menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used "certutil -decode" to decode files on the victim’s machine when dropping UPPERCUT.