Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /t /im iManageStayExec.exe
- '<SYSTEM32>\taskkill.exe' /f /t /im iManageUpdateManager.exe
- '<SYSTEM32>\taskkill.exe' /f /t /im iwAgent.exe
- '<SYSTEM32>\taskkill.exe' /f /t /im iwAgentBackground.exe
- '<SYSTEM32>\taskkill.exe' /f /t /im iwWCS.exe
- '<SYSTEM32>\taskkill.exe' /f /t /im iwsingleton.exe
- '<SYSTEM32>\taskkill.exe' /f /t /im WorkSiteAgent.exe
Modifies file system
Creates the following files
- %TEMP%\imanage\_clean _and_install_imanage.exe
- %TEMP%\imanage\imanageinstaller.exe
- %TEMP%\ixp000.tmp\imanage_cleanup.msi
- %TEMP%\ixp000.tmp\imanagecleaninstaller.cmd
- %TEMP%\ixp000.tmp\products.txt
- nul
- %TEMP%\msi3f6.tmp
- %TEMP%\msi3f6.tmp-\cleanuputils.dll
- %TEMP%\msi3f6.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msi3f6.tmp-\customaction.config
Deletes the following files
- %TEMP%\msi3f6.tmp-\cleanuputils.dll
- %TEMP%\msi3f6.tmp-\customaction.config
- %TEMP%\msi3f6.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msi3f6.tmp
- %TEMP%\ixp000.tmp\products.txt
- %TEMP%\ixp000.tmp\imanagecleaninstaller.cmd
- %TEMP%\ixp000.tmp\imanage_cleanup.msi
Network activity
Connects to
- 'up####s.imanage.com':443
TCP
Other
- 'up####s.imanage.com':443
UDP
- DNS ASK up####s.imanage.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\imanage\_clean _and_install_imanage.exe'
- '%TEMP%\imanage\imanageinstaller.exe' /norestart
- '<SYSTEM32>\cmd.exe' /c %TEMP%\IXP000.TMP\iManageCleanInstaller.cmd' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c %TEMP%\IXP000.TMP\iManageCleanInstaller.cmd
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\Excel\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\Excel\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\Excel\AddIns\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\Excel\AddIns\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\Excel\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Microsoft\Office\Excel\Addins\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Microsoft\Office\Excel\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Microsoft\Office\Excel\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\Excel\Addins\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\Excel\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\Excel\Addins\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\Excel\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Wow6432Node\Microsoft\Office\Excel\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Wow6432Node\Microsoft\Office\Excel\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\PowerPoint\Addins\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\PowerPoint\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\PowerPoint\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\PowerPoint\Addins\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\PowerPoint\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\PowerPoint\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\PowerPoint\AddIns\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\Excel\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Wow6432Node\Microsoft\Office\Excel\Addins\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\PowerPoint\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\PowerPoint\AddIns\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Wow6432Node\Microsoft\Office\Word\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\iManage" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Interwoven" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\iManage" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\Word\Addins\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\Word\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\Word\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\Word\Addins\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\Word\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\Excel\Addins\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Visio\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\Excel\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\Word\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Microsoft\Office\Word\Addins\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Microsoft\Office\Word\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Microsoft\Office\Word\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\Word\Addins\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\Word\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\Word\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Wow6432Node\Microsoft\Office\Word\Addins\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Wow6432Node\Microsoft\Office\Word\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\Word\AddIns\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\Word\AddIns\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\Word\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Office\15.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Microsoft\Office\PowerPoint\Addins\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Visio\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Visio\AddIns\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Visio\AddIns\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Microsoft\Visio\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Microsoft\Visio\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Visio\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Visio\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Wow6432Node\Microsoft\Visio\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Wow6432Node\Microsoft\Visio\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Visio\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\cmd.exe' /c dir /a:d /b C:\Users\*
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Visio\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\iManage\StayExec /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\iManage\StayExec /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\iManage\StayExec /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\iManage\StayExec /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\iManage\StayExec /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\iManage\AgentServices /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\iManage\AgentServices /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\iManage\AgentServices /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\iManage\AgentServices /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\iManage\AgentServices\AutoUpdate" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Visio\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\iManage\StayExec /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Wow6432Node\Microsoft\Office\Outlook\Addins\WorkSiteEmailManagement.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Wow6432Node\Microsoft\Office\Outlook\Addins\iMFileSite.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Microsoft\Office\PowerPoint\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\PowerPoint\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\PowerPoint\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Wow6432Node\Microsoft\Office\PowerPoint\Addins\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Wow6432Node\Microsoft\Office\PowerPoint\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Wow6432Node\Microsoft\Office\PowerPoint\Addins\oUTR02K.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\iManage.Outlook.VstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\iMFileSite.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\WorkSiteEmailManagement.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\Outlook\Addins\iManage.Outlook.VstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\Outlook\Addins\iMFileSite.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\PowerPoint\Addins\iManage.WordVstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\Outlook\Addins\WorkSiteEmailManagement.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\Outlook\Addins\iMFileSite.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\Outlook\Addins\WorkSiteEmailManagement.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Microsoft\Office\Outlook\Addins\iManage.Outlook.VstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Microsoft\Office\Outlook\Addins\iMFileSite.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Microsoft\Office\Outlook\Addins\WorkSiteEmailManagement.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\Outlook\Addins\iManage.Outlook.VstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\Outlook\Addins\iMFileSite.