Should I block it?

No, this file is 100% safe to run.

Additional versions

15.0.4551.1007	2.23%
15.0.4551.1001	0.45%
15.0.4535.1507	17.41%
15.0.4535.1507	0.45%
15.0.4535.1001	4.02%
15.0.4517.1504	0.45%
15.0.4517.1004	0.45%
15.0.4505.1510	7.59%
15.0.4505.1005	2.23%
15.0.4505.1005	0.45%
15.0.4481.1508	11.16%
15.0.4481.1005	16.52%
15.0.4454.1513	0.45%
15.0.4454.1504	5.80%
15.0.4454.1504	0.45%
15.0.4454.1002	0.45%
15.0.4128.1025	0.45%
15.0.4128.1025	28.57%
15.0.4128.1019	0.45%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegCloseKey, RegCreateKeyExW, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegOpenKeyExW, RegQueryValueExW, LookupAccountNameW, RegSetValueExW, ConvertSidToStringSidW, OpenProcessToken, GetTokenInformation, CredWriteW, RegQueryValueExA, RegOpenKeyExA, SetServiceStatus, RegisterServiceCtrlHandlerExW, StartServiceCtrlDispatcherW, ReportEventW, RegisterEventSourceW, DeregisterEventSource, EventWrite, OpenThreadToken, ConvertStringSidToSidW, IsValidSid, GetSidSubAuthorityCount, GetSidSubAuthority, FreeSid, EqualSid, CreateWellKnownSid, SetServiceObjectSecurity, QueryServiceStatusEx, OpenServiceW, OpenSCManagerW, DeleteService, CreateServiceW, ControlService, CloseServiceHandle, ChangeServiceConfig2W, RegQueryInfoKeyW, RegNotifyChangeKeyValue, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, CreateProcessAsUserW, RegQueryValueW, RegGetValueW, RegSetKeySecurity, EnumDependentServicesW, AllocateAndInitializeSid, LookupPrivilegeValueW, AdjustTokenPrivileges

c2rui.dll

ShowStreamingCompleteToast, DestroyProgressAgent, ShowProtoHandlerInstalledUI, ShowFeatureBlockStreamingUI, ShowUpdatesInProgressProgressAgent, ShowUpdatesReadyToApplyDialog, ShowErrorBagUI, DestroyErrorBagUI, ShowRetryUI, ShowProgressUI, DestroyProgressUI, ShowProgressAgent, ShowUninstallDialog, ShowDisconnectedToast, ShowPackageLockedDialog, ShowUpdatesCompleteProgressAgent, ShowRepairDialog, CloseC2RUI, ShowDuringProcessShutDownDialog, ShowLessAggressiveProcessKillerDialog, ShowProcessKillerFailureDialog, ShowProcessKillerDialog, GetString, ShowErrorDialog, ShowRepairTypePickerDialog, ShowPartialRepairDialog, ShowProgressAgentDialog, ShowProgressAgentInstallationBlocked, ShowUpdatesAreLateProgressAgent, ShowAppNoHangUI, ConfirmOnlineRepairDialog

gdi32.dll

AddFontResourceW, SelectObject, EnumFontFamiliesExW, GetFontData, CreateFontIndirectW, DeleteObject

iphlpapi.dll

FreeMibTable, CreateSortedAddressPairs

kernel32.dll

GetFileType, CreateFileW, GetExitCodeThread, GetCurrentThreadId, WTSGetActiveConsoleSessionId, ProcessIdToSessionId, GetCurrentThread, OpenMutexW, GetSystemDefaultLCID, WaitForMultipleObjects, GetTimeZoneInformation, SystemTimeToTzSpecificLocalTime, LoadLibraryExW, FreeLibrary, GetNativeSystemInfo, GetVersionExW, GetSystemTimeAsFileTime, SetErrorMode, GetDiskFreeSpaceExW, CopyFileW, GetFileTime, CompareFileTime, LoadLibraryW, LoadLibraryA, GetModuleHandleA, GetVersion, OutputDebugStringA, GetFileAttributesW, LocalFree, GetTempPathW, SetFilePointerEx, ReadFile, GetFileSizeEx, K32GetModuleFileNameExW, K32EnumProcessModules, K32EnumProcesses, GetProcAddress, GetModuleHandleW, GetProcessId, GetPriorityClass, CreateProcessW, GetExitCodeProcess, GetLastError, InitializeCriticalSectionEx, DeleteCriticalSection, GetCurrentProcess, GetTempPathA, DeleteFileA, CompareStringEx, CreateDirectoryW, GetFileAttributesExW, SetLastError, WideCharToMultiByte, GetSystemDirectoryW, GetTempFileNameW, MoveFileExW, lstrcmpW, FindNextFileW, FindFirstFileW, WaitForSingleObjectEx, MultiByteToWideChar, FindClose, RaiseException, ExpandEnvironmentStringsA, LoadLibraryExA, FindResourceW, SizeofResource, LockResource, LoadResource, LocaleNameToLCID, CreateThread, OpenEventW, ResetEvent, IsProcessorFeaturePresent, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, DecodePointer, EncodePointer, GetStartupInfoW, InterlockedCompareExchange, InterlockedExchange, HeapFree, HeapAlloc, WerRegisterMemoryBlock, VirtualProtect, HeapSetInformation, GetProcessHeap, QueryPerformanceCounter, FormatMessageW, LeaveCriticalSection, EnterCriticalSection, WriteFile, LocalAlloc, IsWow64Process, RemoveDirectoryW, FindFirstFileExW, ExpandEnvironmentStringsW, GetWindowsDirectoryW, CloseHandle, SetEvent, WaitForSingleObject, CreateEventExW, ReleaseMutex, CreateMutexW, GetTickCount64, GlobalFree, OpenProcess, ExitProcess, TerminateProcess, SystemTimeToFileTime, GetSystemTime, Sleep, SetFileAttributesW, DeleteFileW, SetCurrentDirectoryW, GetModuleFileNameW, GetTickCount, OpenThread, GetCurrentProcessId, K32EnumProcessModulesEx, lstrlenW, CreateSemaphoreW, ReleaseSemaphore, SetEndOfFile, HeapReAlloc, GetFileSize, GetTimeFormatW, GetDateFormatW, FileTimeToSystemTime, lstrcmpiW, GetShortPathNameW, GetSystemPowerStatus, GetUserGeoID

msvcp100.dll

DllMain

msvcr100.dll

DllMain

ole32.dll

CoInitializeEx, StringFromGUID2, CoTaskMemFree, CoCreateInstance, StringFromIID, IIDFromString, CLSIDFromString, CoUninitialize, CoCreateGuid, ProgIDFromCLSID, CLSIDFromProgID

rpcrt4.dll

RpcStringBindingComposeW, RpcBindingFromStringBindingW, RpcBindingFree, NdrServerCall2, RpcServerListen, RpcServerRegisterIf2, RpcServerUnregisterIf, RpcServerUseProtseqEpW, RpcMgmtStopServerListening, RpcMgmtWaitServerListen, RpcImpersonateClient, RpcStringFreeW, RpcBindingInqAuthClientW, RpcRevertToSelf, NdrClientCall2, RpcMgmtIsServerListening, RpcBindingSetAuthInfoW, RpcServerRegisterAuthInfoW

rstrtmgr.dll

RmEndSession, RmRegisterResources, RmGetList, RmShutdown, RmRestart, RmStartSession, RmAddFilter

setupapi.dll

SetupIterateCabinetW

version.dll

VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW

wer.dll

WerReportSetParameter, WerReportAddFile, WerReportSubmit, WerReportCloseHandle, WerReportCreate

wevtapi.dll

EvtExportLog

wintrust.dll

WinVerifyTrust

ws2_32.dll

FreeAddrInfoW, GetAddrInfoW

wtsapi32.dll

WTSFreeMemory, WTSSendMessageW, WTSEnumerateSessionsW

IntegratedOffice.exe

Microsoft Office 15 by Microsoft Corporation (Signed)

Remove IntegratedOffice.exe

Version:	15.0.4128.1019
MD5:	d99d7854f2d03463c82b2bb2d8c43abc
SHA1:	bdc3e42c1910954ad03cdca8dc8052d2edf34f66
SHA256:	fd21009fcafd3ec8e52a7a9c0a39f0ef62c02765d9443705218c1f077ff3d970

What is IntegratedOffice.exe?

Microsoft Office Click-to-Run for Microsoft Office is an office suite of desktop applications, servers and services for the Microsoft Windows. A major feature of the Office suite is the ability for users and third party companies to write add-ins (plug-ins) that extend the capabilities of an application by adding custom commands and specialized features.

Overview

integratedoffice.exe runs as a service under the name Microsoft Office-Dienst (OfficeSvc) with extensive SYSTEM privileges (full administrator access). It is an auto-starting process that used the Windows Task Scheduler service to load when the user logs into Windows (sometimes this is required to bypass the UAC protection). The file is digitally signed by Microsoft Corporation.

Details

File name:	integratedoffice.exe
Publisher:	Microsoft Corporation
Product name:	Microsoft Office 15
Description:	Microsoft Office Click-to-Run
Typical file path:	C:\Program Files\microsoft office 15\clientx86\integratedoffice.exe
File version:	15.0.4128.1019
Size:	1.42 MB (1,492,080 bytes)
Certificate
Issued to:	Microsoft Corporation
Authority (CA):	Microsoft Corporation
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
Code language:	Microsoft Visual C++ 10.0
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'OfficeSvc' (Microsoft Office-Dienst)
OfficeSvc

Scheduled tasks

The task 'Office First Run Task' runs on logon in the path '\Microsoft\Office\Office First Run Task'
The job 'Office Automatic Updates' runs weekly in the path '\Microsoft\Office\Office Automatic Updates'
Entry path '\Microsoft\Office\Office First Run Task'
Entry path '\Microsoft\Office\Office Automatic Updates'

Scheduled tasks startups

Set to load on user login (bypasses Windows UAC if enabled)

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00020341%	0.028634%
Kernel CPU:	0.00006884%	0.013761%
User CPU:	0.00013457%	0.014873%
Kernel CPU time:	1,310 ms/min	100,923,805ms/min
Memory
Private memory:	24.47 MB	21.59 MB
Private (maximum):	24.12 MB
Private (minimum):	12.05 MB
Non-paged memory:	24.47 MB	21.59 MB
Virtual memory:	186.74 MB	140.96 MB
Virtual memory (peak):	188.4 MB	169.69 MB
Working set:	13.23 MB	18.61 MB
Working set (peak):	38.51 MB	37.95 MB
Page faults:	13,523/min	2,039/min
Resource allocations
Threads:	82	12
Handles:	462	600

Process properties

Integrety level:	Undefined
Platform:	64-bit
Command line:	"C:\Program Files\microsoft office 15\clientx64\integratedoffice.exe"
Owner:	SYSTEM
Windows Service
Service name:	OfficeSvc
Display name:	Microsoft Office-Dienst
Description:	“Verwaltet die Ressourcenkoordination, das Hintergrundstreaming und die Systemintegration von Microsoft Office-Produkten mit den dazugehörigen Updates. Dieser Dienst muss während der Verwendung der Microsoft Office-Programme sowie während der Erstinstallation des Streamings und während aller späteren Aktualisierungen ausgeführt werden.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads