Should I block it?

No, this file is 100% safe to run.

Additional versions

15.0.4551.1007	2.23%
15.0.4551.1001	0.45%
15.0.4535.1507	17.41%
15.0.4535.1507	0.45%
15.0.4535.1001	4.02%
15.0.4517.1504	0.45%
15.0.4517.1004	0.45%
15.0.4505.1510	7.59%
15.0.4505.1005	2.23%
15.0.4505.1005	0.45%
15.0.4481.1508	11.16%
15.0.4481.1005	16.52%
15.0.4454.1513	0.45%
15.0.4454.1504	5.80%
15.0.4454.1504	0.45%
15.0.4454.1002	0.45%
15.0.4128.1025	0.45%
15.0.4128.1025	28.57%
15.0.4128.1019	0.45%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegCloseKey, RegCreateKeyExW, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegOpenKeyExW, RegQueryValueExW, LookupAccountNameW, RegSetValueExW, ConvertSidToStringSidW, OpenProcessToken, GetTokenInformation, CredWriteW, RegQueryValueExA, RegOpenKeyExA, SetServiceStatus, RegisterServiceCtrlHandlerExW, StartServiceCtrlDispatcherW, ReportEventW, RegisterEventSourceW, DeregisterEventSource, EventWrite, OpenThreadToken, ConvertStringSidToSidW, IsValidSid, GetSidSubAuthorityCount, GetSidSubAuthority, FreeSid, EqualSid, CreateWellKnownSid, SetServiceObjectSecurity, QueryServiceStatusEx, OpenServiceW, OpenSCManagerW, DeleteService, CreateServiceW, ControlService, CloseServiceHandle, ChangeServiceConfig2W, RegQueryInfoKeyW, RegNotifyChangeKeyValue, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, CreateProcessAsUserW, RegQueryValueW, RegGetValueW, RegSetKeySecurity, EnumDependentServicesW, AllocateAndInitializeSid, LookupPrivilegeValueW, AdjustTokenPrivileges

c2rui.dll

ShowStreamingCompleteToast, DestroyProgressAgent, ShowProtoHandlerInstalledUI, ShowFeatureBlockStreamingUI, ShowUpdatesInProgressProgressAgent, ShowUpdatesReadyToApplyDialog, ShowErrorBagUI, DestroyErrorBagUI, ShowRetryUI, ShowProgressUI, DestroyProgressUI, ShowProgressAgent, ShowUninstallDialog, ShowDisconnectedToast, ShowPackageLockedDialog, ShowUpdatesCompleteProgressAgent, ShowRepairDialog, CloseC2RUI, ShowDuringProcessShutDownDialog, ShowLessAggressiveProcessKillerDialog, ShowProcessKillerFailureDialog, ShowProcessKillerDialog, GetString, ShowErrorDialog, ShowRepairTypePickerDialog, ShowPartialRepairDialog, ShowProgressAgentDialog, ShowProgressAgentInstallationBlocked, ShowUpdatesAreLateProgressAgent, ShowAppNoHangUI, ConfirmOnlineRepairDialog

gdi32.dll

AddFontResourceW, SelectObject, EnumFontFamiliesExW, GetFontData, CreateFontIndirectW, DeleteObject

iphlpapi.dll

FreeMibTable, CreateSortedAddressPairs

kernel32.dll

GetFileType, CreateFileW, GetExitCodeThread, GetCurrentThreadId, WTSGetActiveConsoleSessionId, ProcessIdToSessionId, GetCurrentThread, OpenMutexW, GetSystemDefaultLCID, WaitForMultipleObjects, GetTimeZoneInformation, SystemTimeToTzSpecificLocalTime, LoadLibraryExW, FreeLibrary, GetNativeSystemInfo, GetVersionExW, GetSystemTimeAsFileTime, SetErrorMode, GetDiskFreeSpaceExW, CopyFileW, GetFileTime, CompareFileTime, LoadLibraryW, LoadLibraryA, GetModuleHandleA, GetVersion, OutputDebugStringA, GetFileAttributesW, LocalFree, GetTempPathW, SetFilePointerEx, ReadFile, GetFileSizeEx, K32GetModuleFileNameExW, K32EnumProcessModules, K32EnumProcesses, GetProcAddress, GetModuleHandleW, GetProcessId, GetPriorityClass, CreateProcessW, GetExitCodeProcess, GetLastError, InitializeCriticalSectionEx, DeleteCriticalSection, GetCurrentProcess, GetTempPathA, DeleteFileA, CompareStringEx, CreateDirectoryW, GetFileAttributesExW, SetLastError, WideCharToMultiByte, GetSystemDirectoryW, GetTempFileNameW, MoveFileExW, lstrcmpW, FindNextFileW, FindFirstFileW, WaitForSingleObjectEx, MultiByteToWideChar, FindClose, RaiseException, ExpandEnvironmentStringsA, LoadLibraryExA, FindResourceW, SizeofResource, LockResource, LoadResource, LocaleNameToLCID, CreateThread, OpenEventW, ResetEvent, IsProcessorFeaturePresent, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, DecodePointer, EncodePointer, GetStartupInfoW, InterlockedCompareExchange, InterlockedExchange, HeapFree, HeapAlloc, WerRegisterMemoryBlock, VirtualProtect, HeapSetInformation, GetProcessHeap, QueryPerformanceCounter, FormatMessageW, LeaveCriticalSection, EnterCriticalSection, WriteFile, LocalAlloc, IsWow64Process, RemoveDirectoryW, FindFirstFileExW, ExpandEnvironmentStringsW, GetWindowsDirectoryW, CloseHandle, SetEvent, WaitForSingleObject, CreateEventExW, ReleaseMutex, CreateMutexW, GetTickCount64, GlobalFree, OpenProcess, ExitProcess, TerminateProcess, SystemTimeToFileTime, GetSystemTime, Sleep, SetFileAttributesW, DeleteFileW, SetCurrentDirectoryW, GetModuleFileNameW, GetTickCount, OpenThread, GetCurrentProcessId, K32EnumProcessModulesEx, lstrlenW, CreateSemaphoreW, ReleaseSemaphore, SetEndOfFile, HeapReAlloc, GetFileSize, GetTimeFormatW, GetDateFormatW, FileTimeToSystemTime, lstrcmpiW, GetShortPathNameW, GetSystemPowerStatus, GetUserGeoID

msvcp100.dll

DllMain

msvcr100.dll

DllMain

ole32.dll

CoInitializeEx, StringFromGUID2, CoTaskMemFree, CoCreateInstance, StringFromIID, IIDFromString, CLSIDFromString, CoUninitialize, CoCreateGuid, ProgIDFromCLSID, CLSIDFromProgID

rpcrt4.dll

RpcStringBindingComposeW, RpcBindingFromStringBindingW, RpcBindingFree, NdrServerCall2, RpcServerListen, RpcServerRegisterIf2, RpcServerUnregisterIf, RpcServerUseProtseqEpW, RpcMgmtStopServerListening, RpcMgmtWaitServerListen, RpcImpersonateClient, RpcStringFreeW, RpcBindingInqAuthClientW, RpcRevertToSelf, NdrClientCall2, RpcMgmtIsServerListening, RpcBindingSetAuthInfoW, RpcServerRegisterAuthInfoW

rstrtmgr.dll

RmEndSession, RmRegisterResources, RmGetList, RmShutdown, RmRestart, RmStartSession, RmAddFilter

setupapi.dll

SetupIterateCabinetW

version.dll

VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW

wer.dll

WerReportSetParameter, WerReportAddFile, WerReportSubmit, WerReportCloseHandle, WerReportCreate

wevtapi.dll

EvtExportLog

wintrust.dll

WinVerifyTrust

ws2_32.dll

FreeAddrInfoW, GetAddrInfoW

wtsapi32.dll

WTSFreeMemory, WTSSendMessageW, WTSEnumerateSessionsW

IntegratedOffice.exe

Microsoft Office 15 by Microsoft Corporation (Signed)

Remove IntegratedOffice.exe

Version:	15.0.4517.1004
MD5:	ce8ad6748dba78a9d3cbb7094176d6c8
SHA1:	76c943719c39f12c87b5f2bc50471a4fbdcca53d
SHA256:	0cb0c337f3aa42100895c6c0a0dccc18df487d4ec9695e7510ec967af4fefddf

What is IntegratedOffice.exe?

