19042024_0340_2023 Tax Organizer[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
19042024_0340_2023 Tax Organizer.zip
Size 10.6MB
Sample240419-d8xp1sff94
SHA256 bd8ff468b6fb4958059537257894153fc0cb9eb43f4a05c0b7c42ddd0fac7df9
MD5 283f7eabb82f578f49510915c4b2bf4f
SHA1 719ddeb335d1a6ce6d58826a363e249d974b82f7
SHA512 c5fd5916505024bca1c9fbbdadfb8e851072a8923d469778aefa7445aa174040494dd23ec32e5f55b9be1fb1db4bc710ea62191339432b412289a290a741c512
SSDEEP 196608:Kr1D+scr7majR7NAiGmVRui3sBpQnAuRjoks+NhRKzxcneL94YoNpZVlV:KBD+sJ+2rmt3sBpQn7RkR8G94tpZd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Tax Organizer 2023/g2m.dll

File Explorer

19042024_0340_2023 Tax Organizer.zip

.zip 10.6MB
Tax Organizer 2023/Tax Organizer.exe

.exe 31KB
Tax Organizer 2023/g2m.dll

.dll 25.9MB

19042024_0340_2023 Tax Organizer.zip

SHA256 bd8ff468b6fb4958059537257894153fc0cb9eb43f4a05c0b7c42ddd0fac7df9
MD5 283f7eabb82f578f49510915c4b2bf4f
SHA1 719ddeb335d1a6ce6d58826a363e249d974b82f7
SHA512 c5fd5916505024bca1c9fbbdadfb8e851072a8923d469778aefa7445aa174040494dd23ec32e5f55b9be1fb1db4bc710ea62191339432b412289a290a741c512
SSDEEP 196608:Kr1D+scr7majR7NAiGmVRui3sBpQnAuRjoks+NhRKzxcneL94YoNpZVlV:KBD+sJ+2rmt3sBpQn7RkR8G94tpZd
MD5 SHA1 SHA512 SSDEEP

Password

infected

Tax Organizer 2023/Tax Organizer.exe

IMPHASH 5419c6d0b7a37c6f48c0d961a0d909db
SHA256 a73709c1b5f1f875ee35f477c4e263a57050c36e2cff31ad1ceca17d9623e7cd
MD5 4db45c5fdb9e115b922bdf007523f082
SHA1 90297382a170ff3ea7931db2425329d0b2f70f04
SHA512 7f0bcb2ee96c523cce764d1ec7d197d3aadddcf6fae71b63e88c3a26883b2f2fb4a446187adfbb023be779056ebc0ea50a785c72bbe97bb7dca41a810d0ff6c7
SSDEEP 384:V4Kj/M8y6ryzqEt7a9Oey+IFdP64VYaEwDtiBgxoxlnLr2STchsCxXBhgBx4eMDg:VHDXr+VWOV+csoHViBBn+hRIqeMDGt
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Password

infected

Digest

90:10:c1:28:da:90:ce:50:43:d1:8e:83:8b:91:69:13:ad:36:49:d0:e1:e4:4b:74:ec:98:20:87:00:85:01:37

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=LogMeIn\, Inc.,O=LogMeIn\, Inc.,L=Boston,ST=Massachusetts,C=US

Chains

Sep 4, 2019

CN=LogMeIn\, Inc.,O=LogMeIn\, Inc.,L=Boston,ST=Massachusetts,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - May 30, 2020

Subject

CN=LogMeIn\, Inc.,O=LogMeIn\, Inc.,L=Boston,ST=Massachusetts,C=US

Serial Number

07:77:dd:21:cf:5d:c9:dc:78:5a:cb:ae:2a:02:bb:26

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 26, 2018 - Nov 3, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Minor OS version

Major OS version

Entry point

4111

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\Communication_Cloud\G2MWTEndpoint\Production\build-g2mwt-endpoint\output\G2M_Exe.pdb

Tax Organizer 2023/g2m.dll

IMPHASH 7a3f4df5134515e5cd11f422da6c8d86
SHA256 2643dbabde4595b6505a2c5f74810022a75322cb1c0a7a889783ad794f55df7d
MD5 485b8cc54d8a2fc27a1c0c1cafe21811
SHA1 b0011058e2babc680273aacf9eb382e85532d5a5
SHA512 e7e7c207d76e00b047875b0937b6b81dbfd2623095095aaff656e2b9c90c49b5ba710bf9f997af346a928f7d1967cb39ee842e6ee62792aa5d100d90bdd86560
SSDEEP 196608:+5H3zHriM3lONIfjm0S6VFWxtswdO8Nw3MRfW8+IiAp7kz8roTsWbbh7nkMM9haK:8rmKSPoTsWbbh7nkMGRNc4Y/kyZpJIgi
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

11886600

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\p4builds\Products\GoToMeeting\release-723\output\G2M_Dll.pdb

rpcrt4

NdrCStdStubBuffer_Release UuidToStringW UuidCreate RpcStringFreeW CStdStubBuffer_DebugServerRelease CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_CountRefs NdrDllGetClassObject NdrOleAllocate NdrOleFree CStdStubBuffer_QueryInterface CStdStubBuffer_AddRef IUnknown_QueryInterface_Proxy CStdStubBuffer_Connect IUnknown_AddRef_Proxy CStdStubBuffer_Disconnect CStdStubBuffer_Invoke IUnknown_Release_Proxy CStdStubBuffer_IsIIDSupported

netapi32

NetApiBufferFree Netbios NetUserGetInfo DsGetDcNameW

psapi

GetModuleBaseNameW EnumProcessModules EnumProcesses GetModuleInformation GetModuleFileNameExW

wsock32

send recv WSAGetLastError shutdown recvfrom ntohl inet_addr sendto setsockopt select ntohs htonl getsockopt getsockname getpeername connect WSACleanup __WSAFDIsSet gethostname gethostbyname accept bind closesocket inet_ntoa htons ioctlsocket listen socket WSAStartup WSASetLastError

shlwapi

PathRemoveExtensionW PathStripPathW StrChrW StrFormatByteSizeW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

powrprof

CallNtPowerInformation

secur32

InitSecurityInterfaceA GetUserNameExW

wininet

HttpQueryInfoW HttpAddRequestHeadersW InternetSetStatusCallbackW InternetSetOptionW InternetConnectW InternetReadFileExA InternetErrorDlg HttpEndRequestW HttpSendRequestExW InternetQueryOptionW InternetCrackUrlW InternetCanonicalizeUrlW InternetCloseHandle InternetOpenW InternetCreateUrlW HttpOpenRequestW

kernel32

GetSystemTime SystemTimeToFileTime FileTimeToSystemTime GlobalMemoryStatusEx LocalAlloc GetSystemInfo lstrcmpiW lstrlenA GetLocaleInfoW OpenProcess GetCurrentThread GetShortPathNameW GetModuleHandleExW WriteFile ReadFile FlushFileBuffers SetEndOfFile SetFilePointer FindClose SetFileTime GetTempFileNameW GetDiskFreeSpaceExW GetFileAttributesW DeleteFileW FindFirstFileW CopyFileW MoveFileW GetLocalTime GetTempPathW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW RemoveDirectoryW ReleaseMutex CreateMutexW SetThreadPriority GetThreadPriority TerminateThread ResumeThread InitializeCriticalSection TerminateProcess GetExitCodeProcess CreateProcessW CompareFileTime FindNextFileW WaitForMultipleObjects GetProcessTimes GetSystemTimeAsFileTime GetTimeZoneInformation GetTickCount QueryPerformanceCounter QueryPerformanceFrequency GetTimeFormatW GetDateFormatW CreateToolhelp32Snapshot Process32FirstW Process32NextW ResetEvent CreateEventW OpenEventW QueryDosDeviceW FindFirstVolumeW FindNextVolumeW FindVolumeClose LoadResource SizeofResource FindResourceW HeapReAlloc HeapSize GetProcessHeap OpenMutexW MulDiv GetTempPathA CreateDirectoryA GetWindowsDirectoryW GetEnvironmentVariableW TlsFree SetLastError GlobalAlloc GlobalLock GlobalUnlock FlushInstructionCache lstrcmpW CreateWaitableTimerW SetWaitableTimer SetProcessShutdownParameters GetCommandLineW GetVersionExA GetFileTime LockResource GlobalFree Thread32First Thread32Next ExitProcess InterlockedExchange InterlockedExchangeAdd GetProcessId DuplicateHandle CreateThread OpenFileMappingW lstrlenW LoadLibraryExA HeapAlloc HeapDestroy HeapCreate GetSystemWindowsDirectoryW LoadLibraryW SetEvent CreateEventA CreateFileW CreateFileMappingW UnmapViewOfFile MapViewOfFile CloseHandle GetFileSize WaitForSingleObject GetCurrentThreadId GetCurrentProcessId WideCharToMultiByte MultiByteToWideChar GetSystemDirectoryW LoadLibraryExW GetVersionExW IsBadReadPtr TlsSetValue TlsGetValue TlsAlloc Sleep SetUnhandledExceptionFilter GetCurrentProcess FreeLibrary OutputDebugStringW FormatMessageW LocalFree SetThreadLocale GetThreadLocale GetModuleHandleW GetModuleFileNameW LeaveCriticalSection EnterCriticalSection GetProcAddress InterlockedDecrement InterlockedIncrement EncodePointer DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException DisableThreadLibraryCalls DecodePointer IsValidLocale LCMapStringW CompareStringW CreateSemaphoreW GetStartupInfoW UnhandledExceptionFilter GetCPInfo SetEnvironmentVariableW HeapFree ReadConsoleInputA SetConsoleMode LocalFileTimeToFileTime RtlUnwind GetACP ExitThread CreateTimerQueue WaitForSingleObjectEx SignalObjectAndWait SwitchToThread GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber RegisterWaitForSingleObject UnregisterWait FindFirstFileExW GetCommandLineA VirtualFree VirtualAlloc GetDriveTypeW SystemTimeToTzSpecificLocalTime FreeLibraryAndExitThread VirtualProtect IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent FormatMessageA GetStringTypeW EnumSystemLocalesW AreFileApisANSI GetStdHandle GetFileType GetModuleFileNameA GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetOEMCP GetConsoleCP GetConsoleMode SetConsoleCtrlHandler SetFilePointerEx SetStdHandle WriteConsoleW SetEnvironmentVariableA ReadConsoleW ReleaseSemaphore GetModuleHandleA GlobalMemoryStatus LoadLibraryA FlushConsoleInputBuffer GetPrivateProfileSectionW GetPrivateProfileSectionNamesW GetSystemDefaultLCID EnumResourceLanguagesW InterlockedFlushSList QueryDepthSList UnregisterWaitEx FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetFullPathNameW GetUserDefaultUILanguage OpenThread VerifyVersionInfoW VerSetConditionMask InterlockedCompareExchange OpenEventA GetFileSizeEx GetExitCodeThread MoveFileA FindNextFileA FindFirstFileA GetFileAttributesExA SetThreadAffinityMask GetProcessAffinityMask CreateWaitableTimerA SetPriorityClass FreeConsole AllocConsole OutputDebugStringA CreateMutexA GetLocaleInfoA GetNativeSystemInfo CreateSemaphoreA GetOverlappedResult ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState WaitNamedPipeW FoldStringW GetVolumeInformationW CreateNamedPipeW SetThreadExecutionState ExpandEnvironmentStringsW FreeResource GetThreadTimes GetUserDefaultLCID

gdi32

GetRegionData FillRgn SetPixel SetROP2 GetClipRgn IntersectClipRect CreateBitmap GetObjectA ExtTextOutW EqualRgn CreateRectRgnIndirect DPtoLP OffsetRgn GetSystemPaletteEntries CreatePalette Polyline GetPaletteEntries SetDIBColorTable GetDIBColorTable CreateDIBSection SaveDC RestoreDC GetDCOrgEx CreateDCW GetRgnBox PtInRegion CreatePen Polygon SetPolyFillMode PaintRgn FrameRgn SetDCPenColor SetDCBrushColor Rectangle CreateEllipticRgn GetTextMetricsW SetBkColor CreatePolygonRgn CreateRoundRectRgn SetStretchBltMode StretchBlt SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx MoveToEx SetPixelV SetMapMode SelectClipRgn LineTo GetPixel GetClipBox SetRectRgn ExcludeClipRect CreateRectRgn CombineRgn GetTextExtentPoint32W SetDIBits GetDIBits CreateDIBitmap GetBitmapBits TextOutW SetTextColor GetTextColor GetBkMode CreateFontW CreateFontIndirectW SetBrushOrgEx SetBkMode CreatePatternBrush GetObjectW SelectObject GetStockObject DeleteObject DeleteDC CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap BitBlt GetDeviceCaps

