Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\aut7484.tmp
- %WINDIR%\globalization\els\installfiles\bewerkt.gif
- %TEMP%\aut7764.tmp
- %WINDIR%\globalization\els\installfiles\setup.exe
- %TEMP%\aut7968.tmp
- %WINDIR%\globalization\els\installfiles\configuratielite.xml
- %TEMP%\aut7979.tmp
- %WINDIR%\globalization\els\installfiles\ohook_activation_aio.cmd
- %LOCALAPPDATA%\microsoft\office\16.0\webservicecache\allusers\officeclient.microsoft.com\46410a2c-6959-449f-8be2-9e59138c9fdb
- %LOCALAPPDATA%\microsoft\office\otele\setup.exe.db-journal
- %LOCALAPPDATA%\microsoft\office\otele\setup.exe.db
- %LOCALAPPDATA%\microsoft\office\otele\setup.exe.db-shm
- %LOCALAPPDATA%\microsoft\office\otele\setup.exe.db-wal
- %TEMP%\auztdairgzel-20261012-0118.log
- %TEMP%\officec2rae81fe2a-9736-47ef-a60b-5d653015c707officec2rfd3d9be6-2ed3-4c7a-a2bd-89f272d67e51\v64.hash
- %TEMP%\officec2rae81fe2a-9736-47ef-a60b-5d653015c707officec2rfd3d9be6-2ed3-4c7a-a2bd-89f272d67e51\versiondescriptor.xml
- nul
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\appxprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\assocprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\cbsprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\dismcore.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\dismcoreps.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\dismhost.exe
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\dismprov.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\dmiprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\appxprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\assocprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\cbsprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\dismcore.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\dismprov.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\dmiprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\ffuprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\folderprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\genericprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\ibsprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\imagingprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\intlprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\logprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\msiprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\offlinesetupprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\osprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\provprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\setupplatformprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\smiprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\sysprepprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\transmogprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\unattendprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\vhdprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\en-us\wimprovider.dll.mui
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\ffuprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\folderprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\genericprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\ibsprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\imagingprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\intlprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\logprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\msiprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\offlinesetupprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\osprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\provprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\setupplatformprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\smiprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\sysprepprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\transmogprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\unattendprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\vhdprovider.dll
- %TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\wimprovider.dll
Удаляет файлы, которые сам же создал
- %TEMP%\aut7484.tmp
- %TEMP%\aut7764.tmp
- %TEMP%\aut7968.tmp
- %TEMP%\aut7979.tmp
- %LOCALAPPDATA%\microsoft\office\otele\setup.exe.db-journal
- %TEMP%\v64_16.0.17932.21000checkreachable078b9eaf-dbce-4113-a658-f07fa6c28ae3
- %TEMP%\officec2rae81fe2a-9736-47ef-a60b-5d653015c707\v64.hash
- %TEMP%\officec2rae81fe2a-9736-47ef-a60b-5d653015c707\v64_16.0.17932.21000.cab
- %TEMP%\officec2rae81fe2a-9736-47ef-a60b-5d653015c707\versiondescriptor.xml
- %LOCALAPPDATA%\microsoft\office\otele\setup.exe.db-shm
- %LOCALAPPDATA%\microsoft\office\otele\setup.exe.db-wal
Перемещает следующие файлы
- %TEMP%\officec2rae81fe2a-9736-47ef-a60b-5d653015c707officec2rfd3d9be6-2ed3-4c7a-a2bd-89f272d67e51\v64.hash в %TEMP%\officec2rae81fe2a-9736-47ef-a60b-5d653015c707\v64.hash