Microsoft Office Click-to-Run for Microsoft Office is an office suite of desktop applications, servers and services for the Microsoft Windows. A major feature of the Office suite is the ability for users and third party companies to write add-ins (plug-ins) that extend the capabilities of an application by adding custom commands and specialized features.

Overview

integratedoffice.exe runs as a service under the name Microsoft Office-Dienst (OfficeSvc) with extensive SYSTEM privileges (full administrator access). It is an auto-starting process that used the Windows Task Scheduler service to load when the user logs into Windows (sometimes this is required to bypass the UAC protection). It is installed with a couple of know programs including Microsoft Office 365 Hogar Premium - es-es published by Microsoft Corporation and Microsoft Office 365 Home Premium - en-us published by Microsoft Corporation.

Details

File name:	integratedoffice.exe
Publisher:	Microsoft Corporation
Product name:	Microsoft Office 15
Description:	Microsoft Office Click-to-Run
Typical file path:	C:\Program Files\microsoft office 15\clientx86\integratedoffice.exe
File version:	15.0.4517.1004
Size:	1.81 MB (1,900,728 bytes)
Build date:	6/6/2013 11:14 PM
Certificate
Issued to:	Microsoft Corporation
Authority (CA):	Microsoft Corporation
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
Code language:	Microsoft Visual C++ 10.0
.NET CLR:	No

More details

Programs

The following programs will install this file

Microsoft Office 365 Hogar Premium - es-es

Microsoft Corporation

11% remove

A subscription to Microsoft Office 365 Home Premium lets you install a full copy of Office 2013 on up to five devices and also lets any Windows 7 or 8 machine temporarily download Word, Excel, or the other Office apps for use on other PCs.

Microsoft Office 365 Home Premium - en-us

Microsoft Corporation

10% remove

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'OfficeSvc' (Microsoft Office-Dienst)
OfficeSvc

Scheduled tasks

The task 'Office First Run Task' runs on logon in the path '\Microsoft\Office\Office First Run Task'
The job 'Office Automatic Updates' runs weekly in the path '\Microsoft\Office\Office Automatic Updates'
Entry path '\Microsoft\Office\Office First Run Task'
Entry path '\Microsoft\Office\Office Automatic Updates'

Scheduled tasks startups

Set to load on user login (bypasses Windows UAC if enabled)

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00018071%	0.028634%
Kernel CPU:	0.00005558%	0.013761%
User CPU:	0.00012513%	0.014873%
Kernel CPU time:	203 ms/min	100,923,805ms/min
CPU cycles:	162,422/sec	17,470,203/sec
Context switches:	3/sec	284/sec
Memory
Private memory:	25.93 MB	21.59 MB
Private (maximum):	42.38 MB
Private (minimum):	25.43 MB
Non-paged memory:	25.93 MB	21.59 MB
Virtual memory:	168.24 MB	140.96 MB
Virtual memory (peak):	170.49 MB	169.69 MB
Working set:	42.35 MB	18.61 MB
Working set (peak):	45.66 MB	37.95 MB
Page faults:	16,393/min	2,039/min
I/O
I/O read transfer:	2.95 KB/sec	1.02 MB/min
I/O read operations:	2/sec	343/min
I/O write transfer:	34 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	127 Bytes/sec	448.09 KB/min
I/O other operations:	3/sec	1,671/min
Resource allocations
Threads:	57	12
Handles:	531	600

Process properties

Integrety level:	System
Platform:	64-bit
Command line:	"C:\Program Files\microsoft office 15\clientx64\integratedoffice.exe"
Owner:	SYSTEM
Windows Service
Service name:	OfficeSvc
Display name:	Microsoft Office-Dienst
Description:	“Verwaltet die Ressourcenkoordination, das Hintergrundstreaming und die Systemintegration von Microsoft Office-Produkten mit den dazugehörigen Updates. Dieser Dienst muss während der Verwendung der Microsoft Office-Programme sowie während der Erstinstallation des Streamings und während aller späteren Aktualisierungen ausgeführt werden.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads