://aws.amazon.com https://aws.demdex.net https://awsmedia.s3.amazonaws.com https://cm.everesttech.net https://d1.awsstatic.com https://d1d1et6laiqoh9.cloudfront.net https://d2908q01vomqb2.cloudfront.net https://d2cpw7vd6a2efr.cloudfront.net https://d36cz9buwru1tt.cloudfront.net https://docs.aws.amazon.com https://dpm.demdex.net https://fls-na.amazon.com https://g.cn https://google.ac https://google.ad https://google.ae https://google.al https://google.am https://google.as https://google.at https://google.az https://google.ba https://google.be https://google.bf https://google.bg https://google.bi https://google.bj https://google.bs https://google.bt https://google.by https: equals www.linkedin.com (Linkedin)
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: m.do https://google.com.ec https://google.com.eg https://google.com.et https://google.com.fj https://google.com.gh https://google.com.gi https://google.com.gt https://google.com.hk https://google.com.jm https://google.com.kh https://google.com.kw https://google.com.lb https://google.com.lc https://google.com.ly https://google.com.mm https://google.com.mt https://google.com.mx https://google.com.my https://google.com.na https://google.com.nf https://google.com.ng https://google.com.ni https://google.com.np https://google.com.om https://google.com.pa https://google.com.pe https://google.com.pg https://google.com.ph https://google.com.pk https://google.com.pr https://google.com.py https://google.com.qa https://google.com.sa https://google.com.sb https://google.com.sg https://google.com.sl https://google.com.sv https://google.com.tj https://google.com.tr https://google.com.tw https://google.com.ua https://google.com.uy https://google.com.vc https://google.com.vn https://google.cv https://google.cz https://google.de https://google.dj https://google.dk https://google.dm https://google.dz https://google.ee https://google.es https://google.fi https://google.fm https://google.fr https://google.ga https://google.ge https://google.gf https://google.gg https://google.gl https://google.gm https://google.gp https://google.gr https://google.gy https://google.hn https://google.hr https://google.ht https://google.hu https://google.ie https://google.im https://google.io https://google.iq https://google.is https://google.it https://google.je https://google.jo https://google.kg https://google.ki https://google.kz https://google.la https://google.li https://google.lk https://google.lt https://google.lu https://google.lv https://google.md https://google.me https://google.mg https://google.mk https://google.ml https://google.mn https://google.ms https://google.mu https://google.mv https://google.mw https://google.ne https://google.nl https://google.no https://google.nr https://google.nu https://google.pl https://google.pn https://google.ps https://google.pt https://google.ro https://google.rs https://google.ru https://google.rw https://google.sc https://google.se https://google.sh https://google.si https://google.sk https://google.sm https://google.sn https://google.so https://google.sr https://google.st https://google.td https://google.tg https://google.tk https://google.tl https://google.tm https://google.tn https://google.to https://google.tt https://google.vg https://google.vu https://google.ws https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://ssl-static.libsyn.com https://static-cdn.jtvnw.net https://www.google.com https://www.linkedin.com https://yt3.ggpht.com; media-src 'self' https://*.libsyn.com https://a0.awsstatic.com https://anchor.fm https://awsmedia.s3.amazonaws.com https:/
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: m.do https://google.com.ec https://google.com.eg https://google.com.et https://google.com.fj https://google.com.gh https://google.com.gi https://google.com.gt https://google.com.hk https://google.com.jm https://google.com.kh https://google.com.kw https://google.com.lb https://google.com.lc https://google.com.ly https://google.com.mm https://google.com.mt https://google.com.mx https://google.com.my https://google.com.na https://google.com.nf https://google.com.ng https://google.com.ni https://google.com.np https://google.com.om https://google.com.pa https://google.com.pe https://google.com.pg https://google.com.ph https://google.com.pk https://google.com.pr https://google.com.py https://google.com.qa https://google.com.sa https://google.com.sb https://google.com.sg https://google.com.sl https://google.com.sv https://google.com.tj https://google.com.tr https://google.com.tw https://google.com.ua https://google.com.uy https://google.com.vc https://google.com.vn https://google.cv https://google.cz https://google.de https://google.dj https://google.dk https://google.dm https://google.dz https://google.ee https://google.es https://google.fi https://google.fm https://google.fr https://google.ga https://google.ge https://google.gf https://google.gg https://google.gl https://google.gm https://google.gp https://google.gr https://google.gy https://google.hn https://google.hr https://google.ht https://google.hu https://google.ie https://google.im https://google.io https://google.iq https://google.is https://google.it https://google.je https://google.jo https://google.kg https://google.ki https://google.kz https://google.la https://google.li https://google.lk https://google.lt https://google.lu https://google.lv https://google.md https://google.me https://google.mg https://google.mk https://google.ml https://google.mn https://google.ms https://google.mu https://google.mv https://google.mw https://google.ne https://google.nl https://google.no https://google.nr https://google.nu https://google.pl https://google.pn https://google.ps https://google.pt https://google.ro https://google.rs https://google.ru https://google.rw https://google.sc https://google.se https://google.sh https://google.si https://google.sk https://google.sm https://google.sn https://google.so https://google.sr https://google.st https://google.td https://google.tg https://google.tk https://google.tl https://google.tm https://google.tn https://google.to https://google.tt https://google.vg https://google.vu https://google.ws https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://ssl-static.libsyn.com https://static-cdn.jtvnw.net https://www.google.com https://www.linkedin.com https://yt3.ggpht.com; media-src 'self' https://*.libsyn.com https://a0.awsstatic.com https://anchor.fm https://awsmedia.s3.amazonaws.com https:/