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\Outlook\Addins\WorkSiteEmailManagement.Connect" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Wow6432Node\Microsoft\Office\Outlook\Addins\iManage.Outlook.VstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Visio\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\Outlook\Addins\iManage.Outlook.VstoAddIn.15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Interwoven" /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Visio\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Visio\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Visio\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Office\Excel\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Office\Excel\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Office\Excel\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Office\Excel\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Office\Excel\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Office\Excel\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Office\Excel\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Office\Excel\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Office\Excel\Addins\iManage.ExcelVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Office\Excel\Addins\iManage.ExcelVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Office\Excel\Addins\iManage.ExcelVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Office\Excel\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Office\14.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Office\14.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Office\14.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Office\14.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Office\14.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Office\15.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Office\15.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Office\Excel\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Office\Excel\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Office\Excel\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Office\Excel\Addins\iManage.ExcelVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Office\Excel\Addins\iManage.ExcelVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Office\15.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\IXP000.TMP\iManage_Cleanup.msi"
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI3F6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1181738 1 CleanupUtils!CleanupUtils.CustomActions.DetectBundles
- '<SYSTEM32>\cmd.exe' /c reg query HKU
- '<SYSTEM32>\reg.exe' query HKU
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Office\Word\Addins\iManage.WordVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Office\Word\Addins\iManage.WordVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Office\Word\Addins\iManage.WordVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Office\Word\Addins\iManage.WordVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Office\Word\Addins\iManage.WordVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Office\Word\Addins\iManage.WordVstoAddIn.15 /f
- '<SYSTEM32>\cmd.exe' /c ver
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Office\Word\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Office\Word\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Office\Word\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Office\Word\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Office\Word\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Office\Word\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Office\Word\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Office\Word\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Office\Word\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Office\Word\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Office\Word\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Office\Word\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\iManage\AgentServices /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\USERS\.DEFAULT\Software\Microsoft\Office\PowerPoint\Addins\WorkSiteOffice2007Addins.Connect" /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Office\15.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Office\16.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Office\Outlook\Addins\iManage.Outlook.VstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Office\Outlook\Addins\iMFileSite.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Office\Outlook\Addins\iMFileSite.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Office\Outlook\Addins\iMFileSite.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Office\Outlook\Addins\iMFileSite.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Office\Outlook\Addins\iMFileSite.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Office\Outlook\Addins\iMFileSite.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Office\Outlook\Addins\WorkSiteEmailManagement.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Office\Outlook\Addins\iManage.Outlook.VstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Office\Outlook\Addins\WorkSiteEmailManagement.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Office\Outlook\Addins\iManage.Outlook.VstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Office\Outlook\Addins\WorkSiteEmailManagement.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Office\Outlook\Addins\WorkSiteEmailManagement.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Visio\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Visio\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Visio\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Visio\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Visio\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Visio\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Visio\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Office\Outlook\Addins\WorkSiteEmailManagement.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Office\Excel\Addins\iManage.ExcelVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Office\Outlook\Addins\WorkSiteEmailManagement.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Office\Outlook\Addins\iManage.Outlook.VstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Office\Outlook\Addins\iManage.Outlook.VstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Office\Outlook\Addins\iManage.Outlook.VstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Office\16.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Office\16.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Office\16.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Office\16.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Office\PowerPoint\Addins\iManage.PowerPointVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Office\PowerPoint\Addins\iManage.PowerPointVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Office\PowerPoint\Addins\iManage.PowerPointVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Office\PowerPoint\Addins\iManage.PowerPointVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Office\PowerPoint\Addins\iManage.PowerPointVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Office\16.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Office\PowerPoint\Addins\iManage.PowerPointVstoAddIn.15 /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Office\PowerPoint\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Office\PowerPoint\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Office\PowerPoint\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Office\PowerPoint\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Office\PowerPoint\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Office\PowerPoint\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-19\SOFTWARE\Microsoft\Office\PowerPoint\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-20\SOFTWARE\Microsoft\Office\PowerPoint\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001\SOFTWARE\Microsoft\Office\PowerPoint\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1960123792-2022915161-3775307078-1001_Classes\SOFTWARE\Microsoft\Office\PowerPoint\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\.DEFAULT\SOFTWARE\Microsoft\Office\PowerPoint\Addins\WorkSiteOffice2007Addins.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Office\PowerPoint\Addins\oUTR02K.Connect /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\Microsoft\Office\15.0\Excel\Options /v OPEN /f
- '<SYSTEM32>\reg.exe' delete HKU\S-1-5-18\SOFTWARE\iManage\AgentServices /f
