Analysis
- user interaction
yes - max time kernel
186s - max time network
188s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/09/2026, 21:04
Static task
static1
Behavioral task
behavioral1
Sample
ablebits-ultimate-suite-excel-v2026-1-3877-2566.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
300 seconds
Behavioral task
behavioral2
Sample
ablebits-ultimate-suite-excel-v2026-1-3877-2566.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
25 signatures
300 seconds
General
- Target ablebits-ultimate-suite-excel-v2026-1-3877-2566.exe
- Size 32.1MB
- Sample260901-zw1f2abk21
- SHA256 05678291f1ae7ea50d85b84d4ae62d6aa58795cb2b6b05e0a35d699fe5025f29
- MD5 304a874108f2bd4a49c4dac075bf33c9
- SHA1 0564ce043e6863010753097ac05c6f613d9d19b5
- SHA512 1c3fd7dd32dd95bb84acabcec8e6ae9470d04b7a030d9e05f28d333ab39b0a651e36c3f59f02f3e72a7170ecc7deacb65e1f72f99667d4b9e1e22f1723db8fc4
- SSDEEP 786432:+s+zD0s1WbpUjqavtR4yZdJVlocWVG9ktfbWEn+E/4QIP+:+ND0YWbpUjv12yfTlo0KtfkEA9G
- TLSH T1FB7733187681B131D1B30534D9A6F2B0493BBE145AD2940277C8B99EAF31BB0A3F5B5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Manipulates Digital Signatures 1 TTPs 2 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03B6A2D771A81212474B5444BFF77A3059E9BE64\Blob = 03000000010000001400000003b6a2d771a81212474b5444bff77a3059e9be642000000001000000800700003082077c30820564a003020102021017aceb2c96223b38ec08986355904e8c300d06092a864886f70d01010b0500306a310b300906035504061302504c3121301f060355040a131841737365636f20446174612053797374656d7320532e412e313830360603550403132f43657274756d20457874656e6465642056616c69646174696f6e20436f6465205369676e696e672032303231204341301e170d3233303632363130313731335a170d3236303632353130313731325a3082013531133011060b2b0601040182373c0201031302504c311c301a060b2b0601040182373c0201020c0b6d617a6f776965636b696531193017060b2b0601040182373c0201010c08576172737a617761310f300d0603550411130630352d303932311d301b06035504090c14756c2e20576172737a6177736b61203130392f35311d301b060355040f131450726976617465204f7267616e697a6174696f6e311330110603550405130a30303030393033383631310b300906035504061302504c3114301206035504080c0b6d617a6f776965636b69653112301006035504070c09c5816f6d69616e6b6931243022060355040a0c1b4f6666696365204461746120417070732053702e207a206f2e6f2e3124302206035504030c1b4f6666696365204461746120417070732053702e207a206f2e6f2e308201a2300d06092a864886f70d01010105000382018f003082018a0282018100a09ed9beb912d61bfa6152466b37ff233c838a7bb35c825ef28cdb1170657627a89cb3897f283cc89eb5c7f6a9646676578d428befd863deddd6c463e728b6c9ccae0b8e59ad56f07d8a867cd366bcb7912ffcd42cdd12273c3999f878a76c0edee8ea0d7ed2c6ca1d582ab7f7baefa5e4689073bc916f1ad34143faf2b1b5930e060b0bc0ab2dfda0ac9ee7c4e4b83c0a03201404748870561ebc4b1b946ca4ea52ca64039d46ce29d817351d022ee1c9215c923abb9298926d31c3e992635437cda4e566d33fcaaa0ccae6ccbc008964b5d415c140594b72c2e4720e6d4cd0d870dbfb992c95f22a7cb46ad9bf632fff53fbb2adc719b51590b09059755e8ddc32e3220e468528f34e46677a20d3dca9c1ad2f477ce5d78f5d99942c7f2fee126581df6f6a64b423374376ef0399e803751f3efdbcd12776bd7a6d8a6fbae4dcbd8419c875a0a7d928a4059bd1ad995b7fd86dd4c83d8df5f2c659d7fc2db5976432cc240effa1cfa348d1c1880a941d5406f11cc6b467e23e2502930002950203010001a38201cf308201cb300c0603551d130101ff0402300030410603551d1f043a30383036a034a0328630687474703a2f2f63657663736361323032312e63726c2e63657274756d2e706c2f63657663736361323032312e63726c307706082b06010505070101046b3069302e06082b060105050730018622687474703a2f2f63657663736361323032312e6f6373702d63657274756d2e636f6d303706082b06010505073002862b687474703a2f2f7265706f7369746f72792e63657274756d2e706c2f63657663736361323032312e636572301f0603551d23041830168014ac57ca0816dc3fc5311c0a4ddbfbf1de99272d34301d0603551d0e04160414fec1efe4c7558281349bdf69d378980275966989304a0603551d20044330413007060567810c01033036060b2a84680186f677020501073027302506082b06010505070201161968747470733a2f2f7777772e63657274756d2e706c2f43505330130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780304e0603551d1104473045a04306082b06010505070803a03730350c33504c2d4d415a4f574945434b49452d574152535a4157412d4f4646494345204441544120415050532053502e205a204f2e4f2e300d06092a864886f70d01010b050003820201004cf9ee0e4a992011de9d4ae0732f6b2fa36a941712bad47696a266104abebf6ae3f0d14b87a3c43125eb8593254dc1e8980b7c2cf64fb35455746ee74e5adef3c5cfdddeb72659d745f8c4860df759a7aef6b6d8b2e22119be614cdb8dccabf515745f03a3102427bd689ebe14fc7d5728c142ed5922c477847e328536991f7f3cfd4bbac9ef8e7e0c9c911422ddf512e27fcecdc430f079ae7541dd1962c5b86234ef7503d8beea2946d690aab29cf11414813d06b99487d340e0b21e757a0ec6f233feba8ac15bf95d9bd7f0ca72e45ed042957cadd916591454403d514d370dca5eea38f6faaf6f812fc6e8740650d27793d675c9d30a18c636ae22ebd242dd6458d69b1300316cf653081d8d5ae003153b6fbef86a4afdc3fdba98a556278aabbf26b89886982c3fc15afd2668d339eae726c3c82680fb584bdc6cabffad2c76b0f9c355be2b0631f38507db1a7683ef404bb28058d51c4fed16ff063d35063a80205316d952bb57d090d1a2e2f8069079f1eae066de811a95bfde92666ecc32a1b2babc9699c7993ea091de38e7328c1443a60d64d343697c77f7f38556f9bd06e80419955f757bc753b1a84643daa601da3287d7238b8df759749ce0206839c8d725311076186023eb210c8300c5d0af1d606db762b1f4841f3ffaca381d65e59a3a832e5d765bbd3879d9c8d2a4dfe16c7ddbba267abca3d1b5c5e2e4 MSI37ED.tmp Set value (data) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\9617094A1CFB59AE7C1F7DFDB6739E4E7C40508F\Blob = 0300000001000000140000009617094a1cfb59ae7c1f7dfdb6739e4e7c40508f20000000010000007e0400003082047a30820362a003020102020a6101cf3e00000000000f300d06092a864886f70d01010505003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f667420436f6465205369676e696e6720504341301e170d3039313230373232343032395a170d3131303330373232343032395a308183310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f5052311e301c060355040313154d6963726f736f667420436f72706f726174696f6e30820122300d06092a864886f70d01010105000382010f003082010a0282010100bd3089fb4572a8536b9e894f0023c0bed41d3db1594038f373918226e696120053d91c820e3cce1dbbbdf7428d97d4fc381ae4b9f9e3ecd36103bfa0d3d6754d5c46a9ed5ef0d2e2695b1a73eab31c8d04cd2944a064592f1e985d6ec7ab18398265c4a7bcab758819ea87971426b37f2676a4d4383984e3b326d518f92be9d2c9165a5421f2978d878629fef4492ce68bf8043f7dcdcd9692860d7103e2d0fe0c4235ffd7b83fdd8e450a7df6d74bad5bf076721d77237d8935c41c5db250034b476d07a75588980680a681ad544ed881d6fabf42c031be550d99d553491230ebe5a5887c5ec47a5a148708b43769a0eb32248c08ebf9d414bae0fccdeaa4150203010001a381f83081f530130603551d25040c300a06082b06010505070303301d0603551d0e0416041438780573c81b329b5f928655af89bac699b1748e300e0603551d0f0101ff040403020780301f0603551d23041830168014cc1dce7600705baff1dac44e9a51442ea34463f030440603551d1f043d303b3039a037a0358633687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f43535043412e63726c304806082b06010505070101043c303a303806082b06010505073002862c687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f43535043412e637274300d06092a864886f70d01010505000382010100280383ab130df1fe116f4276d843abb8c642fa246534ae75b071308e96b683fa72e4fecd37e73a709851200eba71b4c9f4d5e48ae8287073d5ede1c27beef156345a8082eb10d77203ea124eecdd0d8c7b444f0c6175fd6e9c07ddce2b5a180d39b060fddaff04aa02a3d8fa8ea3bbbdc16a543b315fe42c6ecbf14d2a1cf21e767b86afc687d6b12aedaccc0ec0e49f7fe8cfe884725482186e2ac89e95b41a1ec16f93db62a6c14b6badc9ed3d92e3b22fab7a7739676a007b829d0310de6395492642de9522c1870bd014a35fdc733272361effc829c524524f6648c91d1da9c5263969504ea7ecc2066c2e721bf121da6d2448808115407c9fcc74384a4f MSI37ED.tmp - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 4648 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Drops file in Program Files directory 42 IoCs
description ioc Process File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Ablebits.ExcelDataReader.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Ablebits.NativeAPI.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Aspose.Cells.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Microsoft.Web.WebView2.Core.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\ablebits-udf-functions-64.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Microsoft.WindowsAPICodePack.DLL msiexec.exe File opened for modification \??\c:\program files (x86)\ablebits\ultimate suite for microsoft excel\1dd3a559c6c92dd\adxloader.dll.manifest MSI50A7.tmp File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AblebitsLoader.exe msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\adxloader64.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\GuideSet.xml msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Microsoft.Office.Interop.Excel.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\readme.txt msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Ablebits.ExcelTemplates.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AblebitsMakediffs.exe msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AblebitsRegistrator.exe msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AblebitsSuiteForExcel.xlam msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AddinExpress.MSO.2005.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Monaco.zip msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Watermarks.xml msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Ablebits.Helper.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AblebitsUltimateSuite.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AddinExpress.XL.2005.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Interop.UIAutomationClient.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Microsoft.Web.WebView2.WinForms.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\xl-suite.ico msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Ablebits.US.ThreadUtils.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AblebitsOfferUtils.exe msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Ablebits.SelectRangeController.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\adxregistrator.exe msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\CorporateDeployment.url msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Microsoft.WindowsAPICodePack.Shell.DLL msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\xlSumByColorUtils32.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\ablebits-udf-functions.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\adxloader.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Licence.rtf msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Microsoft.Vbe.Interop.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Office.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\xlSumByColorUtils64.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Ablebits.WelcomeTour.dll msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\adxloader.dll.manifest msiexec.exe File created C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Website.url msiexec.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\km\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\mn\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\hy\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\is\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\as\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\128.png msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\service_worker_bin_prod.js msedge.exe File opened for modification C:\Windows\Installer\{5C43A6AA-2E6D-415A-A58F-29C90D6909CC}\icon_ico msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\offscreendocument_main.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\ko\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\en_GB\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\fr\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\hu\messages.json msedge.exe File opened for modification C:\Windows\Installer\MSI37ED.tmp msiexec.exe File created C:\Windows\Installer\{5C43A6AA-2E6D-415A-A58F-29C90D6909CC}\icon_ico msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\da\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\sl\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\sr\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\ta\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\te\messages.json msedge.exe File opened for modification C:\Windows\Installer\MSI2CFD.tmp-\Newtonsoft.Json.dll rundll32.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\az\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\gu\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\pa\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\tr\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\cs\messages.json msedge.exe File opened for modification C:\Windows\Installer\MSI6FF7.tmp-\AblebitsInstallUtils.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI7299.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\ru\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\nl\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\ca\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\ar\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\sk\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\en_CA\messages.json msedge.exe File opened for modification C:\Windows\Installer\MSI6FF7.tmp-\CustomAction.config rundll32.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\ka\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\es_419\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\af\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\bg\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\et\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\id\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\ne\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\gl\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\iw\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\en\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\ms\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\pt_BR\messages.json msedge.exe File opened for modification C:\Windows\Installer\MSI71FC.tmp msiexec.exe File created C:\Windows\Installer\e5a29a3.msi msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\pl\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\sv\messages.json msedge.exe File opened for modification C:\Windows\Installer\MSI30F5.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI6FF7.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\dasherSettingSchema.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\ur\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\my\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\pt_PT\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_2013545144\_locales\am\messages.json msedge.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI2CFD.tmp-\AblebitsInstallUtils.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2CFD.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\SystemTemp\Ablebits\Logs\Ablebits Ultimate Suite for Microsoft Excel, Personal edition\09-01-2026_C.log MSI50A7.tmp - Executes dropped EXE 7 IoCs
pid Process 5988 MSI37ED.tmp 5600 MSI3936.tmp 1248 MSI50A7.tmp 3100 MSI71FC.tmp 5408 MSI7299.tmp 5292 AblebitsOfferUtils.exe 4828 AblebitsLoader.exe - Loads dropped DLL 64 IoCs
pid Process 3976 MsiExec.exe 5540 rundll32.exe 5540 rundll32.exe 5540 rundll32.exe 5540 rundll32.exe 5540 rundll32.exe 3976 MsiExec.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 3976 MsiExec.exe 4604 rundll32.exe 4604 rundll32.exe 4604 rundll32.exe 4604 rundll32.exe 4604 rundll32.exe 988 MsiExec.exe 1752 rundll32.exe 1752 rundll32.exe 1752 rundll32.exe 1752 rundll32.exe 1752 rundll32.exe 988 MsiExec.exe 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 5600 MSI3936.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MSI50A7.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MSI3936.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI7299.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI3936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ablebits-ultimate-suite-excel-v2026-1-3877-2566.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AblebitsOfferUtils.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI50A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AblebitsLoader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2752 msedge.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Modifies data under HKEY_USERS 17 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Excel\AddIns\Ablebits.Suite.1DD3A559C6C92DD MSI50A7.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office MSI50A7.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Excel\AddIns MSI50A7.tmp Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MSI50A7.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MSI50A7.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MSI50A7.tmp Key created \REGISTRY\USER\.DEFAULT\Software MSI50A7.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Excel MSI50A7.tmp Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134327703829494507" msedge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MSI50A7.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft MSI50A7.tmp Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Excel\AddIns\Ablebits.Suite.1DD3A559C6C92DD\ADXStartMode = "FIRSTSTART" MSI50A7.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MSI50A7.tmp Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6430BBBC-CBDC-3CC6-BF42-0995C49B6683}\InprocServer32\Class = "Ablebits.NameParser.FirstNameMapper" MSI50A7.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5076CE6A-BCFD-3668-9F35-90D1317B6794}\InprocServer32\Class = "AddinExpress.AddIns.MultiMergeTables.SavedSettingsWizardStepControl" MSI50A7.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{3CD584D2-DB02-3AE4-9AF2-099D7DCDF787}\InprocServer32\Class = "AddinExpress.AddIns.xlQuickTools.FormulaToValueModule" MSI3936.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{110B5002-E5CD-3C2A-A69A-DDB7D76B4014}\InprocServer32\2026.1.3877.2566\RuntimeVersion = "v4.0.30319" MSI3936.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C6752A0-B163-3A4F-9E8F-C606DB3E2BF4}\InprocServer32\2026.1.3877.2566 MSI50A7.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{110B5002-E5CD-3C2A-A69A-DDB7D76B4014}\ProgId MSI50A7.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34A92B53-CD79-334C-92B2-C529DC3FEB7F}\InprocServer32\Assembly = "AblebitsUltimateSuite, Version=2026.1.3877.2566, Culture=neutral, PublicKeyToken=c5f27ee33718ff24" MSI50A7.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{110B5002-E5CD-3C2A-A69A-DDB7D76B4014}\InprocServer32\RuntimeVersion = "v4.0.30319" MSI50A7.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{97A282A2-2465-3353-B692-8956951BDFC9}\InprocServer32\2026.1.3877.2566\Class = "AddinExpress.AddIns.xlDatePicker.DatePickerFooter" MSI3936.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5294F070-7035-3B73-977B-FA4B8CAA5A56}\InprocServer32\Class = "CompareWorksheets.StepWorkbooks" MSI50A7.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E2BFFBF3-AA25-3540-826E-3D6E701B9C89} MSI50A7.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{6430BBBC-CBDC-3CC6-BF42-0995C49B6683}\Implemented Categories MSI3936.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{890589F8-0CB4-3BA1-9912-4338FA068F1D}\InprocServer32 MSI3936.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A56F3B4D-2C29-3812-A478-869A284F5ECD}\InprocServer32\ThreadingModel = "Both" MSI50A7.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E2BFFBF3-AA25-3540-826E-3D6E701B9C89}\InprocServer32\ThreadingModel = "Both" MSI50A7.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ AblebitsLoader.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{91BAA0AE-8314-3427-B7C8-62EDF1B8BBD6}\ProgId MSI3936.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\AddinExpress.TextToDatetime.DateResult\CLSID MSI3936.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{A56F3B4D-2C29-3812-A478-869A284F5ECD}\InprocServer32\Assembly = "AblebitsUltimateSuite, Version=2026.1.3877.2566, Culture=neutral, PublicKeyToken=c5f27ee33718ff24" MSI3936.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{BA67E505-4EA4-3896-891E-8A8B9DC9F8B6}\InprocServer32\2026.1.3877.2566 MSI3936.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{BA67E505-4EA4-3896-891E-8A8B9DC9F8B6}\ProgId MSI3936.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57DA5893-AC40-3812-8386-7945EF620124}\InprocServer32\2026.1.3877.2566\Assembly = "AblebitsUltimateSuite, Version=2026.1.3877.2566, Culture=neutral, PublicKeyToken=c5f27ee33718ff24" MSI50A7.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AddinExpress.AddIns.xlFormulaEditor.EditorTaskpaneControl\CLSID\ = "{D1D51A8A-3DE3-35F2-8A20-5761C2A29642}" MSI50A7.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA67E505-4EA4-3896-891E-8A8B9DC9F8B6}\InprocServer32\2026.1.3877.2566\CodeBase = "file:///C:/Program Files (x86)/Ablebits/Ultimate Suite for Microsoft Excel/1DD3A559C6C92DD/AblebitsUltimateSuite.DLL" MSI50A7.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4D2E01C-6BB9-4BE8-0025-BB93B5A90B2E} MSI71FC.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{0F48EAEE-BC30-307A-84BB-90A8A1802DE2}\ProgId\ = "AddinExpress.SubstringOperations.adxRegistryRemoveSubstrings" MSI3936.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{EA8460D2-AA6F-3AA0-B1B3-2F8024CB389E}\ProgId\ = "AddinExpress.AddIns.xlFormulaEditor.EditorTaskpane" MSI3936.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{5B35428F-BEBA-3EF5-BC3E-9F8623696102}\ = "AddinExpress.AddIns.xlDatePicker.DatePickerHeader" MSI3936.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{93BA10A4-C3A6-3F71-AC6B-8766EEB1D2E7}\InprocServer32 MSI3936.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{872D60C8-A418-3BAE-B446-986CEB09344C}\ = "AddinExpress.AddIns.xlDatePicker.DpiImages+DpiImage" MSI3936.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0DFA123-27F1-33D7-BEFD-9E729CB2CC11}\InprocServer32\RuntimeVersion = "v4.0.30319" MSI50A7.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C1007947-EB9D-3462-ACBC-77E22D291A46}\InprocServer32\ = "mscoree.dll" MSI50A7.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{F86B3CD1-E48E-3140-853D-13D6C7F28FF9}\Implemented Categories MSI3936.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{72373D89-9DEB-3203-94DE-EF2CFFD580B1}\InprocServer32\2026.1.3877.2566 MSI3936.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D617CE6-C7CF-4B1D-86B4-BF8C8C530210}\ = "{4BA250A6-8BCA-46A6-982A-F340081187C3}" MSI50A7.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C6752A0-B163-3A4F-9E8F-C606DB3E2BF4}\ = "AddinExpress.TextToDatetime.TextToDateTimeOperationsModule" MSI50A7.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C663E113-FC66-3512-8028-264764D06938}\ProgId MSI50A7.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8319BCD7-5DE9-3EF0-898C-8CE41B2FC60E} MSI50A7.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F0B719C-7CC1-3402-929D-5741188B4A98}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} MSI50A7.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{875BB7E7-212B-349C-A910-B3905A7A19BA}\Implemented Categories MSI50A7.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{A56F3B4D-2C29-3812-A478-869A284F5ECD}\ProgId MSI3936.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{93BA10A4-C3A6-3F71-AC6B-8766EEB1D2E7}\InprocServer32\ = "mscoree.dll" MSI3936.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{4623EA0B-EEEA-3C99-8C86-7B1DA65FE8CD}\Implemented Categories MSI3936.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{30362A5A-9A58-3FBF-898D-0073DCF1E71B}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} MSI3936.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{ADE03136-4983-3BFB-951E-B6ED87EF5DA2}\InprocServer32\2026.1.3877.2566 MSI3936.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5076CE6A-BCFD-3668-9F35-90D1317B6794}\InprocServer32\2026.1.3877.2566 MSI50A7.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{890589F8-0CB4-3BA1-9912-4338FA068F1D}\InprocServer32\Assembly = "AblebitsUltimateSuite, Version=2026.1.3877.2566, Culture=neutral, PublicKeyToken=c5f27ee33718ff24" MSI3936.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\AddinExpress.AddIns.XLFindDuplicates.FDCWizard\CLSID MSI3936.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5294F070-7035-3B73-977B-FA4B8CAA5A56}\InprocServer32\ThreadingModel = "Both" MSI50A7.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0A3727C3-0628-3EDE-B3C1-0A4B30174E79}\InprocServer32\ThreadingModel = "Both" MSI50A7.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{110B5002-E5CD-3C2A-A69A-DDB7D76B4014} MSI50A7.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97A282A2-2465-3353-B692-8956951BDFC9}\InprocServer32\2026.1.3877.2566 MSI50A7.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{9E0728EC-D18C-3A7E-9275-24B7CB2B49FD}\ = "CompareWorksheets.StepOptions" MSI3936.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{31D15AFD-12BB-3968-9552-A729D1568EC6}\InprocServer32\ = "mscoree.dll" MSI3936.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{9E0728EC-D18C-3A7E-9275-24B7CB2B49FD}\InprocServer32 MSI3936.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\AddinExpress.SubstringOperations.adxRegistryRemoveSubstrings MSI3936.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AEECF786-7E80-402D-BC15-A180B3A74385}\1.0\0\win32 MSI50A7.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5076CE6A-BCFD-3668-9F35-90D1317B6794}\InprocServer32 MSI50A7.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91BAA0AE-8314-3427-B7C8-62EDF1B8BBD6}\ProgId MSI50A7.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\WOW6432Node\CLSID\{8319BCD7-5DE9-3EF0-898C-8CE41B2FC60E}\InprocServer32 MSI3936.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{C0DFA123-27F1-33D7-BEFD-9E729CB2CC11}\InprocServer32\ThreadingModel = "Both" MSI3936.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{492D7AE3-2CF7-3D4B-85DB-565F71B1EEE1}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/Ablebits/Ultimate Suite for Microsoft Excel/1DD3A559C6C92DD/AblebitsUltimateSuite.DLL" MSI3936.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{94D6D178-3183-3A7A-B27F-37F556414EA0}\Implemented Categories MSI3936.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{42DDB32D-B255-3B39-9DAF-558A94DFE4B9}\InprocServer32\ = "mscoree.dll" MSI3936.tmp - Modifies system certificate store 2 TTPs 4 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\9617094A1CFB59AE7C1F7DFDB6739E4E7C40508F\Blob = 0300000001000000140000009617094a1cfb59ae7c1f7dfdb6739e4e7c40508f20000000010000007e0400003082047a30820362a003020102020a6101cf3e00000000000f300d06092a864886f70d01010505003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f667420436f6465205369676e696e6720504341301e170d3039313230373232343032395a170d3131303330373232343032395a308183310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f5052311e301c060355040313154d6963726f736f667420436f72706f726174696f6e30820122300d06092a864886f70d01010105000382010f003082010a0282010100bd3089fb4572a8536b9e894f0023c0bed41d3db1594038f373918226e696120053d91c820e3cce1dbbbdf7428d97d4fc381ae4b9f9e3ecd36103bfa0d3d6754d5c46a9ed5ef0d2e2695b1a73eab31c8d04cd2944a064592f1e985d6ec7ab18398265c4a7bcab758819ea87971426b37f2676a4d4383984e3b326d518f92be9d2c9165a5421f2978d878629fef4492ce68bf8043f7dcdcd9692860d7103e2d0fe0c4235ffd7b83fdd8e450a7df6d74bad5bf076721d77237d8935c41c5db250034b476d07a75588980680a681ad544ed881d6fabf42c031be550d99d553491230ebe5a5887c5ec47a5a148708b43769a0eb32248c08ebf9d414bae0fccdeaa4150203010001a381f83081f530130603551d25040c300a06082b06010505070303301d0603551d0e0416041438780573c81b329b5f928655af89bac699b1748e300e0603551d0f0101ff040403020780301f0603551d23041830168014cc1dce7600705baff1dac44e9a51442ea34463f030440603551d1f043d303b3039a037a0358633687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f43535043412e63726c304806082b06010505070101043c303a303806082b06010505073002862c687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f43535043412e637274300d06092a864886f70d01010505000382010100280383ab130df1fe116f4276d843abb8c642fa246534ae75b071308e96b683fa72e4fecd37e73a709851200eba71b4c9f4d5e48ae8287073d5ede1c27beef156345a8082eb10d77203ea124eecdd0d8c7b444f0c6175fd6e9c07ddce2b5a180d39b060fddaff04aa02a3d8fa8ea3bbbdc16a543b315fe42c6ecbf14d2a1cf21e767b86afc687d6b12aedaccc0ec0e49f7fe8cfe884725482186e2ac89e95b41a1ec16f93db62a6c14b6badc9ed3d92e3b22fab7a7739676a007b829d0310de6395492642de9522c1870bd014a35fdc733272361effc829c524524f6648c91d1da9c5263969504ea7ecc2066c2e721bf121da6d2448808115407c9fcc74384a4f MSI37ED.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03B6A2D771A81212474B5444BFF77A3059E9BE64 MSI37ED.tmp Set value (data) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03B6A2D771A81212474B5444BFF77A3059E9BE64\Blob = 03000000010000001400000003b6a2d771a81212474b5444bff77a3059e9be642000000001000000800700003082077c30820564a003020102021017aceb2c96223b38ec08986355904e8c300d06092a864886f70d01010b0500306a310b300906035504061302504c3121301f060355040a131841737365636f20446174612053797374656d7320532e412e313830360603550403132f43657274756d20457874656e6465642056616c69646174696f6e20436f6465205369676e696e672032303231204341301e170d3233303632363130313731335a170d3236303632353130313731325a3082013531133011060b2b0601040182373c0201031302504c311c301a060b2b0601040182373c0201020c0b6d617a6f776965636b696531193017060b2b0601040182373c0201010c08576172737a617761310f300d0603550411130630352d303932311d301b06035504090c14756c2e20576172737a6177736b61203130392f35311d301b060355040f131450726976617465204f7267616e697a6174696f6e311330110603550405130a30303030393033383631310b300906035504061302504c3114301206035504080c0b6d617a6f776965636b69653112301006035504070c09c5816f6d69616e6b6931243022060355040a0c1b4f6666696365204461746120417070732053702e207a206f2e6f2e3124302206035504030c1b4f6666696365204461746120417070732053702e207a206f2e6f2e308201a2300d06092a864886f70d01010105000382018f003082018a0282018100a09ed9beb912d61bfa6152466b37ff233c838a7bb35c825ef28cdb1170657627a89cb3897f283cc89eb5c7f6a9646676578d428befd863deddd6c463e728b6c9ccae0b8e59ad56f07d8a867cd366bcb7912ffcd42cdd12273c3999f878a76c0edee8ea0d7ed2c6ca1d582ab7f7baefa5e4689073bc916f1ad34143faf2b1b5930e060b0bc0ab2dfda0ac9ee7c4e4b83c0a03201404748870561ebc4b1b946ca4ea52ca64039d46ce29d817351d022ee1c9215c923abb9298926d31c3e992635437cda4e566d33fcaaa0ccae6ccbc008964b5d415c140594b72c2e4720e6d4cd0d870dbfb992c95f22a7cb46ad9bf632fff53fbb2adc719b51590b09059755e8ddc32e3220e468528f34e46677a20d3dca9c1ad2f477ce5d78f5d99942c7f2fee126581df6f6a64b423374376ef0399e803751f3efdbcd12776bd7a6d8a6fbae4dcbd8419c875a0a7d928a4059bd1ad995b7fd86dd4c83d8df5f2c659d7fc2db5976432cc240effa1cfa348d1c1880a941d5406f11cc6b467e23e2502930002950203010001a38201cf308201cb300c0603551d130101ff0402300030410603551d1f043a30383036a034a0328630687474703a2f2f63657663736361323032312e63726c2e63657274756d2e706c2f63657663736361323032312e63726c307706082b06010505070101046b3069302e06082b060105050730018622687474703a2f2f63657663736361323032312e6f6373702d63657274756d2e636f6d303706082b06010505073002862b687474703a2f2f7265706f7369746f72792e63657274756d2e706c2f63657663736361323032312e636572301f0603551d23041830168014ac57ca0816dc3fc5311c0a4ddbfbf1de99272d34301d0603551d0e04160414fec1efe4c7558281349bdf69d378980275966989304a0603551d20044330413007060567810c01033036060b2a84680186f677020501073027302506082b06010505070201161968747470733a2f2f7777772e63657274756d2e706c2f43505330130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780304e0603551d1104473045a04306082b06010505070803a03730350c33504c2d4d415a4f574945434b49452d574152535a4157412d4f4646494345204441544120415050532053502e205a204f2e4f2e300d06092a864886f70d01010b050003820201004cf9ee0e4a992011de9d4ae0732f6b2fa36a941712bad47696a266104abebf6ae3f0d14b87a3c43125eb8593254dc1e8980b7c2cf64fb35455746ee74e5adef3c5cfdddeb72659d745f8c4860df759a7aef6b6d8b2e22119be614cdb8dccabf515745f03a3102427bd689ebe14fc7d5728c142ed5922c477847e328536991f7f3cfd4bbac9ef8e7e0c9c911422ddf512e27fcecdc430f079ae7541dd1962c5b86234ef7503d8beea2946d690aab29cf11414813d06b99487d340e0b21e757a0ec6f233feba8ac15bf95d9bd7f0ca72e45ed042957cadd916591454403d514d370dca5eea38f6faaf6f812fc6e8740650d27793d675c9d30a18c636ae22ebd242dd6458d69b1300316cf653081d8d5ae003153b6fbef86a4afdc3fdba98a556278aabbf26b89886982c3fc15afd2668d339eae726c3c82680fb584bdc6cabffad2c76b0f9c355be2b0631f38507db1a7683ef404bb28058d51c4fed16ff063d35063a80205316d952bb57d090d1a2e2f8069079f1eae066de811a95bfde92666ecc32a1b2babc9699c7993ea091de38e7328c1443a60d64d343697c77f7f38556f9bd06e80419955f757bc753b1a84643daa601da3287d7238b8df759749ce0206839c8d725311076186023eb210c8300c5d0af1d606db762b1f4841f3ffaca381d65e59a3a832e5d765bbd3879d9c8d2a4dfe16c7ddbba267abca3d1b5c5e2e4 MSI37ED.tmp Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\9617094A1CFB59AE7C1F7DFDB6739E4E7C40508F MSI37ED.tmp - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 6096 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 1088 rundll32.exe 1088 rundll32.exe 1752 rundll32.exe 1752 rundll32.exe 5024 msiexec.exe 5024 msiexec.exe 5600 MSI3936.tmp 5600 MSI3936.tmp 1248 MSI50A7.tmp 1248 MSI50A7.tmp 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 4792 msedge.exe 4792 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 6004 msedge.exe 6004 msedge.exe 6004 msedge.exe 6004 msedge.exe 6004 msedge.exe 6004 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4648 msiexec.exe Token: SeIncreaseQuotaPrivilege 4648 msiexec.exe Token: SeSecurityPrivilege 5024 msiexec.exe Token: SeCreateTokenPrivilege 4648 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4648 msiexec.exe Token: SeLockMemoryPrivilege 4648 msiexec.exe Token: SeIncreaseQuotaPrivilege 4648 msiexec.exe Token: SeMachineAccountPrivilege 4648 msiexec.exe Token: SeTcbPrivilege 4648 msiexec.exe Token: SeSecurityPrivilege 4648 msiexec.exe Token: SeTakeOwnershipPrivilege 4648 msiexec.exe Token: SeLoadDriverPrivilege 4648 msiexec.exe Token: SeSystemProfilePrivilege 4648 msiexec.exe Token: SeSystemtimePrivilege 4648 msiexec.exe Token: SeProfSingleProcessPrivilege 4648 msiexec.exe Token: SeIncBasePriorityPrivilege 4648 msiexec.exe Token: SeCreatePagefilePrivilege 4648 msiexec.exe Token: SeCreatePermanentPrivilege 4648 msiexec.exe Token: SeBackupPrivilege 4648 msiexec.exe Token: SeRestorePrivilege 4648 msiexec.exe Token: SeShutdownPrivilege 4648 msiexec.exe Token: SeDebugPrivilege 4648 msiexec.exe Token: SeAuditPrivilege 4648 msiexec.exe Token: SeSystemEnvironmentPrivilege 4648 msiexec.exe Token: SeChangeNotifyPrivilege 4648 msiexec.exe Token: SeRemoteShutdownPrivilege 4648 msiexec.exe Token: SeUndockPrivilege 4648 msiexec.exe Token: SeSyncAgentPrivilege 4648 msiexec.exe Token: SeEnableDelegationPrivilege 4648 msiexec.exe Token: SeManageVolumePrivilege 4648 msiexec.exe Token: SeImpersonatePrivilege 4648 msiexec.exe Token: SeCreateGlobalPrivilege 4648 msiexec.exe Token: SeCreateTokenPrivilege 4648 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4648 msiexec.exe Token: SeLockMemoryPrivilege 4648 msiexec.exe Token: SeIncreaseQuotaPrivilege 4648 msiexec.exe Token: SeMachineAccountPrivilege 4648 msiexec.exe Token: SeTcbPrivilege 4648 msiexec.exe Token: SeSecurityPrivilege 4648 msiexec.exe Token: SeTakeOwnershipPrivilege 4648 msiexec.exe Token: SeLoadDriverPrivilege 4648 msiexec.exe Token: SeSystemProfilePrivilege 4648 msiexec.exe Token: SeSystemtimePrivilege 4648 msiexec.exe Token: SeProfSingleProcessPrivilege 4648 msiexec.exe Token: SeIncBasePriorityPrivilege 4648 msiexec.exe Token: SeCreatePagefilePrivilege 4648 msiexec.exe Token: SeCreatePermanentPrivilege 4648 msiexec.exe Token: SeBackupPrivilege 4648 msiexec.exe Token: SeRestorePrivilege 4648 msiexec.exe Token: SeShutdownPrivilege 4648 msiexec.exe Token: SeDebugPrivilege 4648 msiexec.exe Token: SeAuditPrivilege 4648 msiexec.exe Token: SeSystemEnvironmentPrivilege 4648 msiexec.exe Token: SeChangeNotifyPrivilege 4648 msiexec.exe Token: SeRemoteShutdownPrivilege 4648 msiexec.exe Token: SeUndockPrivilege 4648 msiexec.exe Token: SeSyncAgentPrivilege 4648 msiexec.exe Token: SeEnableDelegationPrivilege 4648 msiexec.exe Token: SeManageVolumePrivilege 4648 msiexec.exe Token: SeImpersonatePrivilege 4648 msiexec.exe Token: SeCreateGlobalPrivilege 4648 msiexec.exe Token: SeCreateTokenPrivilege 4648 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4648 msiexec.exe Token: SeLockMemoryPrivilege 4648 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4648 msiexec.exe 6004 msedge.exe 4648 msiexec.exe - Suspicious use of SetWindowsHookEx 22 IoCs
pid Process 4648 msiexec.exe 5024 msiexec.exe 3976 MsiExec.exe 988 MsiExec.exe 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE 6096 EXCEL.EXE - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1952 wrote to memory of 4648 1952 ablebits-ultimate-suite-excel-v2026-1-3877-2566.exe 90 PID 5024 wrote to memory of 3976 5024 msiexec.exe 92 PID 3976 wrote to memory of 5540 3976 MsiExec.exe 93 PID 3976 wrote to memory of 1088 3976 MsiExec.exe 94 PID 3976 wrote to memory of 4604 3976 MsiExec.exe 95 PID 5024 wrote to memory of 988 5024 msiexec.exe 97 PID 988 wrote to memory of 1752 988 MsiExec.exe 98 PID 5024 wrote to memory of 5988 5024 msiexec.exe 99 PID 5024 wrote to memory of 5600 5024 msiexec.exe 100 PID 5024 wrote to memory of 1248 5024 msiexec.exe 101 PID 988 wrote to memory of 2992 988 MsiExec.exe 102 PID 5024 wrote to memory of 3100 5024 msiexec.exe 103 PID 5024 wrote to memory of 5408 5024 msiexec.exe 122 PID 5024 wrote to memory of 5292 5024 msiexec.exe 105 PID 5292 wrote to memory of 6004 5292 AblebitsOfferUtils.exe 106 PID 6004 wrote to memory of 4568 6004 msedge.exe 107 PID 6004 wrote to memory of 1876 6004 msedge.exe 108 PID 6004 wrote to memory of 2752 6004 msedge.exe 109 PID 6004 wrote to memory of 1876 6004 msedge.exe 108 PID 6004 wrote to memory of 1876 6004 msedge.exe 108 PID 6004 wrote to memory of 5548 6004 msedge.exe 110 PID 6004 wrote to memory of 5548 6004 msedge.exe 110 PID 6004 wrote to memory of 1072 6004 msedge.exe 111 PID 6004 wrote to memory of 1072 6004 msedge.exe 111 PID 6004 wrote to memory of 1072 6004 msedge.exe 111 PID 6004 wrote to memory of 3760 6004 msedge.exe 112 PID 6004 wrote to memory of 3760 6004 msedge.exe 112 PID 6004 wrote to memory of 3760 6004 msedge.exe 112 PID 6004 wrote to memory of 4992 6004 msedge.exe 114 PID 6004 wrote to memory of 4324 6004 msedge.exe 115 PID 6004 wrote to memory of 4992 6004 msedge.exe 114 PID 6004 wrote to memory of 4992 6004 msedge.exe 114 PID 6004 wrote to memory of 4324 6004 msedge.exe 115 PID 6004 wrote to memory of 4324 6004 msedge.exe 115 PID 6004 wrote to memory of 2132 6004 msedge.exe 116 PID 6004 wrote to memory of 2132 6004 msedge.exe 116 PID 6004 wrote to memory of 1120 6004 msedge.exe 118 PID 6004 wrote to memory of 5440 6004 msedge.exe 119 PID 6004 wrote to memory of 1120 6004 msedge.exe 118 PID 6004 wrote to memory of 5440 6004 msedge.exe 119 PID 3976 wrote to memory of 2860 3976 MsiExec.exe 120 PID 6004 wrote to memory of 5408 6004 msedge.exe 122 PID 3976 wrote to memory of 3060 3976 MsiExec.exe 123 PID 3976 wrote to memory of 2452 3976 MsiExec.exe 124 PID 2452 wrote to memory of 6096 2452 rundll32.exe 126 PID 6004 wrote to memory of 5092 6004 msedge.exe 129 PID 6004 wrote to memory of 5092 6004 msedge.exe 129 PID 6004 wrote to memory of 3772 6004 msedge.exe 130 PID 6004 wrote to memory of 3772 6004 msedge.exe 130 PID 6004 wrote to memory of 4436 6004 msedge.exe 131 PID 6004 wrote to memory of 4436 6004 msedge.exe 131 PID 6004 wrote to memory of 4864 6004 msedge.exe 133 PID 6004 wrote to memory of 4864 6004 msedge.exe 133 PID 6004 wrote to memory of 3148 6004 msedge.exe 135 PID 6004 wrote to memory of 3148 6004 msedge.exe 135 PID 6004 wrote to memory of 3148 6004 msedge.exe 135 PID 6004 wrote to memory of 2992 6004 msedge.exe 136 PID 6004 wrote to memory of 4980 6004 msedge.exe 137 PID 6004 wrote to memory of 2860 6004 msedge.exe 138 PID 6004 wrote to memory of 2920 6004 msedge.exe 139 PID 6004 wrote to memory of 2920 6004 msedge.exe 139 PID 6004 wrote to memory of 1588 6004 msedge.exe 143 PID 6004 wrote to memory of 1588 6004 msedge.exe 143 PID 6004 wrote to memory of 5536 6004 msedge.exe 144
Processes
-
C:\Users\Admin\AppData\Local\Temp\ablebits-ultimate-suite-excel-v2026-1-3877-2566.exe"C:\Users\Admin\AppData\Local\Temp\ablebits-ultimate-suite-excel-v2026-1-3877-2566.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\excel-ultimate-suite.msi"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4648
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 210DB9AE35199F140D2816BEA7CFC294 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIB433.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240760046 1 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.CheckAgreeAddTrustedCertInstalled3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5540
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIB80C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240760890 10 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.CheckExcelBrothersProductsInstallated3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1088
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIBBC6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240761828 26 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.SetTimestamp3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4604
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8AFE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240814906 34 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.CheckExplorerPreview3⤵
- System Location Discovery: System Language Discovery
PID:2860
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8CE4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240815437 39 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.CheckExcelDuringInstall3⤵
- System Location Discovery: System Language Discovery
PID:3060
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8F46.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240816718 44 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.RunExcel3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6096
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F474807188A2B8D735B24B2831D36B162⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI2CFD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240790937 2 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.CheckExcelBrothersProductsInstallated3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1752
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI6FF7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240807984 25 AblebitsInstallUtils!AblebitsInstallUtils.CustomActions.CheckExcelInteropsProblem_PE3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2992
-
-
-
C:\Windows\Installer\MSI37ED.tmp"C:\Windows\Installer\MSI37ED.tmp" ADD CurrentUser2⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- Modifies system certificate store
PID:5988
-
-
C:\Windows\Installer\MSI3936.tmp"C:\Windows\Installer\MSI3936.tmp" /install="C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AblebitsUltimateSuite.dll" /privileges=user /log="C:\Users\Admin\AppData\Local\Temp\Ablebits\Ablebits-ExcelUltimateSuite-registration_perUser.log" /timestamp=1DD3A559C6C92DD2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5600
-
-
C:\Windows\Installer\MSI50A7.tmp"C:\Windows\Installer\MSI50A7.tmp" /install="C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AblebitsUltimateSuite.dll" /privileges=admin /scope="perMachine" /log="C:\Users\Admin\AppData\Local\Temp\Ablebits\Ablebits-ExcelUltimateSuite-registration_perMachine.log" /timestamp=1DD3A559C6C92DD2⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1248
-
-
C:\Windows\Installer\MSI71FC.tmp"C:\Windows\Installer\MSI71FC.tmp" RegisterAblebitsLoaderPERMACHINE UltimateSuite "C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\ "2⤵
- Executes dropped EXE
- Modifies registry class
PID:3100
-
-
C:\Windows\Installer\MSI7299.tmp"C:\Windows\Installer\MSI7299.tmp" /RemovePerMachineHostRegistration:Ablebits.Suite.1DD3A559C6C92DD2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5408
-
-