Source: loaddll64.exe, 00000000.00000003.301931864.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.279575182.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.336770942.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.307540903.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.421256424.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.293593816.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.469077982.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.301217976.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.296630943.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.299702403.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.320853892.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.315013703.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.598048748.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.318242390.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.408508254.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.458850387.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.305474473.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.441800641.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.306042031.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.435434969.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.423274352.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micosoft.c
Source: rundll32.exe, 00000004.00000003.300093700.000001E90C7E4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.524383009.0000024990463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/
Source: loaddll64.exe, 00000000.00000003.303305137.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.306147533.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.419285425.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.419463769.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.305948479.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.469861552.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.494235596.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.305566557.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.305265867.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.467448104.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/$l
Source: rundll32.exe, 00000004.00000003.300093700.000001E90C7E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/-.1
Source: loaddll64.exe, 00000000.00000003.312116641.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.767376439.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.296722844.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.296551050.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/0l
Source: regsvr32.exe, 00000002.00000003.303177975.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.305253871.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/3
Source: regsvr32.exe, 00000002.00000003.294005581.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.267736131.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/7
Source: rundll32.exe, 00000004.00000003.300093700.000001E90C7E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/9.E
Source: regsvr32.exe, 00000002.00000003.265148469.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/;
Source: loaddll64.exe, 00000000.00000003.515254487.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.297830845.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.449481029.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.324742085.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.484853208.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.410962864.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.315300667.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.418564767.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.598201964.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.477298408.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.421448641.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.299296583.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.767376439.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.302243734.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.294070958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.292563140.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.469861552.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.463358477.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.300119379.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.295541331.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.321973808.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/?
Source: rundll32.exe, 00000003.00000003.274029943.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/CN
Source: rundll32.exe, 00000004.00000003.300093700.000001E90C7E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/E.Y
Source: regsvr32.exe, 00000002.00000003.265148469.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.276133966.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.317541622.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.262535432.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.272139372.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.267736131.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.277085762.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.437665754.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.263777645.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.317957028.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.320169360.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269684817.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.281055159.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/H2az
Source: loaddll64.exe, 00000000.00000003.308366586.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.296722844.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.296551050.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.491404712.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.423537792.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/Ho
Source: loaddll64.exe, 00000000.00000003.449449027.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/Kk
Source: loaddll64.exe, 00000000.00000003.515254487.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.414476070.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.284985082.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.441838460.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.290552402.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.443682397.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.453312773.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/Lo_
Source: regsvr32.exe, 00000002.00000003.317957028.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/Name
Source: loaddll64.exe, 00000000.00000003.418564767.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.310508348.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.499476528.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.295541331.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/Po3
Source: rundll32.exe, 00000004.00000003.300093700.000001E90C7E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/Q.m
Source: regsvr32.exe, 00000002.00000003.277085762.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.437665754.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/W-
Source: loaddll64.exe, 00000000.00000003.278615904.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.306147533.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.305948479.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.469861552.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.467448104.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/XoK
Source: regsvr32.exe, 00000002.00000003.491310372.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.297763257.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.297486719.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.281055159.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/_-
Source: loaddll64.exe, 00000000.00000003.408508254.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/abledpH
Source: loaddll64.exe, 00000000.00000003.775599675.00000272B357A000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.764165017.00000272B357A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.415162173.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/ame
Source: regsvr32.exe, 00000002.00000003.491310372.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/amez
Source: loaddll64.exe, 00000000.00000003.318334707.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.317603140.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.408901626.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.408673247.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/do
Source: loaddll64.exe, 00000000.00000003.296630943.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.423274352.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.287040954.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.463309889.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.477208981.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.414442205.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.322315986.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.494001685.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.463536468.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.296461329.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.453206998.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.310453782.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.308283097.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.449449027.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.443625425.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.265148469.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.276133966.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.491310372.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.317541622.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312615915.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.262535432.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/e.top
Source: regsvr32.exe, 00000002.00000003.329481762.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/e.top0
Source: loaddll64.exe, 00000000.00000003.329932226.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/e.topEH
Source: loaddll64.exe, 00000000.00000003.280404221.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/e.topEz
Source: loaddll64.exe, 00000000.00000003.336770942.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/e.topbH
Source: rundll32.exe, 00000003.00000003.274029943.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/e.topo
Source: loaddll64.exe, 00000000.00000003.302734691.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/eQz
Source: loaddll64.exe, 00000000.00000003.279575182.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/f
Source: loaddll64.exe, 00000000.00000003.297830845.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.291828758.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.296722844.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.294070958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.292563140.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.296551050.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.295541331.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/https://
Source: loaddll64.exe, 00000000.00000003.324665978.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.303177975.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/led
Source: loaddll64.exe, 00000000.00000003.491348491.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/led1H
Source: loaddll64.exe, 00000000.00000003.482965966.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.538400879.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.538090337.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.482331048.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/o
Source: regsvr32.exe, 00000002.00000003.320169360.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.415162173.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/op
Source: regsvr32.exe, 00000002.00000003.312615915.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/opb
Source: loaddll64.exe, 00000000.00000003.307540903.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.491310372.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.437665754.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/p
Source: regsvr32.exe, 00000002.00000003.491310372.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.294005581.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.290580726.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.320169360.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/p2
Source: loaddll64.exe, 00000000.00000003.410962864.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.458893876.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.458519998.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/po
Source: loaddll64.exe, 00000000.00000003.336770942.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.307540903.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.421256424.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.469077982.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.320853892.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.315013703.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.598048748.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.318242390.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.408508254.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.458850387.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.305474473.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.441800641.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.306042031.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.435434969.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.423274352.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.767296622.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.491348491.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.538032510.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.329932226.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.292458654.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.537963690.00000272B357A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/r
Source: loaddll64.exe, 00000000.00000003.458850387.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.297998046.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.458459306.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/rName
Source: loaddll64.exe, 00000000.00000003.410906898.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/rNameEH
Source: loaddll64.exe, 00000000.00000003.462495208.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/rNameuHb
Source: loaddll64.exe, 00000000.00000003.693965931.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.272139372.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/rd
Source: loaddll64.exe, 00000000.00000003.293593816.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/rdQz
Source: regsvr32.exe, 00000002.00000003.520492142.00000000031B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/re
Source: loaddll64.exe, 00000000.00000003.315013703.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/rpgHp
Source: loaddll64.exe, 00000000.00000003.515254487.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.324742085.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.498000828.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.538400879.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.320853892.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.419285425.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.418564767.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.336815635.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.477298408.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.421448641.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.491404712.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.419463769.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.469861552.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.463358477.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.538090337.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.499476528.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.494235596.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.320947335.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.321973808.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.329994913.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.462528825.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/s
Source: loaddll64.exe, 00000000.00000003.278615904.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.303305137.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.297830845.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.308366586.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.306147533.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.302794149.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.291828758.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.284985082.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.309484011.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.299296583.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.296722844.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.279695130.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.302243734.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.310508348.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.294070958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.292563140.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.296551050.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.277605660.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.307743095.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.305948479.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.300119379.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/s=
Source: regsvr32.exe, 00000002.00000003.415162173.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/same
Source: regsvr32.exe, 00000002.00000003.267736131.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/sop
Source: loaddll64.exe, 00000000.00000003.311950269.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/sop%H2
Source: loaddll64.exe, 00000000.00000003.299702403.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.298926769.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/spEz
Source: loaddll64.exe, 00000000.00000003.301217976.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.277558451.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.491310372.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.317541622.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312615915.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.303177975.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.299961911.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.307113678.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.454714376.0000000001206000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.437665754.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.311799175.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.317957028.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.320169360.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.305253871.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.415162173.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/stop
Source: loaddll64.exe, 00000000.00000003.538400879.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.336815635.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.292563140.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.538090337.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/to
Source: loaddll64.exe, 00000000.00000003.484785342.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.297763257.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.297486719.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/top
Source: loaddll64.exe, 00000000.00000003.318242390.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.317358805.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/top%H2
Source: loaddll64.exe, 00000000.00000003.421256424.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.421394094.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/topCH
Source: loaddll64.exe, 00000000.00000003.435434969.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/topbH
Source: regsvr32.exe, 00000002.00000003.307113678.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/topw
Source: rundll32.exe, 00000003.00000003.274029943.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/verH
Source: regsvr32.exe, 00000002.00000003.311799175.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top/very
Source: loaddll64.exe, 00000000.00000003.336770942.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.307540903.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.421256424.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.293593816.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.469077982.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.296630943.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.320853892.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.315013703.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.318242390.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.408508254.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.458850387.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.441800641.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.767296622.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.280404221.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.491348491.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.329932226.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.278476523.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.292458654.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.693965931.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.287040954.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.294961017.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top:80/
Source: loaddll64.exe, 00000000.00000003.336770942.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.421256424.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.598048748.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.423274352.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.419235548.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.421394094.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.419412364.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top:80/%
Source: regsvr32.exe, 00000002.00000003.321553577.000000000119D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top:80/&j
Source: loaddll64.exe, 00000000.00000003.320853892.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.408508254.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.292458654.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.322315986.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.291732911.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.324665978.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.497956918.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.320045602.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top:80/4
Source: loaddll64.exe, 00000000.00000003.301931864.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.301217976.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.435434969.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.499434646.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.302734691.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.311950269.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.310453782.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top:80/5
Source: regsvr32.exe, 00000002.00000003.268605864.000000000119D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.264958888.000000000119D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269626896.000000000119D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.267225769.000000000119D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.264167161.000000000119D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.270807144.000000000119D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.262765450.000000000119D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top:80/7j
Source: regsvr32.exe, 00000002.00000003.320094818.000000000119D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top:80/Lk
Source: loaddll64.exe, 00000000.00000003.469077982.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.477208981.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.309382257.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.453206998.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top:80/M
Source: loaddll64.exe, 00000000.00000003.279575182.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.469077982.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.423274352.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.477208981.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top:80/R
Source: loaddll64.exe, 00000000.00000003.458850387.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.305474473.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.435434969.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.305121309.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.494001685.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.453206998.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.458459306.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.418516678.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.308283097.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top:80/S
Source: loaddll64.exe, 00000000.00000003.421256424.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.423274352.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.767296622.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.538032510.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.329932226.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.484785342.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.421394094.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.324665978.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.538302810.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top:80/a
Source: regsvr32.exe, 00000002.00000003.298272650.000000000119D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.295125426.000000000119D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.305135210.000000000119D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top:80/jY
Source: regsvr32.exe, 00000002.00000003.262765450.000000000119D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top:80/o
Source: regsvr32.exe, 00000002.00000003.411869520.000000000119D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dsedertyhuiokle.top:80/sjh
Source: loaddll64.exe, 00000000.00000003.276449213.00000272B3555000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275455416.00000272B3555000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dses.amazon.com/
Source: loaddll64.exe, 00000000.00000003.275820288.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://112-tzm-766.mktoresp.com
Source: loaddll64.exe, 00000000.00000003.275820288.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://112-tzm-766.mktoutil.com
Source: regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/aws-blog/1.0.48/js
Source: loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/da/js/1.0.48/aws-da.js
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/eb-csr/1.0.15/orchestrate.css
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/eb-csr/1.0.15/orchestrate.js
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/g11n-lib/2.0.100
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/css/1.0.417
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/css/1.0.417/style-awsm.css
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/images
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/images/gi-map/AWS_world.svg
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/images/logos/aws_logo_smile_1200x630.png
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/images/logos/aws_logo_smile_179x109.png
Source: regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/images/site/fav/favicon.ico
Source: regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/images/site/touch-icon-ipad-144-smile.png
Source: regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/images/site/touch-icon-iphone-114-smile.png
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-search/1.0.18/js
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra/1.0.452/csp/csp-report.js
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra/1.0.452/directories
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra/1.0.452/libra-cardsui
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra/1.0.452/libra-head.js
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra/1.0.452/librastandardlib
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/plc/js/1.0.129/plc
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/pricing-calculator/js/1.0.2
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/pricing-savings-plan/js/1.0.6
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/s_code/js/3.0/awshome_s_code.js
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com/target/1.0.120/aws-target-mediator.js
Source: loaddll64.exe, 00000000.00000003.275820288.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.awsstatic.com;
Source: loaddll64.exe, 00000000.00000003.278615904.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.284985082.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.279695130.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275820288.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.277605660.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.280674763.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.290552402.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a0.p.awsstatic.com
Source: loaddll64.exe, 00000000.00000003.278615904.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.284985082.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.279695130.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275820288.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.277605660.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.280674763.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.290552402.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a1.awsstatic.com
Source: loaddll64.exe, 00000000.00000003.279575182.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.293593816.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.296630943.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.299702403.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.280404221.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.278476523.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.297998046.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.292458654.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.287040954.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.277558451.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.294961017.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276274279.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.291732911.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.296461329.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274832296.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.298926769.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/&
Source: regsvr32.exe, 00000002.00000003.264167161.000000000119D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.262765450.000000000119D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/face
Source: loaddll64.exe, 00000000.00000003.277558451.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276274279.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274832296.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/u/
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.280674763.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.290552402.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonwebservices.d2.sc.omtrdc.net
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonwebservicesinc.tt.omtrdc.net
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anchor.fm
Source: loaddll64.exe, 00000000.00000003.278615904.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.284985082.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.279695130.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275820288.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.277605660.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.280674763.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.290552402.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.regional-table.region-services.aws.a2z.com
Source: loaddll64.exe, 00000000.00000003.278615904.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.284985082.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.279695130.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275820288.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.277605660.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.280674763.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.290552402.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.us-west-2.prod.pricing.aws.a2z.com
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws-quickstart.s3.amazonaws.com
Source: loaddll64.exe, 00000000.00000003.276436807.00000272B3551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amaz
Source: loaddll64.exe, 00000000.00000003.277807046.00000272B3551000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276436807.00000272B3551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazo
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.280674763.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.290552402.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com
Source: regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/?nc1=h_ls
Source: regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/?nc2=h_lg
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/ar/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/ar/?nc1=h_ls
Source: loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/blogs/aws/heads-up-aws-support-for-internet-explorer-11-is-ending/
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/blogs/industries/aws-is-how-petco-brings-greater-convenience-and-personalizat
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/blogs/media/winnie-the-pooh-method-melbournes-journey-to-cloud-rendering/
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/blogs/publicsector/50-years-innovation-how-open-data-noaa-science-service-ste
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/blogs/publicsector/capella-uses-space-bring-you-closer-earth/?hp=tile&til
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/blogs/publicsector/how-fred-hutch-unlocks-siloed-data-open-source-software/?h
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/blogs/publicsector/perseverance-lands-mars-cloud-ready-explore/?hp=tile&t
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/blogs/publicsector/uae-mars-mission-uses-aws-advance-scientific-discoveries/?
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/blogs/publicsector/us-census-brings-nationwide-count-aws-cloud/?hp=tile&t
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/cn/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/cn/?nc1=h_ls
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/de/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/de/?nc1=h_ls
Source: loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/es
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/es/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/es/?nc1=h_ls
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/fr/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/fr/?nc1=h_ls
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/id/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/id/?nc1=h_ls
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/it/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/it/?nc1=h_ls
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/jp/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/jp/?nc1=h_ls
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/ko/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/ko/?nc1=h_ls
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/marketplace/?nc2=h_mo
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/marketplace/?nc2=h_ql_mp
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/nfl/
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/partners/success/best-friends-animal-society-n2ws/?hp=tile&tile=customers
Source: loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/privacy/?nc1=f_pr
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/pt/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/pt/?nc1=h_ls
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/ru/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/ru/?nc1=h_ls
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/search
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/search/
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/?hp=tile&tile=customerstories
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/?hp=tile&tile=customerstories&customer-referen
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/agco-case-study/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/altium-case-study/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/amazon-robotics-case-study/?hp=tile&tile=customers
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/arm-case-study/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/astrazeneca/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/axa-landing-zone/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/baccc-case-study/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/basf-digital-farming/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/bmw-group-case-study/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/capital-one/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/carrier-case-study/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/cerner-case-study/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/city-of-port-st-lucie/?hp=tile&tile=customerstorie
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/clever/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/coca-cola-freestyle/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/cropx-case-study/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/engie-aws-analytics-case-study/?hp=tile&tile=custo
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/expedia-aurora-case-study/?hp=tile&tile=customerst
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/freewheel/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/general-electric/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/goldman-sachs-case-study/?hp=tile&tile=customersto
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/halliburton-aurora-case-study/?hp=tile&tile=custom
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/innovators/fox/
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/innovators/moderna/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/kiva-case-study/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/laredo/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/maryland-dhs/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/maxar-case-study/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/nasdaq-case-study/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/netflix/
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/netflix/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/pearson-digitally-transforms/?hp=tile&tile=custome
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/philips/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/publicis-media/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/rivian-case-study/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/salesforce/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/southwest/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/taco-bell/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/the-trade-desk-case-study/?hp=tile&tile=customerst
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/toyota-connected/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/volkswagen-group/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/woodside/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/wyndham-building-resilience/?hp=tile&tile=customer
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/solutions/case-studies/ze-delivery/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/terms/?nc1=f_pr
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/th/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/th/?nc1=f_ls
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/tr/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/tr/?nc1=h_ls
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/training/classroom/?hp=tile&tile=clrt
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/training/ramp-up-guides/?hp=lrhttps://aws.amazon.com/training/ramp-up-guides/
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/tw/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/tw/?nc1=h_ls
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/vi/
Source: regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazon.com/vi/?nc1=f_ls
Source: loaddll64.exe, 00000000.00000003.276436807.00000272B3551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.amazow
Source: loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aws.demdex.net
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://awsmedia.s3.amazonaws.com
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://awspodcastsiberiaent.s3.eu-west-3.amazonaws.com
Source: loaddll64.exe, 00000000.00000003.278615904.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.279695130.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275820288.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.277605660.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://b0.p.awsstatic.com
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c0.b0.p.awsstatic.com
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://calculator.aws
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chtbl.com
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cm.everesttech.net
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.aws.amazon.com/?nc2=h_m_mc
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.aws.amazon.com/billing/home#/account?nc2=h_m_ma
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.aws.amazon.com/billing/home?nc2=h_m_bc
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.aws.amazon.com/console/home
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.aws.amazon.com/console/home?nc1=f_ct&src=footer-signin-mobile
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.aws.amazon.com/console/home?nc2=h_ct&src=header-signin
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.aws.amazon.com/iam/home?nc2=h_m_sc#security_credential
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.aws.amazon.com/support/home/?nc1=f_dr
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.aws.amazon.com/support/home/?nc2=h_ql_cu
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.aws.amazon.com/support/home?nc2=h_ql_cu
Source: loaddll64.exe, 00000000.00000003.278615904.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.279695130.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275820288.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.277605660.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://csml-plc-prod.us-west-2.api.aws/plc/csml/logging
Source: loaddll64.exe, 00000000.00000003.278615904.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.279695130.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275820288.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.277605660.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d0.awsstatic.com
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d1.awsstatic.com
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d1d1et6laiqoh9.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.278615904.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.279695130.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275820288.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.277605660.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d1fgizr415o1r6.cloudfront.n
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d1fgizr415o1r6.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d1hemuljm71t2j.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d1le29qyzha1u4.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d1oqpvwii7b6rh.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d1vo51ubqkiilx.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d1yyh5dhdgifnx.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2908q01vomqb2.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2a6igt6jhaluh.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2c.aws.amazon.com
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2cpw7vd6a2efr.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d36cz9buwru1tt.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3borx6sfvnesb.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3ctxlq1ktw2nl.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3h2ozso0dirfl.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dc.ads.linkedin.com
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dc.ads.linkedin.com/collect/?pid=3038&fmt=gif
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dftu77xade0tc.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dgen8gghn3u86.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dk261l6wntthl.cloudfront.net
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.aws.amazon.com
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.aws.amazon.com/index.html?nc2=h_ql_doc
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.stormacq.com/aws/podcast/
Source: loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dpm.demdex.net
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dts.podtrac.com
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f0.awsstatic.com
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fls-na.amazon.com
Source: loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fls-na.amazon.com/1/action-impressions/1/OE/aws-mktg/action/awsm_:comp_DeprecatedBrowser
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.cn
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ac
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ad
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ae
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.al
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.am
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.as
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.at
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.az
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ba
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.be
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.bf
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.bg
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.bi
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.bj
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.bs
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.bt
Source: loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.by
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.ec
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.eg
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.et
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.fj
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.gh
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.gi
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.gt
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.hk
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.jm
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.kh
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.kw
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.lb
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.lc
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.ly
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.mm
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.mt
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.mx
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.my
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.na
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.nf
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.ng
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.ni
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.np
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.om
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.pa
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.pe
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.pg
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.ph
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.pk
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.pr
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.py
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.qa
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.sa
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.sb
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.sg
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.sl
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.sv
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.tj
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.tr
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.tw
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.ua
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.uy
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.vc
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com.vn
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.cv
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.cz
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.de
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.dj
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.dk
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.dm
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.dz
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ee
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.es
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.fi
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.fm
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.fr
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ga
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ge
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.gf
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.gg
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.gl
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.gm
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.gp
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.gr
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.gy
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.hn
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.hr
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ht
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.hu
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ie
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.im
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.io
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.iq
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.is
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.it
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.je
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.jo
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.kg
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ki
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.kz
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.la
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.li
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.lk
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.lt
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.lu
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.lv
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.md
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.me
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.mg
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.mk
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ml
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.mn
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ms
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.mu
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.mv
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.mw
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ne
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.nl
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.no
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.nr
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.nu
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.pl
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.pn
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ps
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.pt
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ro
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.rs
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ru
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.rw
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.sc
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.se
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.sh
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.si
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.sk
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.sm
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.sn
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.so
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.sr
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.st
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.td
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.tg
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.tk
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.tl
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.tm
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.tn
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.to
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.tt
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.vg
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.vu
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.ws
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i18n-string.us-west-2.prod.pricing.aws.a2z.com
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.youtube.com
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marketingplatform.google.com
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://media.amazonwebservices.com
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mktg-apac.s3-ap-southeast-1.amazonaws.com
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.adsymptotic.com
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pages.awscloud.com
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pages.awscloud.com/AWS_TrainCert_Thought-Leadership-download.html?hp=tile&tile=uyt
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pages.awscloud.com/certification-value.html?hp=tile&tile=acst
Source: loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pages.awscloud.com/communication-preferences?trk=homepage
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://phd.aws.amazon.com/?nc2=h_m_sc
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?exp=default
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?exp=default&sc_icampaign=
Source: loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc1=f_ct&src=default
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc2=h_ct&src=header_signu
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://press.aboutamazon.com/press-releases/aws
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://prod-us-west-2.csp-report.marketing.aws.dev
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://prod-us-west-2.csp-report.marketing.aws.dev/submit
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://prod-us-west-2.csp-report.marketing.aws.dev/submitx-amz-id-1TDV2TBQZG36F6HSCSVFCX-Content-Ty
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://prod.log.shortbread.aws.dev
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://prod.tools.shortbread.aws.dev
Source: regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://repost.aws/
Source: loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://repost.aws/?nc1=f_dr
Source: regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s0.awsstatic.com
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s0.awsstatic.com/en_US/nav/v3/panel-content/desktop/index.html
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s0.awsstatic.com/en_US/nav/v3/panel-content/mobile/index.html
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s3-ap-northeast-1.amazonaws.com/aws-china-media/
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s3.amazonaws.com/aws-messaging-pricing-information/
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s3.amazonaws.com/aws-quickstart/
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s3.amazonaws.com/public-pricing-agc/
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skillbuilder.aws/
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spot-bid-advisor.s3.amazonaws.com
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spot-price.s3.amazonaws.com
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl-static.libsyn.com
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static-cdn.jtvnw.net
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.doubleclick.net
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://target.aws.amazon.com
Source: loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/awscloud
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-stage.us-west-2.prod.pricing.aws.a2z.com
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vs.aws.amazon.com
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://website.spot.ec2.aws.a2z.com
Source: loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wrp.dse.marketing.aws.a2z.com
Source: loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.aboutamazon.com/news/aws/making-the-invisible-visible/?hp=tile&tile=customerstories
Source: loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.aboutamazon.com/news/community/helping-700-000-students-transition-to-remote-learning/?h
Source: loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.jobs/aws
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.buzzsprout.com;
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.linkedin.com
Source: loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.twitch.tv/aws
Source: loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube-nocookie.com;
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/iframe_api
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/player/;
Source: loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/user/AmazonWebServices/Cloud/
Source: loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yt3.ggpht.com;

Source: unknown

DNS traffic detected: queries for: aws.amazon.com

Source: unknown	HTTPS traffic detected: 13.225.235.76:443 -> 192.168.2.3:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.235.76:443 -> 192.168.2.3:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.235.76:443 -> 192.168.2.3:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.235.76:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.235.76:443 -> 192.168.2.3:49730 version: TLS 1.2

E-Banking Fraud

Source: Yara match	File source: 00000002.00000003.321553577.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.267642045.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.274029943.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.261454717.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.269643903.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.297404495.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.292337146.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.277053411.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.269043278.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.396642532.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.264700847.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.280507761.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.267145571.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.298272650.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.311756165.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.265795087.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.264618023.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.319014674.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.295125426.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.314754724.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.270691540.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.270084280.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.273346326.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.317474031.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.304327995.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266413828.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.269326182.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.305135210.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.261968567.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.320094818.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.271220559.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.265620836.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.305936677.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.276312756.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.293963524.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.309363516.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.262421311.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.411869520.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.265218608.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.261647380.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.302975794.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.273106192.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.282267699.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.287602431.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.275791438.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.262765450.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.268258493.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.263740751.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.299841707.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.351326851.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.265359115.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.271492952.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.262406305.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.278543970.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.407235069.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.262811825.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.437622717.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.293411402.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.491241630.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.265793313.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.719810116.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.280994457.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.297638852.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.415117148.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.416746789.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.298094562.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.268018419.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.278246832.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.264969343.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.272087960.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.307033359.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.270822392.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.317906358.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.267338480.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.263723615.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.267270096.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.272354753.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.272644834.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.312571750.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.290176337.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.291011198.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.454332371.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.267942385.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.299224080.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.306791775.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.274845604.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.295599262.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.263807736.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.292690922.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.272047247.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.274007377.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 6576, type: MEMORYSTR

Source: C:\Windows\System32\regsvr32.exe

Section loaded: sfc.dll

Source: ikvNEF5d2Z.dll	Virustotal: Detection: 76%
Source: ikvNEF5d2Z.dll	Metadefender: Detection: 35%
Source: ikvNEF5d2Z.dll	ReversingLabs: Detection: 65%

Source: ikvNEF5d2Z.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ikvNEF5d2Z.dll",#1

