11052024_0208_TAX ORGANIZER 2023_stripped[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
11052024_0208_TAX ORGANIZER 2023_stripped.zip
Size 11.3MB
Sample240511-clep9aaa95
SHA256 9edb362c45d38d223d521d49aed8014917d81a7771026616243c1fa4ab409d1d
MD5 b07047a62a593388fb9ac1737aa1dd1b
SHA1 88208fa286f5d1a9160643f06c7fe2e7dd38f1d6
SHA512 6d989bfec1caf90946ea1f9161cf4e1ea52f2986d7ff2a02d61ecc8598e12f166cad4c9ef3ab4137396d53eb36e5649ce29a86a05b623314cf7300b264193245
SSDEEP 196608:zMdOlFzVl2oyrg/+uF62ouh6zvfOvb3r26HGCd+4du07EvzVO/eTHBsAdYk3:V5hFI2o+jb3r2vCd+4du07KVgeTHGAd5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/TAX ORGANIZER 2023/g2m.dll

File Explorer

11052024_0208_TAX ORGANIZER 2023_stripped.zip

.zip 11.3MB
TAX ORGANIZER 2023/Sandra 2023 Tax Organizer.exe

.exe 31KB
TAX ORGANIZER 2023/g2m.dll

.dll 27.9MB

11052024_0208_TAX ORGANIZER 2023_stripped.zip

SHA256 9edb362c45d38d223d521d49aed8014917d81a7771026616243c1fa4ab409d1d
MD5 b07047a62a593388fb9ac1737aa1dd1b
SHA1 88208fa286f5d1a9160643f06c7fe2e7dd38f1d6
SHA512 6d989bfec1caf90946ea1f9161cf4e1ea52f2986d7ff2a02d61ecc8598e12f166cad4c9ef3ab4137396d53eb36e5649ce29a86a05b623314cf7300b264193245
SSDEEP 196608:zMdOlFzVl2oyrg/+uF62ouh6zvfOvb3r26HGCd+4du07EvzVO/eTHBsAdYk3:V5hFI2o+jb3r2vCd+4du07KVgeTHGAd5
MD5 SHA1 SHA512 SSDEEP

Password

infected

TAX ORGANIZER 2023/Sandra 2023 Tax Organizer.exe

IMPHASH 5419c6d0b7a37c6f48c0d961a0d909db
SHA256 a73709c1b5f1f875ee35f477c4e263a57050c36e2cff31ad1ceca17d9623e7cd
MD5 4db45c5fdb9e115b922bdf007523f082
SHA1 90297382a170ff3ea7931db2425329d0b2f70f04
SHA512 7f0bcb2ee96c523cce764d1ec7d197d3aadddcf6fae71b63e88c3a26883b2f2fb4a446187adfbb023be779056ebc0ea50a785c72bbe97bb7dca41a810d0ff6c7
SSDEEP 384:V4Kj/M8y6ryzqEt7a9Oey+IFdP64VYaEwDtiBgxoxlnLr2STchsCxXBhgBx4eMDg:VHDXr+VWOV+csoHViBBn+hRIqeMDGt
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Password

infected

Digest

90:10:c1:28:da:90:ce:50:43:d1:8e:83:8b:91:69:13:ad:36:49:d0:e1:e4:4b:74:ec:98:20:87:00:85:01:37

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=LogMeIn\, Inc.,O=LogMeIn\, Inc.,L=Boston,ST=Massachusetts,C=US

Chains

Sep 4, 2019

CN=LogMeIn\, Inc.,O=LogMeIn\, Inc.,L=Boston,ST=Massachusetts,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - May 30, 2020

Subject

CN=LogMeIn\, Inc.,O=LogMeIn\, Inc.,L=Boston,ST=Massachusetts,C=US

Serial Number

07:77:dd:21:cf:5d:c9:dc:78:5a:cb:ae:2a:02:bb:26

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 26, 2018 - Nov 3, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Minor OS version

Major OS version

Entry point

4111

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\Communication_Cloud\G2MWTEndpoint\Production\build-g2mwt-endpoint\output\G2M_Exe.pdb

TAX ORGANIZER 2023/g2m.dll

IMPHASH 68d2b994f2e04c39bc7b7badfe0d5509
SHA256 d7350580234b4ec776d869758ffab607f2ff42efe3a938b140ad182417cd4e29
MD5 0a2c9acac48e85f0be788220ff712a3e
SHA1 2e1fbba29f518b8e98bc4bb0dfc3ef1c6d8f2261
SHA512 9fbb5242355feb5b0cf1c4f00ae0fe0646aba1d11338fe078b3e37defda0e1b164b19a02a14568bc7d7bf2716b4a38dbc16da744230c01550b2642d50df4b298
SSDEEP 393216:lezzyEDJ63vIMxrsjnh7CHfqkALvIzhJRYiE/XWKNnBcRlp:8zHCvRGwCXUhJRYiE+0nBcRT
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

12531640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\p4builds\Products\GoToMeeting\release-724\output\G2M_Dll.pdb

rpcrt4

NdrCStdStubBuffer_Release UuidToStringW UuidCreate RpcStringFreeW CStdStubBuffer_DebugServerRelease CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_CountRefs NdrDllGetClassObject NdrOleAllocate NdrOleFree CStdStubBuffer_QueryInterface CStdStubBuffer_AddRef IUnknown_QueryInterface_Proxy IUnknown_AddRef_Proxy CStdStubBuffer_Connect CStdStubBuffer_Disconnect CStdStubBuffer_Invoke IUnknown_Release_Proxy CStdStubBuffer_IsIIDSupported

netapi32

NetApiBufferFree Netbios NetUserGetInfo DsGetDcNameW

psapi

GetModuleBaseNameW EnumProcessModules EnumProcesses GetModuleInformation GetModuleFileNameExW

wsock32

send recv WSAGetLastError shutdown recvfrom ntohl inet_addr sendto setsockopt select ntohs htonl getsockopt getsockname getpeername connect WSACleanup __WSAFDIsSet gethostname gethostbyname accept bind closesocket inet_ntoa htons ioctlsocket listen socket WSAStartup WSASetLastError

shlwapi

PathRemoveExtensionW PathStripPathW StrChrW StrFormatByteSizeW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

powrprof

CallNtPowerInformation

secur32

InitSecurityInterfaceA GetUserNameExW

wininet

HttpQueryInfoW InternetErrorDlg HttpEndRequestW HttpAddRequestHeadersW InternetSetStatusCallbackW InternetSetOptionW InternetConnectW InternetReadFileExA HttpSendRequestExW InternetQueryOptionW InternetCrackUrlW InternetCanonicalizeUrlW InternetCloseHandle InternetOpenW InternetCreateUrlW HttpOpenRequestW

kernel32

FileTimeToSystemTime GlobalMemoryStatusEx LocalAlloc GetSystemInfo lstrcmpiW lstrlenA GetLocaleInfoW OpenProcess GetCurrentThread GetShortPathNameW GetModuleHandleExW WriteFile ReadFile FlushFileBuffers SetEndOfFile SetFilePointer FindClose SetFileTime GetTempFileNameW GetDiskFreeSpaceExW GetFileAttributesW DeleteFileW FindFirstFileW CopyFileW MoveFileW GetLocalTime GetTempPathW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW RemoveDirectoryW ReleaseMutex CreateMutexW SetThreadPriority GetThreadPriority TerminateThread ResumeThread InitializeCriticalSection TerminateProcess GetExitCodeProcess CreateProcessW CompareFileTime FindNextFileW WaitForMultipleObjects GetProcessTimes GetSystemTimeAsFileTime GetTimeZoneInformation GetTickCount QueryPerformanceCounter QueryPerformanceFrequency GetTimeFormatW GetDateFormatW CreateToolhelp32Snapshot Process32FirstW Process32NextW ResetEvent CreateEventW OpenEventW QueryDosDeviceW FindFirstVolumeW FindNextVolumeW FindVolumeClose LoadResource SizeofResource FindResourceW HeapReAlloc HeapSize GetProcessHeap OpenMutexW MulDiv GetTempPathA CreateDirectoryA GetWindowsDirectoryW GetEnvironmentVariableW SetEnvironmentVariableW SystemTimeToFileTime GlobalAlloc GlobalLock GlobalUnlock FlushInstructionCache lstrcmpW CreateWaitableTimerW SetWaitableTimer SetProcessShutdownParameters GetCommandLineW GetVersionExA GetFileTime LockResource GlobalFree Thread32First Thread32Next ExitProcess InterlockedExchange InterlockedExchangeAdd GetProcessId DuplicateHandle CreateThread OpenFileMappingW lstrlenW LoadLibraryExA TlsFree HeapFree HeapAlloc HeapDestroy HeapCreate GetSystemWindowsDirectoryW LoadLibraryW SetEvent CreateEventA CreateFileW CreateFileMappingW UnmapViewOfFile MapViewOfFile CloseHandle GetFileSize WaitForSingleObject GetCurrentThreadId GetCurrentProcessId WideCharToMultiByte MultiByteToWideChar GetSystemDirectoryW LoadLibraryExW GetVersionExW IsBadReadPtr TlsSetValue TlsGetValue TlsAlloc Sleep SetUnhandledExceptionFilter GetCurrentProcess FreeLibrary OutputDebugStringW FormatMessageW LocalFree SetThreadLocale GetThreadLocale GetModuleHandleW GetModuleFileNameW LeaveCriticalSection EnterCriticalSection GetProcAddress InterlockedDecrement InterlockedIncrement EncodePointer DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException DisableThreadLibraryCalls DecodePointer AreFileApisANSI EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW SetLastError GetSystemTime CompareStringW FreeLibraryAndExitThread WaitForSingleObjectEx InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateSemaphoreW GetStartupInfoW UnhandledExceptionFilter GetCPInfo RegisterWaitForSingleObject ReadConsoleInputA SetConsoleMode LocalFileTimeToFileTime CreateTimerQueue SignalObjectAndWait SwitchToThread GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer RtlUnwind GetACP ExitThread DeleteTimerQueueTimer GetNumaHighestNodeNumber GetCommandLineA VirtualFree VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent FormatMessageA GetStringTypeW GetFileType GetModuleFileNameA GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetOEMCP GetConsoleCP GetConsoleMode SetConsoleCtrlHandler SetFilePointerEx SetStdHandle WriteConsoleW SetEnvironmentVariableA ReadConsoleW ReleaseSemaphore GetModuleHandleA GlobalMemoryStatus LoadLibraryA FlushConsoleInputBuffer GetPrivateProfileSectionW GetPrivateProfileSectionNamesW UnregisterWait VirtualProtect FindFirstFileExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToLocalFileTime GetSystemDefaultLCID EnumResourceLanguagesW GetFileInformationByHandle PeekNamedPipe GetFullPathNameW VerifyVersionInfoW VerSetConditionMask InterlockedCompareExchange OpenEventA GetFileSizeEx GetExitCodeThread MoveFileA FindNextFileA FindFirstFileA GetFileAttributesExA SetThreadAffinityMask GetProcessAffinityMask CreateWaitableTimerA SetPriorityClass FreeConsole AllocConsole OutputDebugStringA CreateMutexA GetLocaleInfoA GetNativeSystemInfo CreateSemaphoreA GetOverlappedResult ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState FoldStringW GetVolumeInformationW WaitNamedPipeW CreateNamedPipeW SetThreadExecutionState ExpandEnvironmentStringsW FreeResource GetThreadTimes OpenThread GetUserDefaultUILanguage GetStdHandle

gdi32

SetPixel SetROP2 GetClipRgn IntersectClipRect CreateBitmap GetObjectA ExtTextOutW GetRgnBox GetRegionData EqualRgn CreateRectRgnIndirect DPtoLP OffsetRgn GetSystemPaletteEntries CreatePalette Polyline GetPaletteEntries SetDIBColorTable GetDIBColorTable CreateDIBSection SaveDC RestoreDC GetDCOrgEx CreateDCW FillRgn PtInRegion CreatePen Polygon SetPolyFillMode PaintRgn FrameRgn SetDCPenColor SetDCBrushColor Rectangle CreateEllipticRgn GetTextMetricsW SetBkColor CreatePolygonRgn CreateRoundRectRgn SetStretchBltMode StretchBlt SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx MoveToEx SetPixelV SetMapMode SelectClipRgn LineTo GetPixel GetClipBox SetRectRgn ExcludeClipRect CreateRectRgn CombineRgn GetTextExtentPoint32W SetDIBits GetDIBits CreateDIBitmap GetBitmapBits TextOutW SetTextColor GetTextColor GetBkMode CreateFontW CreateFontIndirectW SetBrushOrgEx SetBkMode CreatePatternBrush GetObjectW SelectObject GetStockObject DeleteObject DeleteDC CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap BitBlt GetDeviceCaps

comdlg32

GetSaveFileNameW ChooseColorW GetOpenFileNameW CommDlgExtendedError

ole32

OleLockRunning CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoGetCurrentProcess StringFromGUID2 CoRegisterClassObject CoInitialize CoRegisterPSClsid RegisterDragDrop RevokeDragDrop ReleaseStgMedium StringFromCLSID PropVariantClear CreateStreamOnHGlobal CLSIDFromProgID CLSIDFromString CoGetClassObject CoRevokeClassObject CoGetCallContext CoSetProxyBlanket CoDisconnectObject CoInitializeSecurity CoGetObject CoCreateGuid StringFromIID IIDFromString CoFreeUnusedLibraries CoCreateInstance CoInitializeEx CoUninitialize OleUninitialize OleInitialize OleRun

oleaut32

SafeArrayUnaccessData OleLoadPicturePath VarBstrCat SafeArrayAccessData SafeArrayCreate OleLoadPicture OleCreateFontIndirect DispCallFunc LoadRegTypeLi VariantClear VariantInit SysStringByteLen SysAllocStringLen VarUI4FromStr LPSAFEARRAY_UserFree LPSAFEARRAY_UserMarshal LPSAFEARRAY_UserSize BSTR_UserFree BSTR_UserUnmarshal BSTR_UserMarshal BSTR_UserSize UnRegisterTypeLi RegisterTypeLi LoadTypeLi SysStringLen SysAllocString SysFreeString VariantChangeType SafeArrayDestroy SafeArrayPutElement SafeArrayGetElement SysAllocStringByteLen SafeArrayGetUBound OleCreatePropertyFrame VariantCopy VarBstrCmp SystemTimeToVariantTime SafeArrayGetLBound LPSAFEARRAY_UserUnmarshal

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

comctl32

ord412 InitCommonControlsEx ord410 ord413

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

winmm

mixerClose mixerGetNumDevs timeSetEvent timeKillEvent timeGetTime mmioAscend mmioDescend mmioRead mmioClose mmioOpenA mmioOpenW waveOutPause waveInGetPosition waveInReset waveInStop waveInStart waveInAddBuffer waveInUnprepareHeader waveInPrepareHeader waveInGetErrorTextW waveOutGetPosition waveOutReset waveOutWrite waveOutUnprepareHeader waveOutPrepareHeader waveOutGetErrorTextW waveOutSetVolume waveOutGetVolume timeBeginPeriod mixerSetControlDetails timeEndPeriod mixerGetControlDetailsW mixerGetLineControlsW mixerGetLineInfoW waveInGetNumDevs mixerGetDevCapsW mixerOpen waveOutMessage waveInMessage waveOutGetDevCapsW waveInGetDevCapsW waveOutGetNumDevs waveInOpen waveOutOpen waveInClose waveOutClose mixerGetID waveInGetID waveOutGetID

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

d3d9

Direct3DCreate9

msacm32

acmStreamPrepareHeader acmStreamClose acmStreamUnprepareHeader acmStreamOpen acmStreamConvert

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW

iphlpapi

GetAdaptersInfo

crypt32

CertCreateCertificateContext CertAddEncodedCertificateToStore CertGetNameStringA CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertCloseStore CertOpenStore CertGetNameStringW

ws2_32

WSAAddressToStringA getaddrinfo freeaddrinfo getnameinfo WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSASetEvent WSASend WSAIoctl

Name

.text

Size

22.0MB

Virtual Size

22.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

IPPCODE

Size

903KB

Virtual Size

904KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

430KB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

IPPDATA

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

970KB

Virtual Size

970KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=8, id=199, version=41118,

count=84, id=223, productName=VS2013 build 21005, version=21005,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=161, id=225, productName=VS2013 build 21005, version=21005,

count=9, id=225, version=20806,

count=10, id=224, productName=VS2013 UPD2 build 30501, version=30501,

count=155, id=205, version=50522,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=18, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=3492, productName=Unmarked objects (old),

count=179, id=229, version=31101,

count=1024, id=1, productName=Unmarked objects,

count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=43, id=224, productName=VS2013 UPD3 build 30723, version=30723,

count=316, id=224, productName=VS2013 build 21005, version=21005,

count=24, id=225, productName=VS2013 UPD3 build 30723, version=30723,

count=726, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=3179, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,

Sharing

General

Malware Config

Signatures

File Explorer

11052024_0208_TAX ORGANIZER 2023_stripped.zip

TAX ORGANIZER 2023/Sandra 2023 Tax Organizer.exe

kernel32

user32

g2m

generic

TAX ORGANIZER 2023/g2m.dll

rpcrt4

netapi32

psapi

wsock32

shlwapi

version

powrprof

secur32

wininet

kernel32

gdi32

comdlg32

ole32

oleaut32

wtsapi32

comctl32

userenv

winmm

avicap32

d3d9

msacm32

setupapi

iphlpapi

crypt32

ws2_32

generic