C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AblebitsOfferUtils.exe"C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AblebitsOfferUtils.exe" install us personal L:LC:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\L:L 52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.ablebits.com/docs/excel-ultimate-suite-getting-started/?edition=personal:non-activated&version=2026.1.3877&event_details=crt:n3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x320,0x7ffa04dec188,0x7ffa04dec194,0x7ffa04dec1a04⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,4593451310466574329,18343817687277449073,262144 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:24⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,2307994839915324174,7011960732442886613,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:114⤵
- System Time Discovery
PID:2752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,987267182708951225,7101917111786988489,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:134⤵PID:5548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,15854514944078991682,5245960995122603284,2097152 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14⤵PID:1072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,676381430882148775,8724844511385811845,2097152 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14⤵PID:3760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,13454423835351008984,10329230013107032109,2097152 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14⤵PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,12848179012571224930,3297736545219446873,2097152 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:94⤵PID:4324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,13946417076302572704,9227471094548366591,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:144⤵PID:2132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,6711051868338957845,12793779016263574974,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:144⤵PID:1120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,10594071315873540099,4852479567950472114,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:144⤵PID:5440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,712923336699958981,4896980002003992526,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:144⤵PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,712923336699958981,4896980002003992526,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:144⤵PID:5408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,13542141309173500962,10516344781684032445,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:144⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,15636303144228643396,8415135090642569399,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:144⤵PID:3772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,14126573190805896439,5411993497526165318,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:144⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,16702702324562230278,844519002093058646,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:144⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6236,i,11369621352932185613,12703845240754305627,2097152 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14⤵PID:3148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,8067761898998276897,5316494361666049739,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:144⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,12449751925157178822,5408785431234421303,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:144⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,3958622283570246781,3639706322565483415,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:144⤵PID:2860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,1451360307963298489,4796767139551108637,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:144⤵PID:2920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,4281106062997710490,10683893741596398097,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:144⤵PID:1588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,9596347069591086974,10431037984746408178,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:144⤵PID:5536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,13101229436772921817,14106390331759628448,524288 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:144⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3804,i,7474893193446385031,10983762861234002161,262144 --field-trial-handle=2140,i,1932950713697037220,5727826351263052354,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
PID:4792
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3508
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:3244
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4340
-
C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AblebitsLoader.exe"C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AblebitsLoader.exe" -Embedding1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4828
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a29a2.rbs
- Size 18KB
- SHA256 97c2300c12a91b7ce71985e29a46febeb50418df691ca4c2186de56d602cd795
- MD5 087252bb2c9e21256e231ee38c0901f1
- SHA1 9d09ad7b3b0f05c7af0bff47669eeddbe63bc5f7
- SHA512 ebf501730ff6baf4bb8cdc37996279f0aab2ca438ddd02c92b074c3902ad4e79ce3332e14808d6ee6a5142c0bf380561044bc425b85b76db3e4b1431c2091f52
- SSDEEP 384:DrRA8o2lduQlf7H3Hiuo2Lck02AlDG6uJBdnEGK:D1A8o2ldtNXC
- TLSH T1F58262C3AC03D2D3FF0117FA5A861A15BB9957AAE5544F1914DCE12A898BBCC47FE201
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Ablebits.ExcelDataReader.dll
- Size 77KB
- SHA256 313fdfeacaf4651eb8c96ee2572a6371f37737fc2b0cdaad04fcf73089e8217a
- MD5 1f488d3cd94c350beafc5fb46c593114
- SHA1 230ea5abc3a206adf23bed3f6e93f040093cfc4d
- SHA512 63441cf21f9c751c18a494a0f1ec6d10c0ccde915e886151f9818b44d35fd76a973a914d956d82c5b82321af1a57b4537c94a024427d23782067af66fc6b21e7
- SSDEEP 1536:n1b/nTw72ZesnWttIG9AIm4p9RL6TiOSXzq0FO9BEN8tdxR:1bO2RnWOG97PRuTibXzzO9qez
- TLSH T14A736C073BFC024AE6BF8EF5F4F590210A72B1A27726D6AF28A550EE45127B04671F17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Ablebits.ExcelTemplates.dll
- Size 3.6MB
- SHA256 616255b87641c4ceac055e09454d6fd0560bea908ed47f66f0b0ec7adc952733
- MD5 09243312684120635cdf780f5f8fedcf
- SHA1 3f6eb7c28770642355cc27a3e29a5af70c86e1f7
- SHA512 93d75cefd40fb2185a366d98b20059f01d27d9a202d9a907c995bbfe2e0a9b3f5fdee6685489ddc8ea4466238f719f55b5a1c22a9dc0e086daabc38c7f943ce8
- SSDEEP 49152:AGnmtWsKlrnCGIJTpQpqQD+Go1BNFZ8TB4MMMMMeGTMXMMMMMw1wz8:AGmnpQUwHa+TB4MMMMMecsMMMMMUwY
- TLSH T1D0061915EAD0722DD2AA0670CC6B457082BBAE435EC1877F26D4B36FC931374B9F1266
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Ablebits.Helper.dll
- Size 111KB
- SHA256 9d55602b5d50e00f3c412c6ee991c9de2206c19962ed6ff64795d9f194787307
- MD5 cde0ba5c7e971e31afa5ed561d7bbff2
- SHA1 f74a56f9fdc1dbb0181310c8c9b2eacdeaecbdcc
- SHA512 a74d537e5a4e62bb09f11e1d32c955d67a38a220acf2aef40577b5efd4d960fbe1fb8ebc41c773f6eec8187bc3b5422893268044c295dbd92993d94ac1925a44
- SSDEEP 3072:4gkrXG1Rblkw9Mw80eo3o3S0RTKI+1e98:4g6X8bjX8C43H+1P
- TLSH T1E5B37CA07795CD63C7DE493EE494695143719E0AA907E3DB98C8F5FC36B338209052EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Ablebits.NativeAPI.dll
- Size 72KB
- SHA256 873a58314c6ccb0457bc0be899a32997f5b78ee8ef07925d28697edd1843742d
- MD5 62447f9ee6b4fbf1fd3463f9d84341f9
- SHA1 9747d1dfd6208db1715d3182a9c22eed122bcccb
- SHA512 ac5ace86b0fa36b8bb14d37a55fa24591ed6ebcb8b0d31df69c82bf7ae81e7b7d0a25ca640a4e2cd877501ab1c895c93a07c9fcb38fab06d4f1b5c30d4e220c1
- SSDEEP 1536:mNb5ocjmC2WfxKeqoMUIQLppBwKliVE/9eoQA8tdxtQ:mNb5NjmC2WfxKWLBwKkVE/9eLDzQ
- TLSH T102738E2743A50992DD5E967EB4333F05DBF0F184014BF3AB188A84F87AB33A419662E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Ablebits.SelectRangeController.dll
- Size 97KB
- SHA256 af93464ba9ba494b599f5c0703b198c8dcd4e9ce4589946bbd0b8db59e0f8da4
- MD5 16b9f4170dd7e7d083b2897a9fde21cd
- SHA1 ee22dce3c021a8a9d273715e210a2b540b2e8ea5
- SHA512 294fb6af1ffea8b46860ca82c6b3cd4925c36171962991e083851f28e1d9b69f040663601c6da53a9363d76d3a00ebbbfff1fb5dd53d15697b4c811116eda2fc
- SSDEEP 3072:wq9pDmbhc6ljhjs/rtm5osHaA8LYCnsETfWHdQrV9:wq9E2whm+6A8LYCnsETf/
- TLSH T1E8A36D3853EC4F2ED5AE0778B0B521124BB4E6A4B982E75F2F08D0DE15A33918F951E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Ablebits.US.ThreadUtils.dll
- Size 16KB
- SHA256 9c1e720284a57ac92d4e4865c7ae0f82dd8f3cf5da1adb627aadf61185c55555
- MD5 079b8ae370adb74629cecd5677b4aa75
- SHA1 9739ba557ad9874d712204395b784ea328f41c08
- SHA512 84e9eaf7fd4f4f792333c57b9de96f0e329d7c03a0cb3c2d4e147b1eedd09dab10d300879dd4f156410b81f9b850d82c80401fa83da8801efcb27565b6511a65
- SSDEEP 384:mgM7X7b+lDCrrQ2ADhrytzsnr5Xy8RbmL4nNy7LQRGQ:HkbSCr82ADhE2VX5ALhQRj
- TLSH T10A723B235FD44846DC776F30B0E96B229D73B500AE72CE8B221C93964F12385AEB5639
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\Ablebits.WelcomeTour.dll
- Size 2.6MB
- SHA256 fe1e4ffa48b92dcd37a7fd2cca65930311fe704fd5487842318d5e5046b4b0a2
- MD5 ba616fea90ea7c7996b8c1570ee4919e
- SHA1 8731296f25421f7bc019227a0f9d0aed31c464f3
- SHA512 cb823d29b3387a098e9846aa4aa59018f40fcb04865e696004c2cbeee03a9e6af9a5d187975263023eb5e6d31f33d681b480266bcff5103cab2129539f5bc501
- SSDEEP 49152:Nwa7KGvdb+UMF+fUprUtB8nYyFasAu4fjHmo3jb+0q0tlGLEtwIo4q3mKJXXlxLZ:NwIvdiUY+fUdUtiFDojxTb+eGLEtxOm6
- TLSH T1E1D501B6CB598CEFC55C427290D30F75BBF2168161E2A30B873521396EDB349AD22DC6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AddinExpress.MSO.2005.dll
- Size 4.2MB
- SHA256 8c298689dd5ab009ae743d06ccf00b8dbc9cbbe4dc11b6474f3c5e26de5b7901
- MD5 43365f6e20902f525a7f64c1c7d9adc3
- SHA1 369b1d0bbaaf9bb139a3af754892d4552ece5187
- SHA512 ea57fd94b669e1ce13c802b421224b68d0521b7a437348ea203848500884fef65c7eca6d88162b24c42d884eab333b8a110e479f597f29f0bfa7d12464d2fd79
- SSDEEP 24576:WmxSF6YefgNkgR2Q3eETkRf7GJclY+6fsRwukV3wbF6fyaLiPKXSg36wb7PbeVf9:MJgpREuriYF
- TLSH T16B168053AAEC7CEAC1396375773793D6C3ADED491211C20E64C0662A29BE3137A037D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\AddinExpress.XL.2005.dll
- Size 711KB
- SHA256 4ac69672810baf9e0c8201aa7840c6078b0823fbc101e4cabc95a327a0f240ff
- MD5 9f592848149f6d76cec8bb0f96ab5a50
- SHA1 f07249920bdb4173cbaf103f66e14acb7c6a0239
- SHA512 2969b8ef39dce95a74fef50bf7b018568a2bac4e070781590b8cb89669af61b9d6e386ce3804d6505d47792c875ac11767b07064b100f342f003225b1e4d6206
- SSDEEP 6144:Ch0HlPRaE6JtJi4Ev7ew0HsR+WhMVnFlwGIlrQvdWKV6MZpKSQZ92X1tEgFbKo+T:S0HaE4Ji9Tehs1a1gG9JmXoBKljQ5mGK
- TLSH T1DAF44A122BE87CA2D07E03BDA3B75392C7B8ED059613D35E45C4A0A91DBA352BE017D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\adxloader.dll.manifest
- Size 4KB
- SHA256 6c54ea6674296d696b23347a1e3ffb70cfb20fa4dc0bc001e5b991950009f3bc
- MD5 4e56f49b41a0521d78126d014dc5b988
- SHA1 5bf6719f72d32d8ee8de3e157f4ac4c08ea420f1
- SHA512 5303ff30cd1f15cdc5d724bdc9155ca7345876f9f993b023a60d6ce71bf8c99ebf9f7bb42c757e2c5c967d07c589d8da54ded1ff87f34baa278210a4e19c816e
- SSDEEP 96:t+yQWclYdfXEKNu7Zp5r/svbvLXN1FU83kODo+SRYP0xeklKloFsIm:tvfclYdfXE0u75sDvzFU69o+MYcxeqGb
- TLSH T138A15C2F68C9790C2701937FD973CC16508B3E4346E8606E7E69393A89444BA22628DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ablebits\Ultimate Suite for Microsoft Excel\1DD3A559C6C92DD\adxloader.dll.manifest
- Size 4KB
- SHA256 159e54611fdadb1eca5c6955ce3011a6cef56261eb7335e87a146de4776588b6
- MD5 e4c0ade962b76812f137a92687bd3e04
- SHA1 4b7f6daaf6a07a6d2accabc6cf4b59fcca9309ec
- SHA512 bf7baf4f71eb1ae596326a0dac993a75dcd6729fff161bcc1dd815c4aba35e1ad85d639ed3148e5f1516dd59fa8cd4393ac4619dfd7d6b4230d8f0577a4039fa
- SSDEEP 96:t+yQWclYdfXEKNu7Zp5r/svbvLXN1FU83kODo+SRYP0xeklKloFsIm:tvfclYdfXE0u75sDvzFU69o+MYcxeqGb
- TLSH T1D6A14D2F68C9790C2701936FD973CC16549B3E4745E8506E7E6939398D444B623728DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
- MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
- SHA1 610df135117504b2857ee3cc03a5ac9797b10333
- SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
- TLSH T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
- MD5 04925ec9b8ab191e010732cba0eeefe1
- SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
- SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
- TLSH T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 7ae12b8b720cab6dc8cf06f3cb37ff50ba8aab469a3b5240dbf1dd60faaffba5
- MD5 1c7c19e858a055c9b622368cec246768
- SHA1 34571d4ce610209743d28d3c51ad7a00feb21b4a
- SHA512 e28f6d2696ce941c5018abac7a9aa216ec40f2a30e8f03f793c08b2e2fb9baa0c903793f55df9a842f4a1cf0a51ecc514b552499956c28c207a66d0d7de75acf
- TLSH T1915173500366D5DEEB60B7FC10E26F67727ABABA89875E834464EDFB1D0230CE10182C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b442a.TMP
- Size 2KB
- SHA256 a96b4a4ca12a93309cc6009fa6f0769892dbe3bee9d5f884018dc0f84a4f4720
- MD5 3b927f11a20c70441ac887d498bd69a2
- SHA1 786d57cd40013223fec25f0633cd526ffddf32de
- SHA512 324f86fe69b18daea3d66b0a96fdc703c9f0c56f4c9d3d5143b4c0d7f52960f813706f348818fae9a56ac3659bba06c797098bbf6f74206202697f96a59b8601
- TLSH T1D25162500726D5DEDB547BFC24E26F67767ABABA4A879ED34050EDBB5D0230CE20142C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 8df3b7453422f08836f172434161e1ae15682b1ef3866073ccbddc30ce07eb5a
- MD5 2869a5492f00983ecf447899d01571d3
- SHA1 b714fdd54d44c0ea7feff43c75fce6f04ce88cd2
- SHA512 e8037da69207763b6d4f953338b89953ab6410ad4119fc4f3735d9db2aec673e639daccb993e5a74888a22483b3ae9e60063426ed479e9ffdd7af357e4ba2653
- SSDEEP 96:DXBOwNz2WVa8JzmayQgw2aZficHpfCKOixSk4wQ:DX0wNzrVa8JiayQgwFFicHVCKOMSk4T
- TLSH T198A169F3C7F8966DCD2191F0BB15AE1ECE190914432C386A89E4EF1797E2461E142A8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 53c9cd3f7f4656d48d0a3baa4f34dc1f3e927afb9503774845b9d69238f90c18
- MD5 0196060030be8a9091790beb0f713dda
- SHA1 d47a0b55fb6a7a97d9c53b58269bda6189258bcb
- SHA512 4c1b70280d0fbd26859dbfee40da19b79490ccdbb0ccbe7f1dff7dd1f9049a4a2435aad7ebda9c483f32d3906136ab757249988fd025071ee7750a71aa0f5ddf
- SSDEEP 192:sxRMR+CZ/f4sT1sJWZH4l2zoA8pvQ/g6+WNOau/zScUIOZ7NXasVGKIgD6yCMJ:sxRMzZ/f4sT1ggH4lr4/5G/Urh
- TLSH T139428656A964993B9CCAD21DFA55BF53E6F9103290D01F48EBFC8A1C04E76DD220780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 e8e4b43946d8cec5e3cfe1747aa07d419e3d12254409dad85ee8b4c6a34ed31d
- MD5 01347ee6d61ddbc10b203099aac07757
- SHA1 7bdf9c27aade287ed06dd6b832db95f05c291215
- SHA512 a81e599962ad9124fe177ef227ddb2053e8ab941c9bcbc1b03bbc1fb5110838607376e18e89686c585ba3f0f98de2b22b98526686d041cf4f1fa97ad6def077d
- SSDEEP 192:sxRPR+CZ/f4sD1sg/S2zoA8pvQ/g6+WNOau/zSNLZ7NqvsVGKIgVbJ:sxRPzZ/f4sD1x6r4/5G/+rb
- TLSH T18F42A856A968A93B9CC7D21DFA65BF53D3F91032A1D01F58EAFC861C04E76DD220780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 818a7907df5f31a2f63d00fee44d0cc46575f5e13515b0980ea7257e648bc0c7
- MD5 ec5903407fa36b5384f05e18eb0fcf17
- SHA1 23b335ea9ee9464ec43de4b10bceb92e3f18f14b
- SHA512 b7ee66029e4a1bce89f793ccc138c7813ed20db5c3a0c13e19a6485cd0c36690a5b898f5cff290292f6c94bdc7b57afbe7ccc7254d09b73108cfc080b947f64c
- SSDEEP 192:sxRMR+CZ/f4sT1sgWZH4l2zoA8pvQ/g6+WNOau/zSNLZ7NqOsVGKIgDYyCMJ:sxRMzZ/f4sT1xgH4lr4/5G/frX
- TLSH T158429556A964A93B9CCBD21DFA55BF53D7F91032A0D01F48EAFC8A1C04E76DD220780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 27KB
- SHA256 25f9caa0181c359f5964a93987a6e5c03787f385c6ec0ef9001a7b869f416aaf
- MD5 37704f6c616918ed00d220db27cdc8b2
- SHA1 bcb0adabe571609939e50fa36d52b6655c6072d9
- SHA512 9a425446fb5516f33b4d137442273f0366df48026f967e73d01b1563221986ec56d2e8aa490f4c1ad7e840b5de639d5d2c30180d1639a61f60b04eefa04bb7a6
- SSDEEP 768:ky2SLS7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUSV4Jrob+d:ky2SLqE7evWgd5f/bu1jaLU4iKd
- TLSH T125C2CA7B640CCB7F4F804ADDA8197F9A6D6802CB9698CD8047FA951C03C7BEE51264DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b6a6e.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 34KB
- SHA256 4215f3be472eb00baf71480c89bbb363092d7c93a39ff1d734fe9fb61459193c
- MD5 099dde8e51f5ad8639e8c28cad87634c
- SHA1 4861e80950483eed7b2c4d2a01a1d688e79647a0
- SHA512 3a4fe55093285f8a4aeedb9713c32e88e0cd1c34b83e5b5981a433492e109fb3d8409171bf6e2f12dc0006e640087d9db908b1ce04c2fa0b7f5c9226ccc90948
- SSDEEP 768:TF3F3QwggIUVcL8cL9Aam6aQMGdjWca4Ghf9b98:ZF3tCmaME6pb6
- TLSH T112F26B32D8A4DA77ACE79785F75A7687EEF011B388C88EC4D9D85E0D019319E170BC1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 30KB
- SHA256 feedb9e9ee906b4e04ac0fc9120b4e4a6fe9b92e7754390a3d47a561d7af7cca
- MD5 c74be658bc8410d21f0060c9b8469caf
- SHA1 4625c1bc0688df2b12c3bf3ddd4b4eedfad7735f
- SHA512 401b15a6bf72cf5ec11270a26e85c36613e2916973d1729e7c9fcb5d5a07f931fe6356e1ab23fa917637ef33676ef302689c6945b11408345afb9ef5a233b0c4
- SSDEEP 768:2L3LIcqzcL8cLf+Aam6aQMGdjWca4Ghf9b98:2L3LfQmaME6pb6
- TLSH T1CAE2AF7168A8DD339CA7A295F75B6783FEF4217388C84E84D5E85B1D029314E270BC1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 34KB
- SHA256 a85658b3ec5061aed6a36fe41d1da0c9373dd69b3cc114557ed4c38bc1a38fc3
- MD5 be92ab98787f53d8940953c9b0ef4c71
- SHA1 e268b81c44a934bf402fb03a46598b32a599c94b
- SHA512 3d717ccdc41a50949e6fca245854b8584d07eed151456e86bee0d4283c5118f5ee2059ca1ab80b48ba51de9acf4decbae931ac804f98d2c8f2ca5266111022ad
- SSDEEP 768:/rv+4UNbdq3bdqzcL6AAam6aQMGdjWca4GhfBaPeU/:/bsbc3SKmaME6pyH
- TLSH T16AF2AE31A8689573DDB79A99F21B6787BFF021A384D40E84C9D91B0D43970CE230BD27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 30KB
- SHA256 0ede598ce818f840b732315a306ffd9be5efb1009aeed4aad1a627a2273fd538
- MD5 edb3f28dc92489243e5af7a8eed076be
- SHA1 8e50653646fec5ebdb88c86d395b4d920ad31c0b
- SHA512 e53163c0b928866e33d36c43129717b06e32aee1f3678119eca69e6775e4e3c1787cd88f4b5650e60c8da10d4f8ebb649880bf8a0086cf52dfc827015b1ed0a2
- SSDEEP 768:1L3uIcqzcL8cLf+Aam6aQMGdjWca4Ghf9b98:1L3ufQmaME6pb6
- TLSH T1B9E29F3168A8DD739CA7A295F65B6783FEF4217388C84E84D5E85B1D029319E270BC1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 36KB
- SHA256 4161afcd568520acccb61b78249ba5d93abf53d0ed783c1985e92a38e45d63b3
- MD5 22801e45b2736ea58271e9b0ec00166d
- SHA1 e0dae8268db4d5cba7a8a0ad92bfbe243b693088
- SHA512 d71ce7dcea242507b284b3cd3cfea5d1e67fabc00f4f1081444e1d0b88d68b3fcfabebd6d25b2aacccc41737e2e92b21c49e176f7b91ca8f5d24f2327659ec2c
- SSDEEP 768:brv+4UNbdj3CAcqzcL8cLfFAam6aQMGdjWca4Ghf9b5n:bbsb53Cn/maME6pbJ