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\ikvNEF5d2Z.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ikvNEF5d2Z.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\ikvNEF5d2Z.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ikvNEF5d2Z.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ikvNEF5d2Z.dll,DllRegisterServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ikvNEF5d2Z.dll,PluginInit
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ikvNEF5d2Z.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\ikvNEF5d2Z.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ikvNEF5d2Z.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ikvNEF5d2Z.dll,PluginInit	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ikvNEF5d2Z.dll",#1	Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@11/0@5422/2

Source: C:\Windows\System32\loaddll64.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: ikvNEF5d2Z.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: ikvNEF5d2Z.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: ikvNEF5d2Z.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\ikvNEF5d2Z.dll

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Windows\System32\rundll32.exe	RDTSC instruction interceptor: First address: 000001599B0824BE second address: 000001599B0824DF instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec esp 0x0000000a mov eax, eax 0x0000000c xor ecx, ecx 0x0000000e mov eax, 00000001h 0x00000013 cpuid 0x00000015 mov dword ptr [ebp-10h], eax 0x00000018 mov dword ptr [ebp-0Ch], ebx 0x0000001b mov dword ptr [ebp-08h], ecx 0x0000001e mov dword ptr [ebp-04h], edx 0x00000021 rdtsc
Source: C:\Windows\System32\rundll32.exe	RDTSC instruction interceptor: First address: 000001599B0824F4 second address: 000001599B082501 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 nop 0x00000007 dec eax 0x00000008 or eax, edx 0x0000000a dec eax 0x0000000b mov ecx, eax 0x0000000d rdtsc
Source: C:\Windows\System32\regsvr32.exe	RDTSC instruction interceptor: First address: 00000000013124BE second address: 00000000013124DF instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec esp 0x0000000a mov eax, eax 0x0000000c xor ecx, ecx 0x0000000e mov eax, 00000001h 0x00000013 cpuid 0x00000015 mov dword ptr [ebp-10h], eax 0x00000018 mov dword ptr [ebp-0Ch], ebx 0x0000001b mov dword ptr [ebp-08h], ecx 0x0000001e mov dword ptr [ebp-04h], edx 0x00000021 rdtsc
Source: C:\Windows\System32\regsvr32.exe	RDTSC instruction interceptor: First address: 00000000013124F4 second address: 0000000001312501 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 nop 0x00000007 dec eax 0x00000008 or eax, edx 0x0000000a dec eax 0x0000000b mov ecx, eax 0x0000000d rdtsc
Source: C:\Windows\System32\rundll32.exe	RDTSC instruction interceptor: First address: 000001E90E2324BE second address: 000001E90E2324DF instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec esp 0x0000000a mov eax, eax 0x0000000c xor ecx, ecx 0x0000000e mov eax, 00000001h 0x00000013 cpuid 0x00000015 mov dword ptr [ebp-10h], eax 0x00000018 mov dword ptr [ebp-0Ch], ebx 0x0000001b mov dword ptr [ebp-08h], ecx 0x0000001e mov dword ptr [ebp-04h], edx 0x00000021 rdtsc
Source: C:\Windows\System32\rundll32.exe	RDTSC instruction interceptor: First address: 000001E90E2324F4 second address: 000001E90E232501 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 nop 0x00000007 dec eax 0x00000008 or eax, edx 0x0000000a dec eax 0x0000000b mov ecx, eax 0x0000000d rdtsc
Source: C:\Windows\System32\rundll32.exe	RDTSC instruction interceptor: First address: 00000249900224BE second address: 00000249900224DF instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec esp 0x0000000a mov eax, eax 0x0000000c xor ecx, ecx 0x0000000e mov eax, 00000001h 0x00000013 cpuid 0x00000015 mov dword ptr [ebp-10h], eax 0x00000018 mov dword ptr [ebp-0Ch], ebx 0x0000001b mov dword ptr [ebp-08h], ecx 0x0000001e mov dword ptr [ebp-04h], edx 0x00000021 rdtsc
Source: C:\Windows\System32\rundll32.exe	RDTSC instruction interceptor: First address: 00000249900224F4 second address: 0000024990022501 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 nop 0x00000007 dec eax 0x00000008 or eax, edx 0x0000000a dec eax 0x0000000b mov ecx, eax 0x0000000d rdtsc
Source: C:\Windows\System32\loaddll64.exe	RDTSC instruction interceptor: First address: 00000272B36224BE second address: 00000272B36224DF instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec esp 0x0000000a mov eax, eax 0x0000000c xor ecx, ecx 0x0000000e mov eax, 00000001h 0x00000013 cpuid 0x00000015 mov dword ptr [ebp-10h], eax 0x00000018 mov dword ptr [ebp-0Ch], ebx 0x0000001b mov dword ptr [ebp-08h], ecx 0x0000001e mov dword ptr [ebp-04h], edx 0x00000021 rdtsc
Source: C:\Windows\System32\loaddll64.exe	RDTSC instruction interceptor: First address: 00000272B36224F4 second address: 00000272B3622501 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 nop 0x00000007 dec eax 0x00000008 or eax, edx 0x0000000a dec eax 0x0000000b mov ecx, eax 0x0000000d rdtsc

Source: C:\Windows\System32\loaddll64.exe	Window / User API: threadDelayed 785	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Window / User API: threadDelayed 829	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 947	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 920	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 847	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe TID: 6984	Thread sleep count: 785 > 30	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe TID: 6984	Thread sleep time: -23550000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe TID: 6952	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 6636	Thread sleep count: 829 > 30	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 6636	Thread sleep time: -24870000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 6612	Thread sleep time: -360000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Last function: Thread delayed
Source: C:\Windows\System32\regsvr32.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\loaddll64.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 60000	Jump to behavior

Source: regsvr32.exe, 00000002.00000003.416702144.0000000001184000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.282059347.000000000118B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.260483844.000000000117F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312521956.0000000001180000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.306978153.0000000001183000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.306761884.0000000001180000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.297549238.0000000001183000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.295026985.0000000001184000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.270789256.000000000118B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.286869053.000000000118B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>]
Source: loaddll64.exe, 00000000.00000003.306685085.00000272B35AA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.482117915.00000272B35AA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.418502481.00000272B35AA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.279557840.00000272B35AA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.277543674.00000272B35AA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.312055610.00000272B35AA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.318190918.00000272B35AA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.297976237.00000272B35AA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.467370625.00000272B35AA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.293560177.00000272B35AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\rundll32.exe	Network Connect: 13.225.235.76 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: dsedertyhuiokle.top
Source: C:\Windows\System32\rundll32.exe	Domain query: aws.amazon.com

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ikvNEF5d2Z.dll",#1

Stealing of Sensitive Information

Source: Yara match	File source: 00000002.00000003.321553577.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.267642045.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.274029943.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.261454717.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.269643903.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.297404495.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.292337146.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.277053411.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.269043278.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.396642532.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.264700847.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.280507761.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.267145571.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.298272650.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.311756165.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.265795087.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.264618023.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.319014674.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.295125426.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.314754724.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.270691540.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.270084280.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.273346326.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.317474031.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.304327995.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266413828.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.269326182.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.305135210.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.261968567.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.320094818.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.271220559.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.265620836.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.305936677.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.276312756.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.293963524.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.309363516.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.262421311.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.411869520.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.265218608.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.261647380.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.302975794.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.273106192.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.282267699.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.287602431.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.275791438.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.262765450.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.268258493.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.263740751.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.299841707.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.351326851.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.265359115.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.271492952.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.262406305.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.278543970.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.407235069.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.262811825.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.437622717.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.293411402.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.491241630.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.265793313.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.719810116.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.280994457.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.297638852.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.415117148.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.416746789.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.298094562.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.268018419.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.278246832.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.264969343.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.272087960.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.307033359.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.270822392.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.317906358.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.267338480.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.263723615.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.267270096.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.272354753.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.272644834.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.312571750.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.290176337.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.291011198.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.454332371.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.267942385.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.299224080.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.306791775.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.274845604.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.295599262.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.263807736.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.292690922.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.272047247.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.274007377.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 6576, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 00000002.00000003.321553577.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.267642045.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.274029943.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.261454717.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.269643903.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.297404495.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.292337146.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.277053411.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.269043278.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.396642532.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.264700847.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.280507761.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.267145571.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.298272650.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.311756165.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.265795087.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.264618023.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.319014674.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.295125426.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.314754724.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.270691540.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.270084280.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.273346326.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.317474031.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.304327995.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.266413828.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.269326182.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.305135210.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.261968567.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.320094818.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.271220559.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.265620836.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.305936677.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.276312756.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.293963524.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.309363516.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.262421311.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.411869520.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.265218608.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.261647380.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.302975794.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.273106192.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.282267699.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.287602431.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.275791438.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.262765450.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.268258493.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.263740751.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.299841707.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.351326851.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.265359115.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.271492952.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.262406305.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.278543970.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.407235069.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.262811825.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.437622717.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.293411402.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.491241630.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.265793313.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.719810116.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.280994457.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.297638852.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.415117148.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.416746789.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.298094562.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.268018419.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.278246832.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.264969343.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.272087960.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.307033359.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.270822392.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.317906358.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.267338480.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.263723615.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.267270096.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.272354753.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.272644834.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.312571750.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.290176337.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.291011198.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.454332371.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.267942385.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.299224080.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.306791775.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.274845604.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.295599262.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.263807736.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.292690922.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.272047247.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.274007377.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 6576, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Regsvr32	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Rundll32	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	11 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ikvNEF5d2Z.dll	76%	Virustotal		Browse
ikvNEF5d2Z.dll	35%	Metadefender		Browse
ikvNEF5d2Z.dll	66%	ReversingLabs	Win64.Trojan.IcedID
ikvNEF5d2Z.dll	100%	Avira	HEUR/AGEN.1245251

