Analysis
- user interaction
yes - max time kernel
124s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/09/2026, 21:04
Static task
static1
Behavioral task
behavioral1
Sample
ablebits-ultimate-suite-excel-v2026-1-3877-2566.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
300 seconds
Behavioral task
behavioral2
Sample
ablebits-ultimate-suite-excel-v2026-1-3877-2566.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
25 signatures
300 seconds
General
- Target ablebits-ultimate-suite-excel-v2026-1-3877-2566.exe
- Size 32.1MB
- Sample260901-zw1f2abk21
- SHA256 05678291f1ae7ea50d85b84d4ae62d6aa58795cb2b6b05e0a35d699fe5025f29
- MD5 304a874108f2bd4a49c4dac075bf33c9
- SHA1 0564ce043e6863010753097ac05c6f613d9d19b5
- SHA512 1c3fd7dd32dd95bb84acabcec8e6ae9470d04b7a030d9e05f28d333ab39b0a651e36c3f59f02f3e72a7170ecc7deacb65e1f72f99667d4b9e1e22f1723db8fc4
- SSDEEP 786432:+s+zD0s1WbpUjqavtR4yZdJVlocWVG9ktfbWEn+E/4QIP+:+ND0YWbpUjv12yfTlo0KtfkEA9G
- TLSH T1FB7733187681B131D1B30534D9A6F2B0493BBE145AD2940277C8B99EAF31BB0A3F5B5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Manipulates Digital Signatures 1 TTPs 2 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03B6A2D771A81212474B5444BFF77A3059E9BE64\Blob = 03000000010000001400000003b6a2d771a81212474b5444bff77a3059e9be642000000001000000800700003082077c30820564a003020102021017aceb2c96223b38ec08986355904e8c300d06092a864886f70d01010b0500306a310b300906035504061302504c3121301f060355040a131841737365636f20446174612053797374656d7320532e412e313830360603550403132f43657274756d20457874656e6465642056616c69646174696f6e20436f6465205369676e696e672032303231204341301e170d3233303632363130313731335a170d3236303632353130313731325a3082013531133011060b2b0601040182373c0201031302504c311c301a060b2b0601040182373c0201020c0b6d617a6f776965636b696531193017060b2b0601040182373c0201010c08576172737a617761310f300d0603550411130630352d303932311d301b06035504090c14756c2e20576172737a6177736b61203130392f35311d301b060355040f131450726976617465204f7267616e697a6174696f6e311330110603550405130a30303030393033383631310b300906035504061302504c3114301206035504080c0b6d617a6f776965636b69653112301006035504070c09c5816f6d69616e6b6931243022060355040a0c1b4f6666696365204461746120417070732053702e207a206f2e6f2e3124302206035504030c1b4f6666696365204461746120417070732053702e207a206f2e6f2e308201a2300d06092a864886f70d01010105000382018f003082018a0282018100a09ed9beb912d61bfa6152466b37ff233c838a7bb35c825ef28cdb1170657627a89cb3897f283cc89eb5c7f6a9646676578d428befd863deddd6c463e728b6c9ccae0b8e59ad56f07d8a867cd366bcb7912ffcd42cdd12273c3999f878a76c0edee8ea0d7ed2c6ca1d582ab7f7baefa5e4689073bc916f1ad34143faf2b1b5930e060b0bc0ab2dfda0ac9ee7c4e4b83c0a03201404748870561ebc4b1b946ca4ea52ca64039d46ce29d817351d022ee1c9215c923abb9298926d31c3e992635437cda4e566d33fcaaa0ccae6ccbc008964b5d415c140594b72c2e4720e6d4cd0d870dbfb992c95f22a7cb46ad9bf632fff53fbb2adc719b51590b09059755e8ddc32e3220e468528f34e46677a20d3dca9c1ad2f477ce5d78f5d99942c7f2fee126581df6f6a64b423374376ef0399e803751f3efdbcd12776bd7a6d8a6fbae4dcbd8419c875a0a7d928a4059bd1ad995b7fd86dd4c83d8df5f2c659d7fc2db5976432cc240effa1cfa348d1c1880a941d5406f11cc6b467e23e2502930002950203010001a38201cf308201cb300c0603551d130101ff0402300030410603551d1f043a30383036a034a0328630687474703a2f2f63657663736361323032312e63726c2e63657274756d2e706c2f63657663736361323032312e63726c307706082b06010505070101046b3069302e06082b060105050730018622687474703a2f2f63657663736361323032312e6f6373702d63657274756d2e636f6d303706082b06010505073002862b687474703a2f2f7265706f7369746f72792e63657274756d2e706c2f63657663736361323032312e636572301f0603551d23041830168014ac57ca0816dc3fc5311c0a4ddbfbf1de99272d34301d0603551d0e04160414fec1efe4c7558281349bdf69d378980275966989304a0603551d20044330413007060567810c01033036060b2a84680186f677020501073027302506082b06010505070201161968747470733a2f2f7777772e63657274756d2e706c2f43505330130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780304e0603551d1104473045a04306082b06010505070803a03730350c33504c2d4d415a4f574945434b49452d574152535a4157412d4f4646494345204441544120415050532053502e205a204f2e4f2e300d06092a864886f70d01010b050003820201004cf9ee0e4a992011de9d4ae0732f6b2fa36a941712bad47696a266104abebf6ae3f0d14b87a3c43125eb8593254dc1e8980b7c2cf64fb35455746ee74e5adef3c5cfdddeb72659d745f8c4860df759a7aef6b6d8b2e22119be614cdb8dccabf515745f03a3102427bd689ebe14fc7d5728c142ed5922c477847e328536991f7f3cfd4bbac9ef8e7e0c9c911422ddf512e27fcecdc430f079ae7541dd1962c5b86234ef7503d8beea2946d690aab29cf11414813d06b99487d340e0b21e757a0ec6f233feba8ac15bf95d9bd7f0ca72e45ed042957cadd916591454403d514d370dca5eea38f6faaf6f812fc6e8740650d27793d675c9d30a18c636ae22ebd242dd6458d69b1300316cf653081d8d5ae003153b6fbef86a4afdc3fdba98a556278aabbf26b89886982c3fc15afd2668d339eae726c3c82680fb584bdc6cabffad2c76b0f9c355be2b0631f38507db1a7683ef404bb28058d51c4fed16ff063d35063a80205316d952bb57d090d1a2e2f8069079f1eae066de811a95bfde92666ecc32a1b2babc9699c7993ea091de38e7328c1443a60d64d343697c77f7f38556f9bd06e80419955f757bc753b1a84643daa601da3287d7238b8df759749ce0206839c8d725311076186023eb210c8300c5d0af1d606db762b1f4841f3ffaca381d65e59a3a832e5d765bbd3879d9c8d2a4dfe16c7ddbba267abca3d1b5c5e2e4 MSIB976.tmp Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\9617094A1CFB59AE7C1F7DFDB6739E4E7C40508F\Blob = 0300000001000000140000009617094a1cfb59ae7c1f7dfdb6739e4e7c40508f20000000010000007e0400003082047a30820362a003020102020a6101cf3e00000000000f300d06092a864886f70d01010505003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f667420436f6465205369676e696e6720504341301e170d3039313230373232343032395a170d3131303330373232343032395a308183310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f5052311e301c060355040313154d6963726f736f667420436f72706f726174696f6e30820122300d06092a864886f70d01010105000382010f003082010a0282010100bd3089fb4572a8536b9e894f0023c0bed41d3db1594038f373918226e696120053d91c820e3cce1dbbbdf7428d97d4fc381ae4b9f9e3ecd36103bfa0d3d6754d5c46a9ed5ef0d2e2695b1a73eab31c8d04cd2944a064592f1e985d6ec7ab18398265c4a7bcab758819ea87971426b37f2676a4d4383984e3b326d518f92be9d2c9165a5421f2978d878629fef4492ce68bf8043f7dcdcd9692860d7103e2d0fe0c4235ffd7b83fdd8e450a7df6d74bad5bf076721d77237d8935c41c5db250034b476d07a75588980680a681ad544ed881d6fabf42c031be550d99d553491230ebe5a5887c5ec47a5a148708b43769a0eb32248c08ebf9d414bae0fccdeaa4150203010001a381f83081f530130603551d25040c300a06082b06010505070303301d0603551d0e0416041438780573c81b329b5f928655af89bac699b1748e300e0603551d0f0101ff040403020780301f0603551d23041830168014cc1dce7600705baff1dac44e9a51442ea34463f030440603551d1f043d303b3039a037a0358633687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f43535043412e63726c304806082b06010505070101043c303a303806082b06010505073002862c687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f43535043412e637274300d06092a864886f70d01010505000382010100280383ab130df1fe116f4276d843abb8c642fa246534ae75b071308e96b683fa72e4fecd37e73a709851200eba71b4c9f4d5e48ae8287073d5ede1c27beef156345a8082eb10d77203ea124eecdd0d8c7b444f0c6175fd6e9c07ddce2b5a180d39b060fddaff04aa02a3d8fa8ea3bbbdc16a543b315fe42c6ecbf14d2a1cf21e767b86afc687d6b12aedaccc0ec0e49f7fe8cfe884725482186e2ac89e95b41a1ec16f93db62a6c14b6badc9ed3d92e3b22fab7a7739676a007b829d0310de6395492642de9522c1870bd014a35fdc733272361effc829c524524f6648c91d1da9c5263969504ea7ecc2066c2e721bf121da6d2448808115407c9fcc74384a4f MSIB976.tmp - Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 5 4260 msiexec.exe 27 4260 msiexec.exe 36 4260 msiexec.exe 49 4260 msiexec.exe 51 4260 msiexec.exe 56 4260 msiexec.exe 58 4260 msiexec.exe 60 4260 msiexec.exe 75 4260 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation ablebits-ultimate-suite-excel-v2026-1-3877-2566.exe Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation rundll32.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Drops file in Program Files directory 42 IoCs
description ioc Process File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AddinExpress.XL.2005.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\adxloader.dll.manifest msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\adxloader64.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\adxregistrator.exe msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Office.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\xlSumByColorUtils32.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AblebitsUltimateSuite.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Ablebits.NativeAPI.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Microsoft.Web.WebView2.WinForms.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Website.url msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\xl-suite.ico msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Ablebits.SelectRangeController.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Microsoft.WindowsAPICodePack.Shell.DLL msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\GuideSet.xml msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\ablebits-udf-functions.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Ablebits.ExcelTemplates.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AblebitsMakediffs.exe msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AblebitsOfferUtils.exe msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AblebitsSuiteForExcel.xlam msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Ablebits.WelcomeTour.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Interop.UIAutomationClient.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Microsoft.Vbe.Interop.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Microsoft.WindowsAPICodePack.DLL msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AblebitsRegistrator.exe msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\adxloader.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\readme.txt msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\xlSumByColorUtils64.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AblebitsLoader.exe msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AddinExpress.MSO.2005.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Watermarks.xml msiexec.exe File opened for modification \??\c:\program files (x86)\ablebits\ultimate suite for microsoft excel\1dd3a55bb2b7eca\adxloader.dll.manifest MSIE5B8.tmp File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Licence.rtf msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Microsoft.Office.Interop.Excel.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\ablebits-udf-functions-64.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Ablebits.US.ThreadUtils.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Aspose.Cells.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\CorporateDeployment.url msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Microsoft.Web.WebView2.Core.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Monaco.zip msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Ablebits.ExcelDataReader.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Ablebits.Helper.dll msiexec.exe - Drops file in Windows directory 26 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{5C43A6AA-2E6D-415A-A58F-29C90D6909CC} msiexec.exe File opened for modification C:\Windows\Installer\MSIB976.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEF3E.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIEF3E.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIF144.tmp msiexec.exe File created C:\Windows\Installer\{5C43A6AA-2E6D-415A-A58F-29C90D6909CC}\icon_ico msiexec.exe File opened for modification C:\Windows\Installer\{5C43A6AA-2E6D-415A-A58F-29C90D6909CC}\icon_ico msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIAD0F.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIAD0F.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIAD0F.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIB201.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIB4F0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEF3E.tmp-\AblebitsInstallUtils.dll rundll32.exe File created C:\Windows\Installer\e59ab0b.msi msiexec.exe File opened for modification C:\Windows\Installer\e59ab0b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIAD0F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD0F.tmp-\AblebitsInstallUtils.dll rundll32.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIBA90.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE5B8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEF3E.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIEF3E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF114.tmp msiexec.exe File created C:\Windows\Installer\e59ab0d.msi msiexec.exe - Executes dropped EXE 7 IoCs
pid Process 4192 MSIB976.tmp 3836 MSIBA90.tmp 3480 MSIE5B8.tmp 2376 MSIF114.tmp 4376 MSIF144.tmp 4672 AblebitsOfferUtils.exe 5844 AblebitsLoader.exe - Loads dropped DLL 64 IoCs
pid Process 3112 MsiExec.exe 4540 rundll32.exe 4540 rundll32.exe 4540 rundll32.exe 4540 rundll32.exe 4540 rundll32.exe 3112 MsiExec.exe 4516 rundll32.exe 4516 rundll32.exe 4516 rundll32.exe 4516 rundll32.exe 4516 rundll32.exe 3112 MsiExec.exe 1592 rundll32.exe 1592 rundll32.exe 1592 rundll32.exe 1592 rundll32.exe 1592 rundll32.exe 2500 MsiExec.exe 3224 rundll32.exe 3224 rundll32.exe 3224 rundll32.exe 3224 rundll32.exe 3224 rundll32.exe 2500 MsiExec.exe 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MSIE5B8.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MSIBA90.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIBA90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIF144.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ablebits-ultimate-suite-excel-v2026-1-3877-2566.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIE5B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AblebitsOfferUtils.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AblebitsLoader.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2084 msedge.exe - Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE - Modifies data under HKEY_USERS 17 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft MSIE5B8.tmp Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Excel\AddIns\Ablebits.Suite.1DD3A55BB2B7ECA\ADXStartMode = "FIRSTSTART" MSIE5B8.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MSIE5B8.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MSIE5B8.tmp Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134327704203803988" msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MSIE5B8.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Excel\AddIns\Ablebits.Suite.1DD3A55BB2B7ECA MSIE5B8.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Excel MSIE5B8.tmp Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MSIE5B8.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MSIE5B8.tmp Key created \REGISTRY\USER\.DEFAULT\Software MSIE5B8.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office MSIE5B8.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Excel\AddIns MSIE5B8.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8319BCD7-5DE9-3EF0-898C-8CE41B2FC60E} MSIE5B8.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2641FD1-D145-3F78-888E-8B75232B907F}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/Ablebits/Ultimate Suite for Microsoft Excel/1DD3A55BB2B7ECA/AblebitsUltimateSuite.DLL" MSIE5B8.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74CC0DA1-082C-3882-8DD4-696BBDC4F513}\InprocServer32\2026.1.3877.2566\RuntimeVersion = "v4.0.30319" MSIE5B8.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C663E113-FC66-3512-8028-264764D06938}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/Ablebits/Ultimate Suite for Microsoft Excel/1DD3A55BB2B7ECA/AblebitsUltimateSuite.DLL" MSIE5B8.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A56F3B4D-2C29-3812-A478-869A284F5ECD}\InprocServer32\Class = "AddinExpress.AddIns.xlQuickTools.AbsoluteToRelativeModule" MSIE5B8.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EA8460D2-AA6F-3AA0-B1B3-2F8024CB389E}\InprocServer32\2026.1.3877.2566\CodeBase = "file:///C:/Program Files (x86)/Ablebits/Ultimate Suite for Microsoft Excel/1DD3A55BB2B7ECA/AblebitsUltimateSuite.DLL" MSIE5B8.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{93E41A14-5A5B-39C1-992B-99A6326E3C73}\InprocServer32\Class = "AddinExpress.AddIns.XLCombineRows.SavedSettingsWizardStepControl" MSIE5B8.tmp Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{3D617CE6-C7CF-4B1D-86B4-BF8C8C530210}\ProgId MSIBA90.tmp Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{ADE03136-4983-3BFB-951E-B6ED87EF5DA2}\InprocServer32\2026.1.3877.2566 MSIBA90.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{93E41A14-5A5B-39C1-992B-99A6326E3C73}\InprocServer32\ = "mscoree.dll" MSIBA90.tmp Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{42DDB32D-B255-3B39-9DAF-558A94DFE4B9}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} MSIBA90.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{875BB7E7-212B-349C-A910-B3905A7A19BA} MSIE5B8.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EA8460D2-AA6F-3AA0-B1B3-2F8024CB389E}\InprocServer32 MSIE5B8.tmp Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{6430BBBC-CBDC-3CC6-BF42-0995C49B6683}\Implemented Categories MSIBA90.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{94D6D178-3183-3A7A-B27F-37F556414EA0}\InprocServer32\2026.1.3877.2566\Assembly = "AblebitsUltimateSuite, Version=2026.1.3877.2566, Culture=neutral, PublicKeyToken=c5f27ee33718ff24" MSIBA90.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{F5AB552C-EA8A-3985-B723-E155B08CA47A}\InprocServer32\ThreadingModel = "Both" MSIBA90.tmp Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{9E0728EC-D18C-3A7E-9275-24B7CB2B49FD}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} MSIBA90.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{C663E113-FC66-3512-8028-264764D06938}\ProgId\ = "AddinExpress.SubstringOperations.adxRegistryRemoveRowsBySubstrings" MSIBA90.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0DFA123-27F1-33D7-BEFD-9E729CB2CC11} MSIE5B8.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4CC5C8D6-5225-3747-BA4C-EFA58C66B1B6}\InprocServer32 MSIE5B8.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91BAA0AE-8314-3427-B7C8-62EDF1B8BBD6}\InprocServer32\ThreadingModel = "Both" MSIE5B8.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{0BC828CD-9AA0-3CE6-B563-BDD3B4A3C186}\InprocServer32\ = "mscoree.dll" MSIBA90.tmp Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{E2BFFBF3-AA25-3540-826E-3D6E701B9C89}\InprocServer32 MSIBA90.tmp Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{42DDB32D-B255-3B39-9DAF-558A94DFE4B9} MSIBA90.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AddinExpress.AddIns.xlDatePicker.DatePickerPane\CLSID MSIE5B8.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB459A1C-F902-372F-95AA-11D807A7AD10}\InprocServer32 MSIE5B8.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{43CF2F97-45DD-3C16-9E05-3771CCCBEA78}\InprocServer32 MSIE5B8.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A01A459B-F15C-30CC-8AEB-28C045C6F9CB}\InprocServer32\2026.1.3877.2566\CodeBase = "file:///C:/Program Files (x86)/Ablebits/Ultimate Suite for Microsoft Excel/1DD3A55BB2B7ECA/AblebitsUltimateSuite.DLL" MSIE5B8.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{9F0B719C-7CC1-3402-929D-5741188B4A98}\ = "AddinExpress.SubstringOperations.adxRegistryAddSubstrings" MSIBA90.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{872D60C8-A418-3BAE-B446-986CEB09344C}\InprocServer32\2026.1.3877.2566\Assembly = "AblebitsUltimateSuite, Version=2026.1.3877.2566, Culture=neutral, PublicKeyToken=c5f27ee33718ff24" MSIBA90.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{74CC0DA1-082C-3882-8DD4-696BBDC4F513}\ProgId\ = "CompareWorksheets.FormOptions" MSIBA90.tmp Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{97A282A2-2465-3353-B692-8956951BDFC9} MSIBA90.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5294F070-7035-3B73-977B-FA4B8CAA5A56}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} MSIE5B8.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{43CF2F97-45DD-3C16-9E05-3771CCCBEA78}\InprocServer32\2026.1.3877.2566\CodeBase = "file:///C:/Program Files (x86)/Ablebits/Ultimate Suite for Microsoft Excel/1DD3A55BB2B7ECA/AblebitsUltimateSuite.DLL" MSIBA90.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AddinExpress.AddIns.xlFormulaEditor.EditorTaskpaneControl\ = "AddinExpress.AddIns.xlFormulaEditor.EditorTaskpaneControl" MSIBA90.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AddinExpress.AddIns.xlDatePicker.DpiImages+DpiImage\CLSID\ = "{872D60C8-A418-3BAE-B446-986CEB09344C}" MSIBA90.tmp Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{2C034698-3D5B-3DB5-9097-CD2AA118924F}\Implemented Categories MSIBA90.tmp Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{E2BFFBF3-AA25-3540-826E-3D6E701B9C89}\InprocServer32\2026.1.3877.2566 MSIBA90.tmp Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{F62CAD45-9FC0-3EF9-AAD8-ACB92F54AC0B} MSIBA90.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74CC0DA1-082C-3882-8DD4-696BBDC4F513}\InprocServer32\2026.1.3877.2566\Class = "CompareWorksheets.FormOptions" MSIE5B8.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1D51A8A-3DE3-35F2-8A20-5761C2A29642}\InprocServer32\ = "mscoree.dll" MSIE5B8.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{49EDD1CE-61F2-32A5-ABAD-F0BE3F9D088C}\InprocServer32\2026.1.3877.2566\CodeBase = "file:///C:/Program Files (x86)/Ablebits/Ultimate Suite for Microsoft Excel/1DD3A55BB2B7ECA/AblebitsUltimateSuite.DLL" MSIBA90.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AddinExpress.TextToDatetime.TextToDateTimeOperationsModule\ = "AddinExpress.TextToDatetime.TextToDateTimeOperationsModule" MSIBA90.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{875BB7E7-212B-349C-A910-B3905A7A19BA}\InprocServer32\RuntimeVersion = "v4.0.30319" MSIBA90.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{F9BF1D76-E69C-31D9-BDB6-D7E5905A4445}\InprocServer32\2026.1.3877.2566\Assembly = "AblebitsUltimateSuite, Version=2026.1.3877.2566, Culture=neutral, PublicKeyToken=c5f27ee33718ff24" MSIBA90.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42DDB32D-B255-3B39-9DAF-558A94DFE4B9}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} MSIE5B8.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AddinExpress.AddIns.xlAutoReplace.ExtendedPanel\CLSID MSIE5B8.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{890589F8-0CB4-3BA1-9912-4338FA068F1D}\InprocServer32\ = "mscoree.dll" MSIE5B8.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30297F00-8731-3AE5-999F-C172F4FAF054}\InprocServer32\2026.1.3877.2566\RuntimeVersion = "v4.0.30319" MSIE5B8.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AddinExpress.AddIns.xlFormulaEditor.EditorControl\CLSID\ = "{E2BFFBF3-AA25-3540-826E-3D6E701B9C89}" MSIBA90.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{21540E1A-1094-343B-A49F-F67B8DE4ACA7}\InprocServer32\RuntimeVersion = "v4.0.30319" MSIBA90.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AddinExpress.LeadingZeros.FormatOperationsModule\CLSID\ = "{43CF2F97-45DD-3C16-9E05-3771CCCBEA78}" MSIE5B8.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A01A459B-F15C-30CC-8AEB-28C045C6F9CB} MSIE5B8.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{49EDD1CE-61F2-32A5-ABAD-F0BE3F9D088C}\InprocServer32\2026.1.3877.2566 MSIE5B8.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB459A1C-F902-372F-95AA-11D807A7AD10}\InprocServer32\2026.1.3877.2566\Class = "CompareWorksheets.StepSheetsBatch" MSIE5B8.tmp Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{9F0B719C-7CC1-3402-929D-5741188B4A98}\InprocServer32\2026.1.3877.2566 MSIBA90.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{890589F8-0CB4-3BA1-9912-4338FA068F1D}\InprocServer32 MSIE5B8.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492D7AE3-2CF7-3D4B-85DB-565F71B1EEE1}\InprocServer32\2026.1.3877.2566 MSIE5B8.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2BFFBF3-AA25-3540-826E-3D6E701B9C89}\InprocServer32\Assembly = "AblebitsUltimateSuite, Version=2026.1.3877.2566, Culture=neutral, PublicKeyToken=c5f27ee33718ff24" MSIE5B8.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{49EDD1CE-61F2-32A5-ABAD-F0BE3F9D088C}\InprocServer32\2026.1.3877.2566\RuntimeVersion = "v4.0.30319" MSIBA90.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB459A1C-F902-372F-95AA-11D807A7AD10}\InprocServer32\2026.1.3877.2566\Assembly = "AblebitsUltimateSuite, Version=2026.1.3877.2566, Culture=neutral, PublicKeyToken=c5f27ee33718ff24" MSIE5B8.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA8460D2-AA6F-3AA0-B1B3-2F8024CB389E}\Implemented Categories MSIE5B8.tmp Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{74CC0DA1-082C-3882-8DD4-696BBDC4F513}\Implemented Categories MSIBA90.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{0A3727C3-0628-3EDE-B3C1-0A4B30174E79}\InprocServer32\Class = "AddinExpress.SubstringOperations.adxRegistryReplaceSubstrings" MSIBA90.tmp - Modifies system certificate store 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03B6A2D771A81212474B5444BFF77A3059E9BE64 MSIB976.tmp Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03B6A2D771A81212474B5444BFF77A3059E9BE64\Blob = 03000000010000001400000003b6a2d771a81212474b5444bff77a3059e9be642000000001000000800700003082077c30820564a003020102021017aceb2c96223b38ec08986355904e8c300d06092a864886f70d01010b0500306a310b300906035504061302504c3121301f060355040a131841737365636f20446174612053797374656d7320532e412e313830360603550403132f43657274756d20457874656e6465642056616c69646174696f6e20436f6465205369676e696e672032303231204341301e170d3233303632363130313731335a170d3236303632353130313731325a3082013531133011060b2b0601040182373c0201031302504c311c301a060b2b0601040182373c0201020c0b6d617a6f776965636b696531193017060b2b0601040182373c0201010c08576172737a617761310f300d0603550411130630352d303932311d301b06035504090c14756c2e20576172737a6177736b61203130392f35311d301b060355040f131450726976617465204f7267616e697a6174696f6e311330110603550405130a30303030393033383631310b300906035504061302504c3114301206035504080c0b6d617a6f776965636b69653112301006035504070c09c5816f6d69616e6b6931243022060355040a0c1b4f6666696365204461746120417070732053702e207a206f2e6f2e3124302206035504030c1b4f6666696365204461746120417070732053702e207a206f2e6f2e308201a2300d06092a864886f70d01010105000382018f003082018a0282018100a09ed9beb912d61bfa6152466b37ff233c838a7bb35c825ef28cdb1170657627a89cb3897f283cc89eb5c7f6a9646676578d428befd863deddd6c463e728b6c9ccae0b8e59ad56f07d8a867cd366bcb7912ffcd42cdd12273c3999f878a76c0edee8ea0d7ed2c6ca1d582ab7f7baefa5e4689073bc916f1ad34143faf2b1b5930e060b0bc0ab2dfda0ac9ee7c4e4b83c0a03201404748870561ebc4b1b946ca4ea52ca64039d46ce29d817351d022ee1c9215c923abb9298926d31c3e992635437cda4e566d33fcaaa0ccae6ccbc008964b5d415c140594b72c2e4720e6d4cd0d870dbfb992c95f22a7cb46ad9bf632fff53fbb2adc719b51590b09059755e8ddc32e3220e468528f34e46677a20d3dca9c1ad2f477ce5d78f5d99942c7f2fee126581df6f6a64b423374376ef0399e803751f3efdbcd12776bd7a6d8a6fbae4dcbd8419c875a0a7d928a4059bd1ad995b7fd86dd4c83d8df5f2c659d7fc2db5976432cc240effa1cfa348d1c1880a941d5406f11cc6b467e23e2502930002950203010001a38201cf308201cb300c0603551d130101ff0402300030410603551d1f043a30383036a034a0328630687474703a2f2f63657663736361323032312e63726c2e63657274756d2e706c2f63657663736361323032312e63726c307706082b06010505070101046b3069302e06082b060105050730018622687474703a2f2f63657663736361323032312e6f6373702d63657274756d2e636f6d303706082b06010505073002862b687474703a2f2f7265706f7369746f72792e63657274756d2e706c2f63657663736361323032312e636572301f0603551d23041830168014ac57ca0816dc3fc5311c0a4ddbfbf1de99272d34301d0603551d0e04160414fec1efe4c7558281349bdf69d378980275966989304a0603551d20044330413007060567810c01033036060b2a84680186f677020501073027302506082b06010505070201161968747470733a2f2f7777772e63657274756d2e706c2f43505330130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780304e0603551d1104473045a04306082b06010505070803a03730350c33504c2d4d415a4f574945434b49452d574152535a4157412d4f4646494345204441544120415050532053502e205a204f2e4f2e300d06092a864886f70d01010b050003820201004cf9ee0e4a992011de9d4ae0732f6b2fa36a941712bad47696a266104abebf6ae3f0d14b87a3c43125eb8593254dc1e8980b7c2cf64fb35455746ee74e5adef3c5cfdddeb72659d745f8c4860df759a7aef6b6d8b2e22119be614cdb8dccabf515745f03a3102427bd689ebe14fc7d5728c142ed5922c477847e328536991f7f3cfd4bbac9ef8e7e0c9c911422ddf512e27fcecdc430f079ae7541dd1962c5b86234ef7503d8beea2946d690aab29cf11414813d06b99487d340e0b21e757a0ec6f233feba8ac15bf95d9bd7f0ca72e45ed042957cadd916591454403d514d370dca5eea38f6faaf6f812fc6e8740650d27793d675c9d30a18c636ae22ebd242dd6458d69b1300316cf653081d8d5ae003153b6fbef86a4afdc3fdba98a556278aabbf26b89886982c3fc15afd2668d339eae726c3c82680fb584bdc6cabffad2c76b0f9c355be2b0631f38507db1a7683ef404bb28058d51c4fed16ff063d35063a80205316d952bb57d090d1a2e2f8069079f1eae066de811a95bfde92666ecc32a1b2babc9699c7993ea091de38e7328c1443a60d64d343697c77f7f38556f9bd06e80419955f757bc753b1a84643daa601da3287d7238b8df759749ce0206839c8d725311076186023eb210c8300c5d0af1d606db762b1f4841f3ffaca381d65e59a3a832e5d765bbd3879d9c8d2a4dfe16c7ddbba267abca3d1b5c5e2e4 MSIB976.tmp Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\9617094A1CFB59AE7C1F7DFDB6739E4E7C40508F MSIB976.tmp Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\9617094A1CFB59AE7C1F7DFDB6739E4E7C40508F\Blob = 0300000001000000140000009617094a1cfb59ae7c1f7dfdb6739e4e7c40508f20000000010000007e0400003082047a30820362a003020102020a6101cf3e00000000000f300d06092a864886f70d01010505003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f667420436f6465205369676e696e6720504341301e170d3039313230373232343032395a170d3131303330373232343032395a308183310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f5052311e301c060355040313154d6963726f736f667420436f72706f726174696f6e30820122300d06092a864886f70d01010105000382010f003082010a0282010100bd3089fb4572a8536b9e894f0023c0bed41d3db1594038f373918226e696120053d91c820e3cce1dbbbdf7428d97d4fc381ae4b9f9e3ecd36103bfa0d3d6754d5c46a9ed5ef0d2e2695b1a73eab31c8d04cd2944a064592f1e985d6ec7ab18398265c4a7bcab758819ea87971426b37f2676a4d4383984e3b326d518f92be9d2c9165a5421f2978d878629fef4492ce68bf8043f7dcdcd9692860d7103e2d0fe0c4235ffd7b83fdd8e450a7df6d74bad5bf076721d77237d8935c41c5db250034b476d07a75588980680a681ad544ed881d6fabf42c031be550d99d553491230ebe5a5887c5ec47a5a148708b43769a0eb32248c08ebf9d414bae0fccdeaa4150203010001a381f83081f530130603551d25040c300a06082b06010505070303301d0603551d0e0416041438780573c81b329b5f928655af89bac699b1748e300e0603551d0f0101ff040403020780301f0603551d23041830168014cc1dce7600705baff1dac44e9a51442ea34463f030440603551d1f043d303b3039a037a0358633687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f43535043412e63726c304806082b06010505070101043c303a303806082b06010505073002862c687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f43535043412e637274300d06092a864886f70d01010505000382010100280383ab130df1fe116f4276d843abb8c642fa246534ae75b071308e96b683fa72e4fecd37e73a709851200eba71b4c9f4d5e48ae8287073d5ede1c27beef156345a8082eb10d77203ea124eecdd0d8c7b444f0c6175fd6e9c07ddce2b5a180d39b060fddaff04aa02a3d8fa8ea3bbbdc16a543b315fe42c6ecbf14d2a1cf21e767b86afc687d6b12aedaccc0ec0e49f7fe8cfe884725482186e2ac89e95b41a1ec16f93db62a6c14b6badc9ed3d92e3b22fab7a7739676a007b829d0310de6395492642de9522c1870bd014a35fdc733272361effc829c524524f6648c91d1da9c5263969504ea7ecc2066c2e721bf121da6d2448808115407c9fcc74384a4f MSIB976.tmp - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5884 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4516 rundll32.exe 3224 rundll32.exe 3224 rundll32.exe 1860 msiexec.exe 1860 msiexec.exe 3836 MSIBA90.tmp 3836 MSIBA90.tmp 3480 MSIE5B8.tmp 3480 MSIE5B8.tmp 5884 EXCEL.EXE 5884 EXCEL.EXE 5884 EXCEL.EXE - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 1648 msedge.exe 1648 msedge.exe 1648 msedge.exe 1648 msedge.exe 1648 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4260 msiexec.exe Token: SeIncreaseQuotaPrivilege 4260 msiexec.exe Token: SeSecurityPrivilege 1860 msiexec.exe Token: SeCreateTokenPrivilege 4260 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4260 msiexec.exe Token: SeLockMemoryPrivilege 4260 msiexec.exe Token: SeIncreaseQuotaPrivilege 4260 msiexec.exe Token: SeMachineAccountPrivilege 4260 msiexec.exe Token: SeTcbPrivilege 4260 msiexec.exe Token: SeSecurityPrivilege 4260 msiexec.exe Token: SeTakeOwnershipPrivilege 4260 msiexec.exe Token: SeLoadDriverPrivilege 4260 msiexec.exe Token: SeSystemProfilePrivilege 4260 msiexec.exe Token: SeSystemtimePrivilege 4260 msiexec.exe Token: SeProfSingleProcessPrivilege 4260 msiexec.exe Token: SeIncBasePriorityPrivilege 4260 msiexec.exe Token: SeCreatePagefilePrivilege 4260 msiexec.exe Token: SeCreatePermanentPrivilege 4260 msiexec.exe Token: SeBackupPrivilege 4260 msiexec.exe Token: SeRestorePrivilege 4260 msiexec.exe Token: SeShutdownPrivilege 4260 msiexec.exe Token: SeDebugPrivilege 4260 msiexec.exe Token: SeAuditPrivilege 4260 msiexec.exe Token: SeSystemEnvironmentPrivilege 4260 msiexec.exe Token: SeChangeNotifyPrivilege 4260 msiexec.exe Token: SeRemoteShutdownPrivilege 4260 msiexec.exe Token: SeUndockPrivilege 4260 msiexec.exe Token: SeSyncAgentPrivilege 4260 msiexec.exe Token: SeEnableDelegationPrivilege 4260 msiexec.exe Token: SeManageVolumePrivilege 4260 msiexec.exe Token: SeImpersonatePrivilege 4260 msiexec.exe Token: SeCreateGlobalPrivilege 4260 msiexec.exe Token: SeCreateTokenPrivilege 4260 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4260 msiexec.exe Token: SeLockMemoryPrivilege 4260 msiexec.exe Token: SeIncreaseQuotaPrivilege 4260 msiexec.exe Token: SeMachineAccountPrivilege 4260 msiexec.exe Token: SeTcbPrivilege 4260 msiexec.exe Token: SeSecurityPrivilege 4260 msiexec.exe Token: SeTakeOwnershipPrivilege 4260 msiexec.exe Token: SeLoadDriverPrivilege 4260 msiexec.exe Token: SeSystemProfilePrivilege 4260 msiexec.exe Token: SeSystemtimePrivilege 4260 msiexec.exe Token: SeProfSingleProcessPrivilege 4260 msiexec.exe Token: SeIncBasePriorityPrivilege 4260 msiexec.exe Token: SeCreatePagefilePrivilege 4260 msiexec.exe Token: SeCreatePermanentPrivilege 4260 msiexec.exe Token: SeBackupPrivilege 4260 msiexec.exe Token: SeRestorePrivilege 4260 msiexec.exe Token: SeShutdownPrivilege 4260 msiexec.exe Token: SeDebugPrivilege 4260 msiexec.exe Token: SeAuditPrivilege 4260 msiexec.exe Token: SeSystemEnvironmentPrivilege 4260 msiexec.exe Token: SeChangeNotifyPrivilege 4260 msiexec.exe Token: SeRemoteShutdownPrivilege 4260 msiexec.exe Token: SeUndockPrivilege 4260 msiexec.exe Token: SeSyncAgentPrivilege 4260 msiexec.exe Token: SeEnableDelegationPrivilege 4260 msiexec.exe Token: SeManageVolumePrivilege 4260 msiexec.exe Token: SeImpersonatePrivilege 4260 msiexec.exe Token: SeCreateGlobalPrivilege 4260 msiexec.exe Token: SeCreateTokenPrivilege 4260 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4260 msiexec.exe Token: SeLockMemoryPrivilege 4260 msiexec.