- TLSH T17003AF31A8ACD9339CB79199F25B6783BFB421B388C40E84D9D95B0D429719E370BD1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 c28e1be96997e212c5bb14a289b7f2f9804fcf87f81d161aceb7d60cefe41efc
- MD5 6a0f7369fff1411962fe15f4fa377650
- SHA1 a2eaf917b80c493193f08cbfc4e31d1f6ab175f7
- SHA512 faeb108699d227cf840c780535ba0e8f8ad31cdb025e55ef83985a6480464aa9ffea1abc5a489f46841ebb2be8dd971f1da08e1e82c0758dd390e341d5895d89
- SSDEEP 768:Arv+4UNbdq3OGqzcL8cLf0Aam6aQMGdjWca4GhfwbPeU/:Absbc3HWmaME6p0H
- TLSH T10BF2AF31A86CD9339CB79295F25B6787BEB421B388C40E84D9D96B0D429718E370FD1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 252B
- SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
- MD5 880fe67d2d8def8a73d1f09d09f8f2ff
- SHA1 adad7fdd0652919461f89bfe36b449081489052b
- SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
- TLSH T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 132B
- SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
- MD5 f5a3b29f9a977e23d6ca4eb728238f9f
- SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
- SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
- TLSH T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
- Size 154KB
- SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
- MD5 a922bd2071b7aa9f2154c991d41885c7
- SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
- SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
- SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
- TLSH T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
- Size 132B
- SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
- MD5 22215f69c4a5231b8c568620e783d7fe
- SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
- SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
- TLSH T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSIB433.tmp
- Size 1.1MB
- SHA256 dd078e23bad267be41b48083569f47b7f4f73ca5820e99a4432181f4ef709325
- MD5 dafeb8f4d3d25febf3e5642488dc2a94
- SHA1 ddee4006bb2c0f83d19bae6e0d5d9601a772ddc1
- SHA512 ee81963a287d8e99ecd1693d544b060dbdc455eb508bff922a5bf9258780ca7adb3c982ae403331ed6c278e284415dce4919c26096e6a141f3bcd3e252fc43d1
- SSDEEP 24576:1IC2NvTON2xBHyXtCZGeAtiEK7XIS82CiZDr5:1ItVfJ4NPK7XI4p
- TLSH T1DA451251B6E48432E7FF1E3079A496E149BBBE642F70DA4E57044C6D8AB4780C632B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB433.tmp-\AblebitsInstallUtils.dll
- Size 2.8MB
- SHA256 c8e3f025eddd874ea5577e6602d8db0eeffd224b4c089874324165dfcd4f580d
- MD5 6de863a7c6fbb2a8989ed2719fc981ba
- SHA1 4ce5e5da5b4d8ac971223feeaa26733cbf1a16ae
- SHA512 94d4ba28ea4bc9eaebb2eb105e36a9e49794b86d0141f900deca7447df70c43af73b940af3475ff89a49aab4fc44e1cee1ec5df417646f253870ead59f75800d
- SSDEEP 49152:YPFAeMMMMMQFol2q2I/MMMMMSx/tCCbfU:YJMMMMMQKEI/MMMMMWbbf
- TLSH T103D5B225EAD1B22EC3EA0130CC9B947051ABAF425EC0867B76D4F32FC9702B575F1666
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB433.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 182KB
- SHA256 ced6cab3c04c08ce5705af0b6986965dbdbfda17cbd66c973bb371ed3b95f37a
- MD5 82eb1ccf28f3af897c2db27282b41156
- SHA1 9f945d8b18ff0fbb5f013efe5e2ff33aef136104
- SHA512 9458fabeae4dabf8109b9736496a01d9168312faec1c17d6eed89e8f09cbb8287d74ff758948cf07838720c11005e87a734e920be4ead275354f46a0a6176f84
- SSDEEP 3072:eGfZS7hUuK3PcbFeRRLxyR69UgoCaf8IkCnfKlRUjW01KyAFPMQx:YzMRLkR6joxfrVjS
- TLSH T1C5047D2953FC473ECAEF4778E261425197B1F2E67113DB0EAC8181BA2162780F792397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB80C.tmp-\CustomAction.config
- Size 1KB
- SHA256 33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f
- MD5 01c01d040563a55e0fd31cc8daa5f155
- SHA1 3c1c229703198f9772d7721357f1b90281917842
- SHA512 9c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5
- TLSH T11031568E0B05B77711312753AEED90C5DB7561A73C95811834DE99293F36978137338E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp38B5.tmp
- Size 2KB
- SHA256 ebe8a6b5b95232f0c34a5844bf2e41af3689525e4711ecea2bde0bbff31233a1
- MD5 a6f58c456742efc3cbf81c3a9bebf155
- SHA1 224979c39e819cc0e67731d8045c3e2c17da1f85
- SHA512 d98107939046f5bcbd0ff98e21333f2d86baac9d5abafc0328ce9977276aabddf29a83bfc04684eef80735bf2563855f26460bab327395339907c885afa59a81
- TLSH T1DB510A5B0D9125461F8FF2BCDD3A986A81D3364609D2707D66883234CB4846B7179CDD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp3905.tmp
- Size 1KB
- SHA256 8c3c63c8d96d55a61c0d816cd7547baa1b1f7b3045d14c4d7da5943eae16f85f
- MD5 b7bb7ce474cd6cfe2451e7f14d3a9745
- SHA1 103d3fb8f06cbe4ebed3c9c65de0eabc9cf8f5c5
- SHA512 44e6c193ce08964fa7429b967d2cf9e3b739dee37d6f396ced5cda443dd6f660afd297b95bfe72f9492f5aaeda04552479d476f28db4260de288cdab980e202c
- TLSH T1B43186F64F10686E21DEE960584E1829545DEA8E43D0B3AC66C19472C7E2D3405FB4CA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\excel-ultimate-suite.msi
- Size 31.6MB
- SHA256 afd088d64172c6196c8f18a3f46865226bf9531fb4d19b0c2bb0b3dd4ba97c52
- MD5 ef7a74093ee45c80f42b7aa6b767de4b
- SHA1 990e7cb9d3a34ced144b3712faf7cdc9c92815fe
- SHA512 3446833fdedae22e59d589016cc6837d7c85734a04c6666c02740a2d9ad6e3a2b095decec6022bec33b3a7237e4b8c0042cdcf57e094503987f0b908a1980a2c
- SSDEEP 786432:as+zD0s1WbpUjqavtR4yZdJVlocWVG9ktfbWEn+E/4QIP:aND0YWbpUjv12yfTlo0KtfkEA9
- TLSH T1DF77331876C1B131D1A70534D9A9F2B0493BBE145AD2900277C8F99EAF35BB0A3F4B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\f29e3271-51c3-4ac8-a97d-fea40224d7ed.tmp
- Size 1B
- SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
- MD5 5058f1af8388633f609cadb75a75dc9d
- SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
- SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6004_74095915\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
- Size 2KB
- SHA256 d6279844f94ae2c318fefd5d1b5d155cdb91ca2f8eac5e5c0e54a2506e9b061e
- MD5 3943ed316a74f3dd3dc781d83e21599d
- SHA1 adcf3479f9bc13d4934ca8e1b84813e091074323
- SHA512 4679d7aecc28e428fb52d7d468ae03216aaf7aa5152e75bf406b4acc23694b7a181ea04f5ef4bc5ca8157546c4a29cfd872cbe49ad4b0d88cd3d675d629bda6d
- TLSH T1995101110B874B57D4B046762A2BA36AD330BE53EB18D71DF1C5210F7E70500CA3AABE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI30F5.tmp
- Size 233KB
- SHA256 b29b65905905f7d9279737fad9ee4dbfb9375109ec03c0db2d96e11b031e9a70
- MD5 69ce0f47a489fc5ed1980b43bf0eb0e6
- SHA1 3f6d8ceece019812d43a0de767fc7bd72f2ce241
- SHA512 ade5af5a8ca4716eb651d7de0f9bfd9c2f155884a022312fa808439f56b55ac5375dda3b4cd2dcf9af105d99cdc991e74250246f7c600a13b80507859bf43bb7
- SSDEEP 3072:kTpq20EOtzMa+aLWZMxC9bvpWiMBplSS1flQn1eubG7g2sNrL/ZMfv/PP:kz0/tKmUbvptklfNFsZwv
- TLSH T1FA348D217494507EE7FF0832953AE671AE3DF2281B90C96EC3945C1E6D608C16BB7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI37ED.tmp
- Size 477KB
- SHA256 99bc7dd6e39d09e26e1fb92f192268aaa2f6c383a00e58c15a3277d50a56486f
- MD5 be77ed4e5fcb9f6392243300f89ee0c0
- SHA1 52303b17657c1c87099fb0f985d806be1122fcba
- SHA512 90167f5406b68415beccee657eb90981336228b6a4142877b6afda2ded8477558f233a4ee617a7fe51cf2ae2be2c0d87a28798c6be5dc60def2708d6373c1c0b
- SSDEEP 768:t4Vj3bf8WiU6qbOkYG4ESWs6qlT8T94AFzhspXw+sIkpGe3O8L9z82ADhE2m5ALs:t4Z78qtkT8P9Eg+sdpPeUz8tdF5I
- TLSH T1D3A47E82B644B945D8E60930D452D6F4813F7D09EAE189873BC8768FFA32EB084FE55D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI3936.tmp
- Size 169KB
- SHA256 6656661b68843d5fbba907b4ad39d7337b21059de03068429bd450c9eef8f0d5
- MD5 51e0ef3d015c3e47fc34b1cf8b30b8d2
- SHA1 51f0390bbfef7ffe1d931847853fa118f8deddca
- SHA512 13040d4f5de50529364868ec759195c593b1d0001b6591cbb9c9a9366b3b76e1891132bfdd98620fa3b7b9abf4a4e8174d3cb18d85ee2f596092ed77b3ebe740
- SSDEEP 3072:yJDLZbxrtY4slAkxiHkiDRUlxfJsni2ISJ:yJv5PY4slDxiHnURsi
- TLSH T1DE046C507BD6C072E2A3193255F597626A79BB325B32D0CB775C0AA85F307D0AA3D313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6FF7.tmp-\Newtonsoft.Json.dll
- Size 522KB
- SHA256 9c9dd756162300902b29e07bd7e95c1fca6705fc9c728023911d99cb2e2b0216
- MD5 49037a121593acfd95e7de31fc8c9a4d
- SHA1 6e0c789b5a6bc80e97af9506909f0a5766d9c4ee
- SHA512 0b950baf70784c1b98a1a4e25f44d88fc3a9d38d8661f7b641b3242223fdb8ac1cc69c676f4d035057ed1f9f9a06c272cdfde4b5727a936950c6668e381aff11
- SSDEEP 6144:ihMoo1Nw3XRpmdxcgVAbGaq/0D0yDZn2M3MCHA1ui8YjFFezlLSJThvLpCpGQ/DM:dAXa6pHA1CVpstLpCpGQ/DqrBodAb
- TLSH T1A4B44B2223FC8B2AD5EF1B35E4B0092547FEF416A279DB8F590499AE6C937814D90373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\ablebits\ultimate suite for microsoft excel\1dd3a559c6c92dd\ablebitsultimatesuite.dll
- Size 26.7MB
- SHA256 15c40d34f08301f917d87fd894ad5d632afdaa2faf0a00f379a1f6dcb42420fb
- MD5 5fe8f5bb2e1c8a98e4c8381e4d87c2b6
- SHA1 5d3a223841a95595f58269272250c4684b575315
- SHA512 9526d6005f2f7b0c145d005cfd4f05581a993cdae76b64e8e675f184b4d8d02ed48c7c6fbcfb6d12d1d86db9b97a7b551f356ee0aa973b2cf6cac59ed3246590
- SSDEEP 196608:CgwykzGWOnGQBNGbsCd8W8xe+gP/aMveD3cNRlM39A28o4rBtcGvLfDnfan3O05V:NAfa9L+Q6
- TLSH T1E2576312B196B169CD972476CC5F8664326EBDC1CDB049FEA2A0FF3E4A7132051E1B87
- MD5 SHA1 SHA512 SSDEEP TLSH