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
dsedertyhuiokle.top	13%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://prod-us-west-2.csp-report.marketing.aws.dev	0%	URL Reputation	safe
http://dsedertyhuiokle.top/do	100%	Avira URL Cloud	malware
http://dsedertyhuiokle.top/top	100%	Avira URL Cloud	malware
https://d1fgizr415o1r6.cloudfront.n	0%	Avira URL Cloud	safe
http://dsedertyhuiokle.top/CN	100%	Avira URL Cloud	malware
https://www.buzzsprout.com;	0%	Avira URL Cloud	safe
http://dsedertyhuiokle.top/eQz	100%	Avira URL Cloud	malware
http://dsedertyhuiokle.top/$l	100%	Avira URL Cloud	malware
http://dsedertyhuiokle.top/;	100%	Avira URL Cloud	malware
http://dsedertyhuiokle.top/?	100%	Avira URL Cloud	malware
http://dsedertyhuiokle.top:80/&j	100%	Avira URL Cloud	malware
http://dsedertyhuiokle.top/3	100%	Avira URL Cloud	malware
http://dsedertyhuiokle.top/7	100%	Avira URL Cloud	malware
http://dsedertyhuiokle.top:80/jY	100%	Avira URL Cloud	malware
http://dsedertyhuiokle.top/	100%	Avira URL Cloud	malware
https://google.com.vc	0%	Avira URL Cloud	safe
https://google.com.vn	0%	Avira URL Cloud	safe
http://dsedertyhuiokle.top/H2az	100%	Avira URL Cloud	malware
http://dsedertyhuiokle.top/Name	100%	Avira URL Cloud	malware
https://google.com.uy	0%	Avira URL Cloud	safe
http://dsedertyhuiokle.top/Po3	100%	Avira URL Cloud	malware
https://112-tzm-766.mktoutil.com	0%	URL Reputation	safe
https://google.gf	0%	Avira URL Cloud	safe
https://download.stormacq.com/aws/podcast/	0%	URL Reputation	safe
http://dsedertyhuiokle.top/sop	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dr49lng3n1n2s.cloudfront.net	13.225.235.76	true	false		high
dsedertyhuiokle.top	unknown	unknown	true	13%, Virustotal, Browse	unknown
aws.amazon.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://console.aws.amazon.com/billing/home#/account?nc2=h_m_ma	loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://prod-us-west-2.csp-report.marketing.aws.dev	loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.linkedin.com	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dsedertyhuiokle.top/do	loaddll64.exe, 00000000.00000003.318334707.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.317603140.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.408901626.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.408673247.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://google.ad	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://c0.b0.p.awsstatic.com	loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.ac	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aws.amazon.com/solutions/case-studies/rivian-case-study/?hp=tile&tile=customerstories	loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.ae	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.aboutamazon.com/news/aws/making-the-invisible-visible/?hp=tile&tile=customerstories	loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.al	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.am	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dsedertyhuiokle.top/top	loaddll64.exe, 00000000.00000003.484785342.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.297763257.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.297486719.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://google.az	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.at	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.as	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.ba	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aws.demdex.net	loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.bi	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://d1fgizr415o1r6.cloudfront.n	loaddll64.exe, 00000000.00000003.278615904.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.279695130.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275820288.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.277605660.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.276356958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aws.amazon.com/solutions/case-studies/maxar-case-study/?hp=tile&tile=customerstories	loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.bj	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dsedertyhuiokle.top/CN	rundll32.exe, 00000003.00000003.274029943.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://google.be	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.buzzsprout.com;	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://aws.amazon.com/solutions/case-studies/maryland-dhs/?hp=tile&tile=customerstories	loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://i18n-string.us-west-2.prod.pricing.aws.a2z.com	loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.bg	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.bf	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aws.amazon.com/ru/?nc1=h_ls	regsvr32.exe, 00000002.00000003.600732821.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dsedertyhuiokle.top/eQz	loaddll64.exe, 00000000.00000003.302734691.00000272B35B3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://google.bs	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.aws.amazon.com/index.html?nc2=h_ql_doc	loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.by	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.bt	loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aws.amazon.com/th/	loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aws.amazon.com/solutions/case-studies/carrier-case-study/?hp=tile&tile=customerstories	loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dsedertyhuiokle.top/$l	loaddll64.exe, 00000000.00000003.303305137.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.306147533.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.419285425.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.419463769.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.305948479.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.469861552.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.494235596.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.305566557.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.305265867.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.467448104.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dsedertyhuiokle.top/;	regsvr32.exe, 00000002.00000003.265148469.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://console.aws.amazon.com/support/home/?nc2=h_ql_cu	loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dftu77xade0tc.cloudfront.net	loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dsedertyhuiokle.top/?	loaddll64.exe, 00000000.00000003.515254487.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.297830845.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.449481029.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.324742085.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.484853208.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.410962864.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.315300667.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.418564767.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.598201964.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.477298408.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.421448641.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.299296583.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.767376439.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.302243734.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.294070958.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.292563140.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.469861552.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.463358477.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.300119379.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.295541331.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.321973808.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dsedertyhuiokle.top:80/&j	regsvr32.exe, 00000002.00000003.321553577.000000000119D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dsedertyhuiokle.top/3	regsvr32.exe, 00000002.00000003.303177975.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.305253871.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://aws.amazon.com/solutions/case-studies/publicis-media/?hp=tile&tile=customerstories	loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pages.awscloud.com/AWS_TrainCert_Thought-Leadership-download.html?hp=tile&tile=uyt	loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dsedertyhuiokle.top/7	regsvr32.exe, 00000002.00000003.294005581.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.267736131.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://aws.amazon.com/solutions/case-studies/pearson-digitally-transforms/?hp=tile&tile=custome	loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.cz	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aws.amazon.com/vi/	loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.cv	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.de	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dsedertyhuiokle.top:80/jY	regsvr32.exe, 00000002.00000003.298272650.000000000119D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.295125426.000000000119D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.305135210.000000000119D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://google.dk	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.dj	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.dm	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aws.amazon.com/solutions/case-studies/nasdaq-case-study/?hp=tile&tile=customerstories	loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dsedertyhuiokle.top/	rundll32.exe, 00000004.00000003.300093700.000001E90C7E4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.524383009.0000024990463000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://wrp.dse.marketing.aws.a2z.com	loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.dz	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aws.amazon.com/training/ramp-up-guides/?hp=lrhttps://aws.amazon.com/training/ramp-up-guides/	loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spot-bid-advisor.s3.amazonaws.com	loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://d3ctxlq1ktw2nl.cloudfront.net	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com.vc	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google.ee	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com.vn	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aws.amazon.com/jp/	loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.es	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aws.amazon.com/solutions/case-studies/netflix/	loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.411376388.0000000003204000.00000004.00000020.00020000.00000000.sdmp	false		high
https://view-stage.us-west-2.prod.pricing.aws.a2z.com	loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274580506.00000272B360B000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aws.amazon.com/solutions/case-studies/freewheel/?hp=tile&tile=customerstories	loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.fm	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s3.amazonaws.com/public-pricing-agc/	loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275643794.00000272B3608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aws.amazon.com/de/	loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dsedertyhuiokle.top/H2az	regsvr32.exe, 00000002.00000003.265148469.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.276133966.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.317541622.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.262535432.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.272139372.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.267736131.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.277085762.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.437665754.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.263777645.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.317957028.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.320169360.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269684817.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.281055159.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://google.fi	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://phd.aws.amazon.com/?nc2=h_m_sc	loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a0.awsstatic.com/libra-css/images/logos/aws_logo_smile_1200x630.png	loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dsedertyhuiokle.top/Name	regsvr32.exe, 00000002.00000003.317957028.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://google.com.uy	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://a0.awsstatic.com	regsvr32.exe, 00000002.00000003.520119151.0000000003201000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.fr	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dsedertyhuiokle.top/Po3	loaddll64.exe, 00000000.00000003.418564767.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.310508348.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.499476528.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.295541331.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://website.spot.ec2.aws.a2z.com	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://112-tzm-766.mktoutil.com	loaddll64.exe, 00000000.00000003.275820288.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.274973142.00000272B35F4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google.gf	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google.ge	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a0.awsstatic.com/da/js/1.0.48/aws-da.js	loaddll64.exe, 00000000.00000003.275443403.00000272B3550000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.gg	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.ga	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.gm	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.gp	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.gl	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://download.stormacq.com/aws/podcast/	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google.gr	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a0.awsstatic.com/plc/js/1.0.129/plc	loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://console.aws.amazon.com/support/home?nc2=h_ql_cu	loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273518645.00000272B360C000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.gy	loaddll64.exe, 00000000.00000003.273548340.00000272B51F5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dsedertyhuiokle.top/sop	regsvr32.exe, 00000002.00000003.267736131.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://aws.amazon.com/solutions/case-studies/astrazeneca/?hp=tile&tile=customerstories	loaddll64.exe, 00000000.00000003.274373656.00000272B5277000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.275115267.00000272B51F1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.618555648.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.278112709.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.559478883.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.423126748.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481705170.0000000003201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.656727314.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568201754.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.266794324.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.269425656.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.469394560.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.540063088.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.481591686.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.312372105.0000000003204000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.684397645.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.696383069.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.678102368.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.568338884.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.672085117.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000002.00000003.594445082.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
13.225.235.76	dr49lng3n1n2s.cloudfront.net	United States		16509	AMAZON-02US	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	651259
Start date and time: 23/06/202217:59:03	2022-06-23 17:59:03 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	ikvNEF5d2Z (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@11/0@5422/2
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:00:12	API Interceptor	2061x Sleep call for process: regsvr32.exe modified
18:00:12	API Interceptor	6589x Sleep call for process: rundll32.exe modified
18:00:18	API Interceptor	1987x Sleep call for process: loaddll64.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
dr49lng3n1n2s.cloudfront.net	https://view.genial.ly/62b1fb0a1c995900190f57d7	Get hash	malicious	Browse	13.224.92.76
	https://view.genial.ly/62b1fb0a1c995900190f57d7	Get hash	malicious	Browse	13.224.92.76
	71F1C8E85B4187C34451AEA70125E7F21759D7E24ADA3.dll	Get hash	malicious	Browse	13.224.92.74
	jW2Qve3jdv.dll	Get hash	malicious	Browse	13.35.252.74
	G5HXngp4co.exe	Get hash	malicious	Browse	99.86.235.74
	https://t2m.io/mghpr.org	Get hash	malicious	Browse	52.85.119.73
	DNpyWaufTe.exe	Get hash	malicious	Browse	108.138.29.66
	http://my.inboxread.in/wiz/index.php/campaigns/jf278q9a5e1c4/track-url/pr1840f8ho373/5d6fbf4f90d2c7fc01d67cdc5069bfa8a8219b5b	Get hash	malicious	Browse	18.66.14.66
	Ca2N0Si1FI.exe	Get hash	malicious	Browse	143.204.4.75
	42#U0440.xls	Get hash	malicious	Browse	13.224.92.74
	https://sk7hmvqac4.s3.us-south.objectstorage.softlayer.net/electrosynthetically/index.html?key=53fdcebf3db938ebf7c3227c19a54efc&redirect=https://www.amazon.com	Get hash	malicious	Browse	13.224.92.74
	gfS5a7J0AR.exe	Get hash	malicious	Browse	108.138.29.66
	PayPall_Gift10$.exe	Get hash	malicious	Browse	13.225.75.74
	https://efax-109309742pages.webflow.io/404	Get hash	malicious	Browse	13.226.135.73
	6N3KuFGfDG.exe	Get hash	malicious	Browse	13.226.135.73
	http://shorturl.at/cjCH4	Get hash	malicious	Browse	13.224.92.74
	51069AFE5B2C62522B68911C1DCF5BC0A089A76BC193D.exe	Get hash	malicious	Browse	65.9.75.70
	Bh9XiPvzXM.exe	Get hash	malicious	Browse	65.9.75.70
	FwlRpmIPXx.exe	Get hash	malicious	Browse	13.224.92.74
	https://hp.myway.com	Get hash	malicious	Browse	52.84.51.73