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4260 msiexec.exe 4260 msiexec.exe 1648 msedge.exe 1648 msedge.exe 4260 msiexec.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 5884 EXCEL.EXE 5884 EXCEL.EXE 5884 EXCEL.EXE 5884 EXCEL.EXE 5884 EXCEL.EXE 5884 EXCEL.EXE 5884 EXCEL.EXE - Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 1848 wrote to memory of 4260 1848 ablebits-ultimate-suite-excel-v2026-1-3877-2566.exe 85 PID 1860 wrote to memory of 3112 1860 msiexec.exe 102 PID 3112 wrote to memory of 4540 3112 MsiExec.exe 103 PID 3112 wrote to memory of 4516 3112 MsiExec.exe 104 PID 3112 wrote to memory of 1592 3112 MsiExec.exe 105 PID 1860 wrote to memory of 2500 1860 msiexec.exe 108 PID 2500 wrote to memory of 3224 2500 MsiExec.exe 109 PID 1860 wrote to memory of 4192 1860 msiexec.exe 110 PID 1860 wrote to memory of 3836 1860 msiexec.exe 111 PID 1860 wrote to memory of 3480 1860 msiexec.exe 112 PID 2500 wrote to memory of 4952 2500 MsiExec.exe 113 PID 1860 wrote to memory of 2376 1860 msiexec.exe 114 PID 1860 wrote to memory of 4376 1860 msiexec.exe 115 PID 1860 wrote to memory of 4672 1860 msiexec.exe 116 PID 4672 wrote to memory of 1648 4672 AblebitsOfferUtils.exe 119 PID 1648 wrote to memory of 4048 1648 msedge.exe 120 PID 1648 wrote to memory of 2084 1648 msedge.exe 122 PID 1648 wrote to memory of 4004 1648 msedge.exe 123 PID 1648 wrote to memory of 4160 1648 msedge.exe 124 PID 1648 wrote to memory of 4004 1648 msedge.exe 123 PID 1648 wrote to memory of 4160 1648 msedge.exe 124 PID 1648 wrote to memory of 4160 1648 msedge.exe 124 PID 1648 wrote to memory of 2316 1648 msedge.exe 126 PID 1648 wrote to memory of 3324 1648 msedge.exe 125 PID 1648 wrote to memory of 2316 1648 msedge.exe 126 PID 1648 wrote to memory of 2316 1648 msedge.exe 126 PID 1648 wrote to memory of 3324 1648 msedge.exe 125 PID 1648 wrote to memory of 3324 1648 msedge.exe 125 PID 1648 wrote to memory of 4380 1648 msedge.exe 128 PID 1648 wrote to memory of 4380 1648 msedge.exe 128 PID 1648 wrote to memory of 4380 1648 msedge.exe 128 PID 1648 wrote to memory of 2768 1648 msedge.exe 129 PID 1648 wrote to memory of 2768 1648 msedge.exe 129 PID 1648 wrote to memory of 2768 1648 msedge.exe 129 PID 1648 wrote to memory of 3836 1648 msedge.exe 132 PID 1648 wrote to memory of 3836 1648 msedge.exe 132 PID 1648 wrote to memory of 1552 1648 msedge.exe 133 PID 1648 wrote to memory of 1552 1648 msedge.exe 133 PID 1648 wrote to memory of 4240 1648 msedge.exe 134 PID 1648 wrote to memory of 4240 1648 msedge.exe 134 PID 1648 wrote to memory of 4240 1648 msedge.exe 134 PID 1648 wrote to memory of 2196 1648 msedge.exe 136 PID 1648 wrote to memory of 632 1648 msedge.exe 137 PID 1648 wrote to memory of 2196 1648 msedge.exe 136 PID 1648 wrote to memory of 632 1648 msedge.exe 137 PID 1648 wrote to memory of 4276 1648 msedge.exe 139 PID 1648 wrote to memory of 5464 1648 msedge.exe 140 PID 1648 wrote to memory of 5464 1648 msedge.exe 140 PID 1648 wrote to memory of 5472 1648 msedge.exe 141 PID 1648 wrote to memory of 5472 1648 msedge.exe 141 PID 1648 wrote to memory of 5652 1648 msedge.exe 142 PID 1648 wrote to memory of 5652 1648 msedge.exe 142 PID 1648 wrote to memory of 5692 1648 msedge.exe 143 PID 1648 wrote to memory of 5692 1648 msedge.exe 143 PID 1648 wrote to memory of 5208 1648 msedge.exe 144 PID 1648 wrote to memory of 5208 1648 msedge.exe 144 PID 1648 wrote to memory of 5996 1648 msedge.exe 146 PID 1648 wrote to memory of 5996 1648 msedge.exe 146 PID 3112 wrote to memory of 5508 3112 MsiExec.exe 149 PID 3112 wrote to memory of 5788 3112 MsiExec.exe 150 PID 3112 wrote to memory of 5716 3112 MsiExec.exe 151 PID 5716 wrote to memory of 5884 5716 rundll32.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\ablebits-ultimate-suite-excel-v2026-1-3877-2566.exe"C:\Users\Admin\AppData\Local\Temp\ablebits-ultimate-suite-excel-v2026-1-3877-2566.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\excel-ultimate-suite.msi"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4260
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9126DD1D61E99F46F23EA30AF29CB300 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5942.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240736656 1 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.CheckAgreeAddTrustedCertInstalled3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4540
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5DC7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240737765 10 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.CheckExcelBrothersProductsInstallated3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4516
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI61CF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240738890 26 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.SetTimestamp3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1592
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI2F71.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240791421 34 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.CheckExplorerPreview3⤵
- System Location Discovery: System Language Discovery
PID:5508
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI30CA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240791765 39 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.CheckExcelDuringInstall3⤵
- System Location Discovery: System Language Discovery
PID:5788
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI31C5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240792015 44 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.RunExcel3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5884
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 347BFC8F6B52AA0C5EB6F8B9F2770A652⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIAD0F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240758109 2 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.CheckExcelBrothersProductsInstallated3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3224
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIEF3E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240775156 25 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.CheckExcelInteropsProblem_PE3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4952
-
-
-
C:\Windows\Installer\MSIB976.tmp"C:\Windows\Installer\MSIB976.tmp" ADD CurrentUser2⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- Modifies system certificate store
PID:4192
-
-
C:\Windows\Installer\MSIBA90.tmp"C:\Windows\Installer\MSIBA90.tmp" /install="C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AblebitsUltimateSuite.dll" /privileges=user /log="C:\Users\Admin\AppData\Local\Temp\Ablebits\Ablebits-ExcelUltimateSuite-registration_perUser.log" /timestamp=1DD3A55BB2B7ECA2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3836
-
-
C:\Windows\Installer\MSIE5B8.tmp"C:\Windows\Installer\MSIE5B8.tmp" /install="C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AblebitsUltimateSuite.dll" /privileges=admin /scope="perMachine" /log="C:\Users\Admin\AppData\Local\Temp\Ablebits\Ablebits-ExcelUltimateSuite-registration_perMachine.log" /timestamp=1DD3A55BB2B7ECA2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3480
-
-
C:\Windows\Installer\MSIF114.tmp"C:\Windows\Installer\MSIF114.tmp" RegisterAblebitsLoaderPERMACHINE UltimateSuite "C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\ "2⤵
- Executes dropped EXE
PID:2376
-
-
C:\Windows\Installer\MSIF144.tmp"C:\Windows\Installer\MSIF144.tmp" /RemovePerMachineHostRegistration:Ablebits.Suite.1DD3A55BB2B7ECA2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4376
-
-
C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AblebitsOfferUtils.exe"C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AblebitsOfferUtils.exe" install us personal L:LC:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\L:L 52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.ablebits.com/docs/excel-ultimate-suite-getting-started/?edition=personal:non-activated&version=2026.1.3877&event_details=crt:n3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffd229ec188,0x7ffd229ec194,0x7ffd229ec1a04⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,15158211901410818023,15717645920474520203,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:34⤵
- System Time Discovery
PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,15623928793373088398,7629501885200661168,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:84⤵PID:4004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,13232444143674093235,1779709565805788028,262144 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:24⤵PID:4160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,17649769973912628927,15453312522069788030,2097152 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14⤵PID:3324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,7309569782088431948,7206760342676921791,2097152 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:14⤵PID:2316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,11286391938294692150,3200290592138397945,2097152 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,9832949746556380662,4810902574247669807,2097152 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:24⤵PID:2768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,8320240580941570547,4547158966440465245,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:84⤵PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,10487853804211097549,10257482758500849113,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:84⤵PID:1552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5056,i,12465739515973687864,12086043910247091846,2097152 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,17768596508213789713,8229612405117149163,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:84⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,17171564972820034236,6995300374504719913,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:84⤵PID:632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,3310167698006491937,6718398689000895083,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:84⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,3310167698006491937,6718398689000895083,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:84⤵PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,6240897246623435836,7548610886983410449,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:84⤵PID:5464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,7927013837198011091,12578888360098610578,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:84⤵PID:5472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,6498496689771047397,14643250312664427350,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:84⤵PID:5652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,4840883591884241813,5154166171050064003,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:84⤵PID:5692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,9922097278477711176,13424642621503508645,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:84⤵PID:5208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,13218642786530034674,8616168413582428615,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:84⤵PID:5996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,3358052692160517215,12396035149088367082,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:84⤵PID:636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,17317310587979140360,11006686886272764734,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:84⤵PID:2504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3988,i,1216249702042979109,9478168272485038718,524288 --field-trial-handle=2592,i,2659147322952426587,11924175683932651017,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:84⤵PID:540
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2936
-
C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AblebitsLoader.exe"C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AblebitsLoader.exe" -Embedding1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5844
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59ab0c.rbs
- Size 18KB
- SHA256 ef871e9899a651f68de397b46fee91184b6c7321151436546582ddfe3c15fc6a
- MD5 062d73fcc9dcba01353d15670e7f36ef
- SHA1 7d766719d85e696f385ffcec95acd5ed29928a4e
- SHA512 dfb7f7d340cdbf6ec163f83a5240cf2b9f96a6ad9ec1f54d018f251a3987555dae4f4008787959c7424dbfbe2488a8da332668216ae9f4798d51e7374d6deffe
- SSDEEP 384:rWRA8o8txqGJ7V7j3jiuO2Lck02AlDG6uJBdnEGK:rMA8o8txBV7Q
- TLSH T1CC8265C3BC0392D3FF1157F61A865E16BB9A478AE5944E1914CDE129888BF8C87FE301
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Ablebits.ExcelDataReader.dll
- Size 77KB
- SHA256 313fdfeacaf4651eb8c96ee2572a6371f37737fc2b0cdaad04fcf73089e8217a
- MD5 1f488d3cd94c350beafc5fb46c593114
- SHA1 230ea5abc3a206adf23bed3f6e93f040093cfc4d
- SHA512 63441cf21f9c751c18a494a0f1ec6d10c0ccde915e886151f9818b44d35fd76a973a914d956d82c5b82321af1a57b4537c94a024427d23782067af66fc6b21e7
- SSDEEP 1536:n1b/nTw72ZesnWttIG9AIm4p9RL6TiOSXzq0FO9BEN8tdxR:1bO2RnWOG97PRuTibXzzO9qez
- TLSH T14A736C073BFC024AE6BF8EF5F4F590210A72B1A27726D6AF28A550EE45127B04671F17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Ablebits.ExcelTemplates.dll
- Size 3.6MB
- SHA256 616255b87641c4ceac055e09454d6fd0560bea908ed47f66f0b0ec7adc952733
- MD5 09243312684120635cdf780f5f8fedcf
- SHA1 3f6eb7c28770642355cc27a3e29a5af70c86e1f7
- SHA512 93d75cefd40fb2185a366d98b20059f01d27d9a202d9a907c995bbfe2e0a9b3f5fdee6685489ddc8ea4466238f719f55b5a1c22a9dc0e086daabc38c7f943ce8
- SSDEEP 49152:AGnmtWsKlrnCGIJTpQpqQD+Go1BNFZ8TB4MMMMMeGTMXMMMMMw1wz8:AGmnpQUwHa+TB4MMMMMecsMMMMMUwY
- TLSH T1D0061915EAD0722DD2AA0670CC6B457082BBAE435EC1877F26D4B36FC931374B9F1266
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Ablebits.Helper.dll
- Size 111KB
- SHA256 9d55602b5d50e00f3c412c6ee991c9de2206c19962ed6ff64795d9f194787307
- MD5 cde0ba5c7e971e31afa5ed561d7bbff2
- SHA1 f74a56f9fdc1dbb0181310c8c9b2eacdeaecbdcc
- SHA512 a74d537e5a4e62bb09f11e1d32c955d67a38a220acf2aef40577b5efd4d960fbe1fb8ebc41c773f6eec8187bc3b5422893268044c295dbd92993d94ac1925a44
- SSDEEP 3072:4gkrXG1Rblkw9Mw80eo3o3S0RTKI+1e98:4g6X8bjX8C43H+1P
- TLSH T1E5B37CA07795CD63C7DE493EE494695143719E0AA907E3DB98C8F5FC36B338209052EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Ablebits.NativeAPI.dll
- Size 72KB
- SHA256 873a58314c6ccb0457bc0be899a32997f5b78ee8ef07925d28697edd1843742d
- MD5 62447f9ee6b4fbf1fd3463f9d84341f9
- SHA1 9747d1dfd6208db1715d3182a9c22eed122bcccb
- SHA512 ac5ace86b0fa36b8bb14d37a55fa24591ed6ebcb8b0d31df69c82bf7ae81e7b7d0a25ca640a4e2cd877501ab1c895c93a07c9fcb38fab06d4f1b5c30d4e220c1
- SSDEEP 1536:mNb5ocjmC2WfxKeqoMUIQLppBwKliVE/9eoQA8tdxtQ:mNb5NjmC2WfxKWLBwKkVE/9eLDzQ
- TLSH T102738E2743A50992DD5E967EB4333F05DBF0F184014BF3AB188A84F87AB33A419662E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\Ablebits.SelectRangeController.dll
- Size 97KB
- SHA256 af93464ba9ba494b599f5c0703b198c8dcd4e9ce4589946bbd0b8db59e0f8da4
- MD5 16b9f4170dd7e7d083b2897a9fde21cd
- SHA1 ee22dce3c021a8a9d273715e210a2b540b2e8ea5
- SHA512 294fb6af1ffea8b46860ca82c6b3cd4925c36171962991e083851f28e1d9b69f040663601c6da53a9363d76d3a00ebbbfff1fb5dd53d15697b4c811116eda2fc
- SSDEEP 3072:wq9pDmbhc6ljhjs/rtm5osHaA8LYCnsETfWHdQrV9:wq9E2whm+6A8LYCnsETf/
- TLSH T1E8A36D3853EC4F2ED5AE0778B0B521124BB4E6A4B982E75F2F08D0DE15A33918F951E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AddinExpress.MSO.2005.dll
- Size 4.2MB
- SHA256 8c298689dd5ab009ae743d06ccf00b8dbc9cbbe4dc11b6474f3c5e26de5b7901
- MD5 43365f6e20902f525a7f64c1c7d9adc3
- SHA1 369b1d0bbaaf9bb139a3af754892d4552ece5187
- SHA512 ea57fd94b669e1ce13c802b421224b68d0521b7a437348ea203848500884fef65c7eca6d88162b24c42d884eab333b8a110e479f597f29f0bfa7d12464d2fd79
- SSDEEP 24576:WmxSF6YefgNkgR2Q3eETkRf7GJclY+6fsRwukV3wbF6fyaLiPKXSg36wb7PbeVf9:MJgpREuriYF
- TLSH T16B168053AAEC7CEAC1396375773793D6C3ADED491211C20E64C0662A29BE3137A037D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\AddinExpress.XL.2005.dll
- Size 711KB
- SHA256 4ac69672810baf9e0c8201aa7840c6078b0823fbc101e4cabc95a327a0f240ff
- MD5 9f592848149f6d76cec8bb0f96ab5a50
- SHA1 f07249920bdb4173cbaf103f66e14acb7c6a0239
- SHA512 2969b8ef39dce95a74fef50bf7b018568a2bac4e070781590b8cb89669af61b9d6e386ce3804d6505d47792c875ac11767b07064b100f342f003225b1e4d6206
- SSDEEP 6144:Ch0HlPRaE6JtJi4Ev7ew0HsR+WhMVnFlwGIlrQvdWKV6MZpKSQZ92X1tEgFbKo+T:S0HaE4Ji9Tehs1a1gG9JmXoBKljQ5mGK
- TLSH T1DAF44A122BE87CA2D07E03BDA3B75392C7B8ED059613D35E45C4A0A91DBA352BE017D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\adxloader.dll.manifest
- Size 4KB
- SHA256 6c54ea6674296d696b23347a1e3ffb70cfb20fa4dc0bc001e5b991950009f3bc
- MD5 4e56f49b41a0521d78126d014dc5b988
- SHA1 5bf6719f72d32d8ee8de3e157f4ac4c08ea420f1
- SHA512 5303ff30cd1f15cdc5d724bdc9155ca7345876f9f993b023a60d6ce71bf8c99ebf9f7bb42c757e2c5c967d07c589d8da54ded1ff87f34baa278210a4e19c816e
- SSDEEP 96:t+yQWclYdfXEKNu7Zp5r/svbvLXN1FU83kODo+SRYP0xeklKloFsIm:tvfclYdfXE0u75sDvzFU69o+MYcxeqGb
- TLSH T138A15C2F68C9790C2701937FD973CC16508B3E4346E8606E7E69393A89444BA22628DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A55BB2B7ECA\adxloader.dll.manifest
- Size 4KB
- SHA256 159e54611fdadb1eca5c6955ce3011a6cef56261eb7335e87a146de4776588b6
- MD5 e4c0ade962b76812f137a92687bd3e04
- SHA1 4b7f6daaf6a07a6d2accabc6cf4b59fcca9309ec
- SHA512 bf7baf4f71eb1ae596326a0dac993a75dcd6729fff161bcc1dd815c4aba35e1ad85d639ed3148e5f1516dd59fa8cd4393ac4619dfd7d6b4230d8f0577a4039fa
- SSDEEP 96:t+yQWclYdfXEKNu7Zp5r/svbvLXN1FU83kODo+SRYP0xeklKloFsIm:tvfclYdfXE0u75sDvzFU69o+MYcxeqGb
- TLSH T1D6A14D2F68C9790C2701936FD973CC16549B3E4745E8506E7E6939398D444B623728DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A96CC62C00FEA3DDB8AB25852385FFA
- Size 825B
- SHA256 2c8a6db93d33c80063d048b2ccbfd0ce7bce73bb045370805ef53e12fa6064f5
- MD5 62a38b6c710020d07fcf1b0bb2419b5b
- SHA1 94ad000896b7bce648895eb722968d0501faa8e2
- SHA512 2536337a2bb735060bd60322a896e6fde7ccc1f4de2347c0f0dac51e007608f58d4935bae33c7b26dcb773bc0d930f68b40c28a7f7754faa55a73cf5a967992f
- TLSH T16A01865B4A2C549456827F7F8BFC8FBF0EB341D854C194177959C8C51D737B1A28009A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B03113490075047F519A3F760F0FF379_963854D8AD7B6E796FA78B81F7C355CA
- Size 2KB
- SHA256 23b2ef2a2f0cd1c9373bc1b7ff0180fa3fbccf28d9c44a8ac61c94deda6ceff2
- MD5 ae6ce2c8dcb087b32740b61435e43b9f
- SHA1 f3d5112fa781ff83297f49b7e361c187934ecddb
- SHA512 ed6efe09b45b8aaff3fca0de7aebbbd294f8f71b7620ab000e160cf5a3b43fe1bb3c888d0af2b07f240560c9980aae6b65668f7d927eb864839e3459bb99db79
- TLSH T15E411B964F645CD4BA47FD20E610CDB20DF677D45F408A097025882977697711F3894C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A96CC62C00FEA3DDB8AB25852385FFA
- Size 180B
- SHA256 4e939e11cadc51100e065a9a555303051cfcfa096df2309bfc0b9deb5eacd8ac
- MD5 0cc1a0c355c21bcabbdccd47223d9e47
- SHA1 d89f3d10c18c6c0cd163774898e739b935bb4acf
- SHA512 b6d067a0c88d44907827bd13550cf88857b745422a032c205969774154880c73174d0f699910e86b892bc90bca72c11a9541e33576ed26861a9095bbe51d16e4
- TLSH T139C04C052B940546D64D453F6C275F642E5EA5218742D7558F7041499828E546CB2D25
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B03113490075047F519A3F760F0FF379_963854D8AD7B6E796FA78B81F7C355CA
- Size 428B
- SHA256 1aea5680714e9548324005d837bf80dc86e4b2fce3950b22ecb00cab77b32556
- MD5 8617628f1d707f25c14d2dbada71c9c0
- SHA1 ff761e16885030b1271c9a3d7d2281d004d810a8
- SHA512 c07a1c8acf1b46f3da3d2f5a1455cf1c5130f8c9da80978081bcd2c08d68d02d2294de2d52684857b83109b14582439a49816e02c4e0b5ea30343b707c195467
- TLSH T1C4E0681C35FB805DF230E83A56C5B6704D3DB203484462A455C102043787D81FD73E38
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
- Size 651B
- SHA256 549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74
- MD5 9bbfe11735bac43a2ed1be18d0655fe2
- SHA1 61141928bb248fd6e9cd5084a9db05a9b980fb3a
- SHA512 a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483
- TLSH T1B8F078702322F5D589032F431C5C659507FF07A8A564FE2CB9AE225FD82A1276F362E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
- MD5 f8a5a8774310485121aa8917052b352c
- SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
- SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
- TLSH T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
- MD5 338a3c92e96cad1510815c958fc76de7
- SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
- SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
- TLSH T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
- MD5 ef105d8d3e87a813544857290c28833d
- SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
- SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
- TLSH T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 4d53f09b072b171035272a03ac3a36332b97d320169231c58e5ebdf0e9c952a5
- MD5 0570012a75051d34bbd413ce12270eaf
- SHA1 b96051d6f43d460c278822c72dd50bc24442567c
- SHA512 bacba1aca75bdb8ffc0621df67422d3a255498424be3fc7a9e0456ddac48222df7cd0e63e42e81bd13771e510cc6c88dfe9ae706509afe172094505de0434f48
- TLSH T114714D380AA13686E7D586B3ECFD0E12BC738C6907434D360E94D93C681F7627D66547
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a67b4.TMP
- Size 3KB
- SHA256 789d295184db85ed8508c10b0fb1236e531e2a736a41dc8aba26f63868028c5d
- MD5 a992f3577069e6b7e86ec7abc95fe8c3
- SHA1 e90f8772e89b11f164d90b0978cc092dcbc5fa9b
- SHA512 e8c09f265b642fea5617f557fe8fe4fcf95dd3a6f6c408221835c813fd6723ed21982876617e718945423878889bb75f3a307bf85286590cce90a729cdfdad6b
- TLSH T19C714F340A923596E7D58AB3ECFD0E163C738C6E06434D710D50983D281F7627D6A54B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 e320fb55fccd78610c53ebff12d92935eb98da1feb1105be1720ceb2a8befc53
- MD5 efcdd481cdd9d0e9ebd97f4f91e9a6b3
- SHA1 a31c656213ed80f2b4728a7b49266bad11b48aaa
- SHA512 a1930dddcc9f09f44b5aee9549152f2c471c3fc037051374bd242008b1646765d9c92f2ca68298f819ffeac8f29f2b4420cc3b64994fab331cb6f928f5b0dfde
- SSDEEP 192:sxZgeRcyM/jK1Ml8Miv/fzsuMjIaqiZxIdp8zHW6+WNgNy/zIrlaTi4hvLvUZIgc:sxZgeyqv/fzsu+HESHbv/FJSc
- TLSH T18D52C516AA349A77CCDBD21DF954BB53D6F50572E1804E84AAFCC91C04E6AED220782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 42e621c2aeea1fc0606318516fb057f4cddae3caf24ad2957abe0ef2fbc36fa5
- MD5 853838cea9f6ca0905d2cc7d816e551c
- SHA1 ca667bb25b1c3a56af3f0ab82b4ed7a46cadfe4a
- SHA512 eb1a7711e1174e19f1b61bccd72fcf685e9aa51236eb2ffb0bfbb854a88e8a3306b72f33994985d29722227a7fe5d7dcbaf776b0566e01e8d0e4bd63d70289e7
- SSDEEP 192:sxZgeRcyM/jK1Ml8Mjv/fzsFMjIaqiZxIdp8zHW6+WNgNy/zIrlaTi4hYLvUZIgk:sxZgey7v/fzsF+HESHbv/FISk
- TLSH T1BF62D516AA349A77CCDBD21DF950BB53D6F50572E1904E84AAFCC91C04E7AED220782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 35KB
- SHA256 7a8e88ab84eeb835d878e30e472855ef023ffd3a297e409629c14809bdf29d94
- MD5 386134e3bd4cebeea148a94a1662b3d9
- SHA1 eed2f2087dbd58041fcbbd2783403dcb36aaef6d
- SHA512 cf6209c97cc0738efbcfde741108b75518f039e42634f0cefd696de8a436ea64e6b7f8aa30c37ab8ce4d85d99f45834bf1aeb36ed34adff36e28d9a870c39705
- SSDEEP 768:EW8iJx07pLuLzxNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9xQALl6opdproh:EW8iJx4EzxNWvx76ru1jacxQALocdC9H
- TLSH T1C7F2EB3B6C0CCB7E4F804E9CEC2A6E9A6DE801CF56D8895447FA881C03C66EE55175DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 0fee5373fe86918cbb593f01120974d7921c5269aa59e34c144838f77485bb8a
- MD5 01677e20817e817926c410ebd0b4e2de
- SHA1 1fa450f1c041243263c4d1c204151dec6e50e75c
- SHA512 05fe18a2c25feb5b6992bec6d8120d8b032e6759e2a4126e086e49036afa09514ea05276705de94693bf2c86f7fb20ac693f0dc12baf66f3a57a95d1564732f7
- SSDEEP 48:KgjIRKso8/yFdI5KWM8iEIHKZWEry0jEtRbhNjk9mSI15jKys:KgjuKsouWdKKWMNEwKZW6KEwKf
- TLSH T10AA1550231FB12413C7E660DE155975B078235633269A62B7FAD00A21E67E290EFDDEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 7e621eefbfb8bd330afef9fb78317031b95a4188f04d8cb7bd2401a7cda8b56c
- MD5 a00894faf42e1fdbd02292920eea3c4d
- SHA1 5f5075f0ff889f3ae8607fdd4cdada4e2e6151aa
- SHA512 30bd3c1c502a981795e2a9e31f90734d7b8bfd7f49c7ca27d25571fe3a49dc11f0353c6262d8b8918be2fc241463e899e2f42e8891d3ee49e16703f4b4ba7e26
- SSDEEP 96:ZqONkPQsjpfmUTmDK5ih/cIPURHl8h4otop5u5DIBhPwivh50xy0SFYKBAxseYoD:gONn6kDfQmiUyY8Z903kC35QiXX0wU6
- TLSH T11A020A3568786CBB8EA3AE49F48737275FA5213BEAD12F84D9E41B1C04C764C1306837
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 18KB
- SHA256 aa812d2a28d2638e571ccc6978a84cd38b421ac687d07b392d1358acc5ae94e7
- MD5 f38ac51ffaf2bbefce4b031b7a221288
- SHA1 c85200754e119d6acb0242c76e438d5bf65e5302
- SHA512 e2c19009dcf0cb85875e91411bde35e09079ac377b9d49328de67316f5c3e68fb2721ad756278b697a7a60ba041cb46d7a02b2f1e2b14dc573fbe57b5a6af532
- SSDEEP 384:nSZcIhsNxSm1OjdktC2BTXR0X1puL2Eoe:ghVclTXRsyLfl
- TLSH T14D828D7168B8AC7B59E2E109F58B37474FB56073DAC85FC5E5D9AB0C00C65881B0BD1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 18KB
- SHA256 49d0172ed20c976ca00c0d516d108a14a0a604303d53e0019e762cf42117b028
- MD5 f4734c4057084bc0698c5afddb7f8e2f
- SHA1 ee5d24ef1f85ed62d9c9a07065673c0f2566c892
- SHA512 12e5ec6e40ff6176032a8053afb3de25ded5c7e2af5405b44c8e82091dc680d1fac8731fcae460d6e1ba6093e1616dd9794f7e56ac589a5220a8c68e125f4770
- SSDEEP 384:nhZcIPsNxmm1OjdktC2BTXR0X1puL2Eoe:pPVclTXRsyLfl
- TLSH T1B5827C716CB8AC7A59A3E109F58B37474FB560739AC85FC5E5D9AB0C01C65881B0BC2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 bddadcf6c3d6d248b6a6c0c6fcac9a7de76569aaa0ef6bfe5d7f8f36d626b65b
- MD5 354408bec9871a1bb05be60056ceea6b
- SHA1 63525e277ff1b597a7bb299236e643242587f03e
- SHA512 8d47acb3cb01e778784b2f02288ebe6371d375d35aab7e0166214911c1bd2cd00858c6e99d2e819db94c19bf476681bd9a0a4d21523e4e2967fe088bf6718956
- SSDEEP 192:RONU6kdQmiUyR8/903kC3GWE0cRXhqZuU6:RONU6C5/9tC2BdXRU6
- TLSH T1321218306878ACBB9E93A509F48737635FA52177DE85AFC5E5E41B1C04C768C2B0E826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9f51b145-7dc0-4c6b-8140-3e7dd5c42d18.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 13bafa867ba1b5ba999268d4d9e2f9636a766e36bea4dfdd1610e9c3d979af7b
- MD5 0d235311298b510a8866bbcb19e65a1a
- SHA1 1bfd39a86a579381ecea9487f92c0114d8ae80f5
- SHA512 599ffe1c4db28a06dd972ffd3bb5346b9bf04f45cf02076bd169719bcb87a8fd069156e8a27d2edace32f13832d13afec63d040c00e0c0f504f6bfe575cbf17b
- TLSH T157412A58F6F91148B3B77E1A9BF6686D887F79772E0AD05E10120D4F0A32B44C8A2737
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\3046d863-28d5-43a7-9dba-c2dd5cdf3b77.tmp
- Size 1B
- SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
- MD5 5058f1af8388633f609cadb75a75dc9d
- SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
- SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSI5942.tmp
- Size 1.1MB
- SHA256 dd078e23bad267be41b48083569f47b7f4f73ca5820e99a4432181f4ef709325
- MD5 dafeb8f4d3d25febf3e5642488dc2a94
- SHA1 ddee4006bb2c0f83d19bae6e0d5d9601a772ddc1
- SHA512 ee81963a287d8e99ecd1693d544b060dbdc455eb508bff922a5bf9258780ca7adb3c982ae403331ed6c278e284415dce4919c26096e6a141f3bcd3e252fc43d1
- SSDEEP 24576:1IC2NvTON2xBHyXtCZGeAtiEK7XIS82CiZDr5:1ItVfJ4NPK7XI4p
- TLSH T1DA451251B6E48432E7FF1E3079A496E149BBBE642F70DA4E57044C6D8AB4780C632B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI5942.tmp-\AblebitsInstallUtils.dll
- Size 2.8MB
- SHA256 c8e3f025eddd874ea5577e6602d8db0eeffd224b4c089874324165dfcd4f580d
- MD5 6de863a7c6fbb2a8989ed2719fc981ba
- SHA1 4ce5e5da5b4d8ac971223feeaa26733cbf1a16ae
- SHA512 94d4ba28ea4bc9eaebb2eb105e36a9e49794b86d0141f900deca7447df70c43af73b940af3475ff89a49aab4fc44e1cee1ec5df417646f253870ead59f75800d
- SSDEEP 49152:YPFAeMMMMMQFol2q2I/MMMMMSx/tCCbfU:YJMMMMMQKEI/MMMMMWbbf
- TLSH T103D5B225EAD1B22EC3EA0130CC9B947051ABAF425EC0867B76D4F32FC9702B575F1666
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI5942.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 182KB
- SHA256 ced6cab3c04c08ce5705af0b6986965dbdbfda17cbd66c973bb371ed3b95f37a
- MD5 82eb1ccf28f3af897c2db27282b41156
- SHA1 9f945d8b18ff0fbb5f013efe5e2ff33aef136104
- SHA512 9458fabeae4dabf8109b9736496a01d9168312faec1c17d6eed89e8f09cbb8287d74ff758948cf07838720c11005e87a734e920be4ead275354f46a0a6176f84
- SSDEEP 3072:eGfZS7hUuK3PcbFeRRLxyR69UgoCaf8IkCnfKlRUjW01KyAFPMQx:YzMRLkR6joxfrVjS
- TLSH T1C5047D2953FC473ECAEF4778E261425197B1F2E67113DB0EAC8181BA2162780F792397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI5DC7.tmp-\CustomAction.config
- Size 1KB
- SHA256 33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f
- MD5 01c01d040563a55e0fd31cc8daa5f155
- SHA1 3c1c229703198f9772d7721357f1b90281917842
- SHA512 9c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5
- TLSH T11031568E0B05B77711312753AEED90C5DB7561A73C95811834DE99293F36978137338E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TmpBA5D.tmp
- Size 2KB
- SHA256 ebe8a6b5b95232f0c34a5844bf2e41af3689525e4711ecea2bde0bbff31233a1
- MD5 a6f58c456742efc3cbf81c3a9bebf155
- SHA1 224979c39e819cc0e67731d8045c3e2c17da1f85
- SHA512 d98107939046f5bcbd0ff98e21333f2d86baac9d5abafc0328ce9977276aabddf29a83bfc04684eef80735bf2563855f26460bab327395339907c885afa59a81
- TLSH T1DB510A5B0D9125461F8FF2BCDD3A986A81D3364609D2707D66883234CB4846B7179CDD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TmpBA6F.tmp
- Size 1KB
- SHA256 8c3c63c8d96d55a61c0d816cd7547baa1b1f7b3045d14c4d7da5943eae16f85f
- MD5 b7bb7ce474cd6cfe2451e7f14d3a9745
- SHA1 103d3fb8f06cbe4ebed3c9c65de0eabc9cf8f5c5
- SHA512 44e6c193ce08964fa7429b967d2cf9e3b739dee37d6f396ced5cda443dd6f660afd297b95bfe72f9492f5aaeda04552479d476f28db4260de288cdab980e202c
- TLSH T1B43186F64F10686E21DEE960584E1829545DEA8E43D0B3AC66C19472C7E2D3405FB4CA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\af5ab8dd-11b8-4c7b-a213-85bfb0a4f005.tmp
- Size 10KB
- SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
- MD5 78e47dda17341bed7be45dccfd89ac87
- SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
- SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
- SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
- TLSH T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\excel-ultimate-suite.msi
- Size 31.6MB
- SHA256 afd088d64172c6196c8f18a3f46865226bf9531fb4d19b0c2bb0b3dd4ba97c52
- MD5 ef7a74093ee45c80f42b7aa6b767de4b
- SHA1 990e7cb9d3a34ced144b3712faf7cdc9c92815fe
- SHA512 3446833fdedae22e59d589016cc6837d7c85734a04c6666c02740a2d9ad6e3a2b095decec6022bec33b3a7237e4b8c0042cdcf57e094503987f0b908a1980a2c
- SSDEEP 786432:as+zD0s1WbpUjqavtR4yZdJVlocWVG9ktfbWEn+E/4QIP:aND0YWbpUjv12yfTlo0KtfkEA9
- TLSH T1DF77331876C1B131D1A70534D9A9F2B0493BBE145AD2900277C8F99EAF35BB0A3F4B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1648_1312940985\4e3d3f0a-4397-4688-9301-309603eff618.tmp
- Size 154KB
- SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
- MD5 a922bd2071b7aa9f2154c991d41885c7
- SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
- SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
- SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
- TLSH T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1648_1496016154\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
- Size 1KB
- SHA256 0fdc15f79f32a07400744061a6faa16a34b338d2213dd2c97992d7695f5e166f
- MD5 d4e2a879cfee52a2293086ca6933cd15
- SHA1 0a64f9675482c62811a773a63bdeca311a3dc685
- SHA512 1d6bc669549e6afa6536c83e61288ea42e7a4fb241fe5acde7a4d02a8ff79724bdeecd81315fb68be75bafb93e368b09f6ba47aed6303474e8c09b2698f2eff3
- TLSH T17821034215D31F1ED094D335A9364713DB30BCC26B11571F97C6A25E3E759006B1E936
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSIB201.tmp
- Size 233KB
- SHA256 b29b65905905f7d9279737fad9ee4dbfb9375109ec03c0db2d96e11b031e9a70
- MD5 69ce0f47a489fc5ed1980b43bf0eb0e6
- SHA1 3f6d8ceece019812d43a0de767fc7bd72f2ce241
- SHA512 ade5af5a8ca4716eb651d7de0f9bfd9c2f155884a022312fa808439f56b55ac5375dda3b4cd2dcf9af105d99cdc991e74250246f7c600a13b80507859bf43bb7
- SSDEEP 3072:kTpq20EOtzMa+aLWZMxC9bvpWiMBplSS1flQn1eubG7g2sNrL/ZMfv/PP:kz0/tKmUbvptklfNFsZwv
- TLSH T1FA348D217494507EE7FF0832953AE671AE3DF2281B90C96EC3945C1E6D608C16BB7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIB976.tmp
- Size 477KB
- SHA256 99bc7dd6e39d09e26e1fb92f192268aaa2f6c383a00e58c15a3277d50a56486f
- MD5 be77ed4e5fcb9f6392243300f89ee0c0
- SHA1 52303b17657c1c87099fb0f985d806be1122fcba
- SHA512 90167f5406b68415beccee657eb90981336228b6a4142877b6afda2ded8477558f233a4ee617a7fe51cf2ae2be2c0d87a28798c6be5dc60def2708d6373c1c0b
- SSDEEP 768:t4Vj3bf8WiU6qbOkYG4ESWs6qlT8T94AFzhspXw+sIkpGe3O8L9z82ADhE2m5ALs:t4Z78qtkT8P9Eg+sdpPeUz8tdF5I
- TLSH T1D3A47E82B644B945D8E60930D452D6F4813F7D09EAE189873BC8768FFA32EB084FE55D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIBA90.tmp
- Size 169KB
- SHA256 6656661b68843d5fbba907b4ad39d7337b21059de03068429bd450c9eef8f0d5
- MD5 51e0ef3d015c3e47fc34b1cf8b30b8d2
- SHA1 51f0390bbfef7ffe1d931847853fa118f8deddca
- SHA512 13040d4f5de50529364868ec759195c593b1d0001b6591cbb9c9a9366b3b76e1891132bfdd98620fa3b7b9abf4a4e8174d3cb18d85ee2f596092ed77b3ebe740
- SSDEEP 3072:yJDLZbxrtY4slAkxiHkiDRUlxfJsni2ISJ:yJv5PY4slDxiHnURsi
- TLSH T1DE046C507BD6C072E2A3193255F597626A79BB325B32D0CB775C0AA85F307D0AA3D313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIEF3E.tmp-\Newtonsoft.Json.dll
- Size 522KB
- SHA256 9c9dd756162300902b29e07bd7e95c1fca6705fc9c728023911d99cb2e2b0216
- MD5 49037a121593acfd95e7de31fc8c9a4d
- SHA1 6e0c789b5a6bc80e97af9506909f0a5766d9c4ee
- SHA512 0b950baf70784c1b98a1a4e25f44d88fc3a9d38d8661f7b641b3242223fdb8ac1cc69c676f4d035057ed1f9f9a06c272cdfde4b5727a936950c6668e381aff11
- SSDEEP 6144:ihMoo1Nw3XRpmdxcgVAbGaq/0D0yDZn2M3MCHA1ui8YjFFezlLSJThvLpCpGQ/DM:dAXa6pHA1CVpstLpCpGQ/DqrBodAb
- TLSH T1A4B44B2223FC8B2AD5EF1B35E4B0092547FEF416A279DB8F590499AE6C937814D90373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\ablebits\ultimate suite for microsoft excel\1dd3a55bb2b7eca\ablebitsultimatesuite.dll
- Size 26.7MB
- SHA256 15c40d34f08301f917d87fd894ad5d632afdaa2faf0a00f379a1f6dcb42420fb
- MD5 5fe8f5bb2e1c8a98e4c8381e4d87c2b6
- SHA1 5d3a223841a95595f58269272250c4684b575315
- SHA512 9526d6005f2f7b0c145d005cfd4f05581a993cdae76b64e8e675f184b4d8d02ed48c7c6fbcfb6d12d1d86db9b97a7b551f356ee0aa973b2cf6cac59ed3246590
- SSDEEP 196608:CgwykzGWOnGQBNGbsCd8W8xe+gP/aMveD3cNRlM39A28o4rBtcGvLfDnfan3O05V:NAfa9L+Q6
- TLSH T1E2576312B196B169CD972476CC5F8664326EBDC1CDB049FEA2A0FF3E4A7132051E1B87
- MD5 SHA1 SHA512 SSDEEP TLSH