comdlg32

GetSaveFileNameW ChooseColorW CommDlgExtendedError GetOpenFileNameW

ole32

OleLockRunning CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoGetCurrentProcess StringFromGUID2 CoCreateInstance CoInitialize CoRegisterClassObject RegisterDragDrop RevokeDragDrop ReleaseStgMedium StringFromCLSID PropVariantClear CreateStreamOnHGlobal CLSIDFromProgID CLSIDFromString CoGetClassObject CoInitializeEx CoRevokeClassObject CoRegisterPSClsid CoGetCallContext CoSetProxyBlanket CoDisconnectObject CoInitializeSecurity CoGetObject CoCreateGuid IIDFromString OleRun CoFreeUnusedLibraries CoUninitialize OleUninitialize OleInitialize StringFromIID

oleaut32

OleLoadPicture SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData OleLoadPicturePath VarBstrCat OleCreateFontIndirect DispCallFunc LoadRegTypeLi VariantClear VariantInit SysStringByteLen SysAllocStringLen VarUI4FromStr LPSAFEARRAY_UserFree LPSAFEARRAY_UserMarshal LPSAFEARRAY_UserSize BSTR_UserFree BSTR_UserUnmarshal BSTR_UserMarshal BSTR_UserSize UnRegisterTypeLi RegisterTypeLi LoadTypeLi SysStringLen SysAllocString SysFreeString VariantChangeType SafeArrayGetElement SafeArrayDestroy SafeArrayPutElement OleCreatePropertyFrame VariantCopy VarBstrCmp SystemTimeToVariantTime SafeArrayGetLBound SafeArrayGetUBound SysAllocStringByteLen LPSAFEARRAY_UserUnmarshal

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

comctl32

ord412 InitCommonControlsEx ord413 ord410

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

winmm

mixerClose mixerGetNumDevs timeSetEvent timeKillEvent timeGetTime mmioAscend mmioDescend mmioRead mmioClose mmioOpenA mmioOpenW waveOutPause waveInGetPosition waveInReset waveInStop waveInStart waveInAddBuffer waveInUnprepareHeader waveInPrepareHeader waveInGetErrorTextW waveOutGetPosition waveOutReset waveOutWrite waveOutUnprepareHeader waveOutPrepareHeader waveOutGetErrorTextW waveOutSetVolume waveOutGetVolume timeBeginPeriod mixerSetControlDetails timeEndPeriod mixerGetControlDetailsW mixerGetLineControlsW mixerGetLineInfoW waveInGetNumDevs mixerGetDevCapsW mixerOpen waveOutMessage waveInMessage waveOutGetDevCapsW waveInGetDevCapsW waveOutGetNumDevs waveInOpen waveOutOpen waveInClose waveOutClose mixerGetID waveInGetID waveOutGetID

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

d3d9

Direct3DCreate9

msacm32

acmStreamPrepareHeader acmStreamConvert acmStreamUnprepareHeader acmStreamOpen acmStreamClose

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW

iphlpapi

GetAdaptersInfo

crypt32

CertGetNameStringA CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertAddEncodedCertificateToStore CertCloseStore CertCreateCertificateContext CertGetNameStringW CertOpenStore

ws2_32

WSAAddressToStringA getaddrinfo freeaddrinfo getnameinfo WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSASetEvent WSASend WSAIoctl

Name

.text

Size

20.5MB

Virtual Size

20.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

IPPCODE

Size

694KB

Virtual Size

696KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

396KB

Virtual Size

1012KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

IPPDATA

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

966KB

Virtual Size

965KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=5, id=199, version=41118,

count=83, id=223, productName=VS2013 build 21005, version=21005,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=160, id=225, productName=VS2013 build 21005, version=21005,

count=9, id=225, version=20806,

count=10, id=224, productName=VS2013 UPD2 build 30501, version=30501,

count=150, id=205, version=50522,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=18, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=3256, productName=Unmarked objects (old),

count=176, id=229, version=31101,

count=1021, id=1, productName=Unmarked objects,

count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=43, id=224, productName=VS2013 UPD3 build 30723, version=30723,

count=306, id=224, productName=VS2013 build 21005, version=21005,

count=725, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=3000, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,

Sharing

General

Malware Config

Signatures

File Explorer

19042024_0340_2023 Tax Organizer.zip

Tax Organizer 2023/Tax Organizer.exe

kernel32

user32

g2m

generic

Tax Organizer 2023/g2m.dll

rpcrt4

netapi32

psapi

wsock32

shlwapi

version

powrprof

secur32

wininet

kernel32

gdi32

comdlg32

ole32

oleaut32

wtsapi32

comctl32

userenv

winmm

avicap32

d3d9

msacm32

setupapi

iphlpapi

crypt32

ws2_32

generic