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-02US	https://indd.adobe.com/view/3e6540b6-13f7-443b-9b0e-83e915dfe252	Get hash	malicious	Browse	15.236.176.210
	https://app.pipefy.com/public/form/8jheZgD_	Get hash	malicious	Browse	75.2.88.188
	https://ukenthasc.xyz/redirect?tid=846645&file=30_min_lounge_chillout_music_and_relax_lounge_around_the_world_autumn_2020_exclusive_lounge	Get hash	malicious	Browse	52.222.236.74
	__ voicemail audio attachment.htm	Get hash	malicious	Browse	108.157.4.48
	DHL_Shipping Documents_pdf.exe	Get hash	malicious	Browse	34.251.91.168
	https://facility.flazio.com/home?r=507392	Get hash	malicious	Browse	99.84.88.7
	zwVNQZhB8r	Get hash	malicious	Browse	52.198.167.195
	https://clt1448203.bmetrack.com/c/l?u=DFD4233&e=146AE05&c=16190B&t=1&l=80749401&email=IC1Fu8ngaNoWAW0RuCNnTm0vu1uUHZqJ&seq=1#c21jbGFjaGxhbkBtb29nLmNvbQ==	Get hash	malicious	Browse	108.139.229.31
	http://recp.mkt81.net/ctt?m=6839690&r=MjI5NjQwMDYxODgzS0&b=0&j=MTI0MTEyMDE3OAS2&k=NEWSLETTER&kx=1&kt=12&kd=https://aouths.aynax.io	Get hash	malicious	Browse	52.13.6.174
	PO_20230025-03662.js	Get hash	malicious	Browse	3.134.143.128
	PAGO.exe	Get hash	malicious	Browse	3.64.163.50
	arm7	Get hash	malicious	Browse	108.128.223.14
	arm	Get hash	malicious	Browse	18.146.208.77
	HSBC_Bank_Swift MT103.pdf.exe	Get hash	malicious	Browse	3.64.163.50
	https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAA3AAABLblqZhBd-MSI-gOSPXoiDUKeBGzEbuJk0GkHh7LmmDOwKIc9SjYbdDx9scq1qfZpQOexeUFPjZHmqNEFLb_QEtmAydhm&	Get hash	malicious	Browse	13.224.103.67
	https://d15k2d11r6t6rl.cloudfront.net/public/users/Integrators/BeeProAgency/151381_127451/RIQ-Logo.png%5Drnrnrnsales@readitquik.com%3Cmailto:sales@readitquik.com%3E	Get hash	malicious	Browse	13.224.103.125
	purchase order.exe	Get hash	malicious	Browse	75.2.115.196
	02uS4qpoJs.exe	Get hash	malicious	Browse	35.157.111.131
	8t2xXr2BI9.exe	Get hash	malicious	Browse	3.68.171.119
	http://goo.su/zKhc0	Get hash	malicious	Browse	34.243.218.67

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	quideleniti.lnk	Get hash	malicious	Browse	13.225.235.76
	RFQ 10050395.exe	Get hash	malicious	Browse	13.225.235.76
	ETBOdBrV1t.exe	Get hash	malicious	Browse	13.225.235.76
	rfAV6Ve3rP.lnk	Get hash	malicious	Browse	13.225.235.76
	VDXJRDz0Pm.lnk	Get hash	malicious	Browse	13.225.235.76
	praesentiumsit.lnk	Get hash	malicious	Browse	13.225.235.76
	BlueCode_HashFinder_9.3.exe	Get hash	malicious	Browse	13.225.235.76
	reiciendisperferendis.lnk	Get hash	malicious	Browse	13.225.235.76
	etnon.lnk	Get hash	malicious	Browse	13.225.235.76
	ORDER NO-08374345345.pdf.exe	Get hash	malicious	Browse	13.225.235.76
	WTIwNMJTrA.exe	Get hash	malicious	Browse	13.225.235.76
	WTIwNMJTrA.exe	Get hash	malicious	Browse	13.225.235.76
	form_33-109f1_notice_of_termination_of_registered_individuals_and_perm (nb).js	Get hash	malicious	Browse	13.225.235.76
	RFQ_23233.exe	Get hash	malicious	Browse	13.225.235.76
	RQR59GnemD.msi	Get hash	malicious	Browse	13.225.235.76
	4zUp29xeab.msi	Get hash	malicious	Browse	13.225.235.76
	WF0SlQWKr1.docx	Get hash	malicious	Browse	13.225.235.76
	250-copy.docx	Get hash	malicious	Browse	13.225.235.76
	R8B8ktGtaP.exe	Get hash	malicious	Browse	13.225.235.76
	R8k0b4Dnp9.exe	Get hash	malicious	Browse	13.225.235.76

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.431311114789898
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	ikvNEF5d2Z.dll
File size:	240216
MD5:	dfa62565b68736dc443386d68388b269
SHA1:	d64a755f001658c7bc037049259f23807105d8ba
SHA256:	6f57eb37bff30df1a66f848cb648799536dcbc05f6fb32d1ae071102ffd830ee
SHA512:	f6d4858e069016e763b4a7dc193742b7eb841f2409a3c03058255006978b7deb586fff0dd1be3b7cbef03d55fe917507876cbf34d2a0c828fe03a0845f363bee
SSDEEP:	6144:dJJLaU1mUGduNzGSijExi3oomlnG9PS9sfr8mnOySgEBmvpmCZdXWdyqL28888Ie:dJJLaU1mUGduNzGSijExi3oomlnG9PSU
TLSH:	A2346266C598D1BCF2476871357CAB58C550AE80AD12DDE3FAE6C412AF239B123213DF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............j...j...j...i...j...k...j...k...j...j...j...j...j...h...j.Rich..j.................PE..d...!p.`.........." .....:...l.....

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x180005f40
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60917021 [Tue May 4 16:02:41 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	87bed5a7cba00c7e1f4015f1bdae2183

Entrypoint Preview

Instruction
push eax
cmp edx, 01h
jne 00007F0DBCCA9344h
mov eax, 0062F187h
mov dword ptr [esp], eax
mov dword ptr [esp+04h], eax
test dword ptr [esp], 00000003h
mov eax, dword ptr [esp]
je 00007F0DBCCA8E8Bh
lea edx, dword ptr [eax+03h]
test eax, eax
cmovns edx, eax
and edx, FFFFFFFCh
sub eax, edx
mov edx, dword ptr [esp]
cmp eax, 01h
jne 00007F0DBCCA8F0Eh
inc esp
imul ecx, edx, 5EEB2A9Ch
inc ecx
add ecx, 2391704Ah
jmp 00007F0DBCCA8E76h
imul eax, eax, 89D19E3Bh
add eax, 3C3C8D0Eh
mov dword ptr [esp], eax
inc ecx
mov ecx, 2391704Ah
mov eax, dword ptr [esp]
add eax, dword ptr [esp+04h]
inc esp
imul edx, eax, AAAAAAABh
inc ecx
add edx, 2AAAAAAAh
mov edx, dword ptr [00030556h]
lea eax, dword ptr [edx-01h]
imul eax, edx
test al, 01h
sete al
cmp dword ptr [00030548h], 0Ah
inc ecx
setl al
inc ecx
or al, al
inc ecx
cmp edx, 55555555h
jc 00007F0DBCCA8E9Bh
inc ecx
add ecx, 02h
inc ebp
test al, al
je 00007F0DBCCA8E88h
inc esp
add dword ptr [esp], ecx
test dword ptr [esp], 00000003h
jne 00007F0DBCCA900Fh
inc dword ptr [esp]
inc dword ptr [esp+04h]
test dword ptr [esp], 00000003h
je 00007F0DBCCA8E52h
jmp 00007F0DBCCA8EF4h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x35250	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x352b4	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x37000	0xb4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x35020	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x35000	0x20	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x33841	0x33a00	False	0.1523910411622276	data	6.091396505487613	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x35000	0x328	0x400	False	0.4521484375	data	3.9148957731530203	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x36000	0x520	0x600	False	0.4915364583333333	data	4.112210005634511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x37000	0xb4	0x200	False	0.26953125	data	2.0213833104584227	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ndata	0x38000	0x5fff	0x6000	False	0.9743245442708334	data	7.7238018558589765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
KERNEL32.dll	LoadLibraryA, GetProcAddress

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x180001000
PluginInit	2	0x180011c63

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll64.exePID: 6552, Parent PID: 4792

General

Target ID:	0
Start time:	18:00:09
Start date:	23/06/2022
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\ikvNEF5d2Z.dll"
Imagebase:	0x7ff6fcf10000
File size:	140288 bytes
MD5 hash:	4E8A40CAD6CCC047914E3A7830A2D8AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exePID: 6568, Parent PID: 6552

General

Target ID:	1
Start time:	18:00:09
Start date:	23/06/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ikvNEF5d2Z.dll",#1
Imagebase:	0x7ff6dcf80000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exePID: 6576, Parent PID: 6552

General

Target ID:	2
Start time:	18:00:09
Start date:	23/06/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\ikvNEF5d2Z.dll
Imagebase:	0x7ff7bf970000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.321553577.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.267642045.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.269643903.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.297404495.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.292337146.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.277053411.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.298272650.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.311756165.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.319014674.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.295125426.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.314754724.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.317474031.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.304327995.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.305135210.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.320094818.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.265620836.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.293963524.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.309363516.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.411869520.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.302975794.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.282267699.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.275791438.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.262765450.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.263740751.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.299841707.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.351326851.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.265359115.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.271492952.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.262406305.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.278543970.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.407235069.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.437622717.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.293411402.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.491241630.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.280994457.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.297638852.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.415117148.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.416746789.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.298094562.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.268018419.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.264969343.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.272087960.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.307033359.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.270822392.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.317906358.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.267270096.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.312571750.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.290176337.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.454332371.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.299224080.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.306791775.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.295599262.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.263807736.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000002.00000003.274007377.000000000119D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exePID: 6588, Parent PID: 6568

General

Target ID:	3
Start time:	18:00:10
Start date:	23/06/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\ikvNEF5d2Z.dll",#1
Imagebase:	0x7ff60eb80000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.274029943.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.261454717.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.269043278.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.396642532.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.264700847.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.267145571.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.270084280.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.266413828.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.261968567.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.271220559.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.265218608.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.273106192.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.262811825.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.265793313.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.719810116.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.263723615.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.272354753.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.267942385.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000003.274845604.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exePID: 6596, Parent PID: 6552

General

Target ID:	4
Start time:	18:00:10
Start date:	23/06/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\ikvNEF5d2Z.dll,DllRegisterServer
Imagebase:	0x7ff60eb80000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.280507761.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.265795087.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.264618023.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.270691540.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.273346326.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.269326182.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.305936677.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.276312756.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.262421311.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.261647380.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.287602431.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.268258493.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.278246832.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.267338480.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.272644834.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.291011198.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.292690922.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000003.272047247.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exePID: 6804, Parent PID: 6552

General

Target ID:	5
Start time:	18:00:13
Start date:	23/06/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\ikvNEF5d2Z.dll,PluginInit
Imagebase:	0x7ff60eb80000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high