- %TEMP%\officec2rae81fe2a-9736-47ef-a60b-5d653015c707officec2rfd3d9be6-2ed3-4c7a-a2bd-89f272d67e51\versiondescriptor.xml в %TEMP%\officec2rae81fe2a-9736-47ef-a60b-5d653015c707\versiondescriptor.xml
Подменяет следующие файлы
- %LOCALAPPDATA%\microsoft\office\otele\setup.exe.db-journal
Сетевая активность
Подключается к
- 'ec#.#ffice.com':443
- 'officeclient.microsoft.com':443
- 'f.###.#s.cdn.office.net':80
- 'mobile.events.data.microsoft.com':443
- 'oneocsp.microsoft.com':80
TCP
Запросы HTTP GET
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e0##############
- http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAALE%2BVmfUqbVYAAAAAAAAs%3D
Другие
- 'ec#.#ffice.com':443
- 'mr########gr.officeapps.live.com':443
- 'mobile.events.data.microsoft.com':443
UDP
- DNS ASK ec#.#ffice.com
- DNS ASK officeclient.microsoft.com
- DNS ASK mr########gr.officeapps.live.com
- DNS ASK f.###.#s.cdn.office.net
- DNS ASK mobile.events.data.microsoft.com
- DNS ASK oneocsp.microsoft.com
- DNS ASK up######eck.massgrave.dev
Другое
Создает и запускает на исполнение
- '%WINDIR%\globalization\els\installfiles\setup.exe' /configure Configuratielite.xml
- '%TEMP%\969c9b4e-d3e0-438a-a766-3c618550d73c\dismhost.exe' {73250124-0998-4BF5-A56D-8C0C4D5E3FBC}
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\Globalization\ELS\installfiles\Ohook_Activation_AIO.cmd (со скрытым окном)
- '<SYSTEM32>\sc.exe' query Null
- '<SYSTEM32>\find.exe' /i "RUNNING"
- '<SYSTEM32>\findstr.exe' /v "$" "Ohook_Activation_AIO.cmd"
- '<SYSTEM32>\cmd.exe' /c ver
- '<SYSTEM32>\reg.exe' query "HKCU\Console" /v ForceV2
- '<SYSTEM32>\find.exe' /i "0x0"
- '<SYSTEM32>\cmd.exe' /c echo prompt $E | cmd
- '<SYSTEM32>\cmd.exe' /S /D /c" echo prompt $E "
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\cmd.exe' /S /D /c" echo "%WINDIR%\Globalization\ELS\installfiles\Ohook_Activation_AIO.cmd" "
- '<SYSTEM32>\find.exe' /i "%LOCALAPPDATA%\Temp"
- '<SYSTEM32>\fltmc.exe'
- '<SYSTEM32>\reg.exe' query HKCU\Console /v QuickEdit
- '<SYSTEM32>\cmd.exe' /c ping -4 -n 1 updatecheck.massgrave.dev
- '<SYSTEM32>\ping.exe' -4 -n 1 updatecheck.massgrave.dev
- '<SYSTEM32>\cmd.exe' /S /D /c" echo "127.69.3.0" "
- '<SYSTEM32>\find.exe' "127.69"
- '<SYSTEM32>\find.exe' "12#.69.2.6"
- '<SYSTEM32>\mode.com' 130, 32
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=32;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $ExecutionContext.SessionState.LanguageMode
- '<SYSTEM32>\find.exe' /i "Full"
- '<SYSTEM32>\cmd.exe' /c "powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.Def...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth =...
- '<SYSTEM32>\cmd.exe' /S /D /c" echo "Windows 10 Pro" "
- '<SYSTEM32>\find.exe' /i "Windows"
- '<SYSTEM32>\wbem\wmic.exe' path Win32_ComputerSystem get CreationClassName /value
- '<SYSTEM32>\find.exe' /i "computersystem"
- '<SYSTEM32>\sc.exe' start sppsvc
- '<SYSTEM32>\cmd.exe' /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
- '<SYSTEM32>\reg.exe' query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
- '<SYSTEM32>\sc.exe' query sppsvc
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type
- '<SYSTEM32>\sc.exe' start Winmgmt
- '<SYSTEM32>\sc.exe' query Winmgmt
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type
- '<SYSTEM32>\cmd.exe' /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot
- '<SYSTEM32>\cmd.exe' /c powershell.exe "$f=[io.file]::ReadAllText('%WINDIR%\Globalization\ELS\installfiles\Ohook_Activation_AIO.cmd') -split ':wpatest\:.*';iex ($f[1]);" 2>nul
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "$f=[io.file]::ReadAllText('%WINDIR%\Globalization\ELS\installfiles\Ohook_Activation_AIO.cmd') -split ':wpatest\:.*';iex ($f[1]);"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo "20" "
- '<SYSTEM32>\find.exe' /i "Error Found"
- '<SYSTEM32>\dism.exe' /English /Online /Get-CurrentEdition
- '<SYSTEM32>\cmd.exe' /c exit /b -2147467259
- '<SYSTEM32>\cmd.exe' /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionID 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionID
- '<SYSTEM32>\cscript.exe' //nologo <SYSTEM32>\slmgr.vbs /dlv
- '<SYSTEM32>\cmd.exe' /c exit /b 0
- '<SYSTEM32>\cmd.exe' /S /D /c" echo "0" "
- '<SYSTEM32>\findstr.exe' /i "0x800410 0x800440"
- '<SYSTEM32>\reg.exe' query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"
- '<SYSTEM32>\cmd.exe' /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d
- '<SYSTEM32>\cmd.exe' /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore
- '<SYSTEM32>\cmd.exe' /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "$acl = Get-Acl '"<SYSTEM32>\spp\store\2.0"'; if ($acl.Access.Where{ $_.IdentityReference -eq 'NT SERVICE\sppsvc' -and $_.AccessControlType -eq 'Deny' -or $acl.Access.IdentityReference -notcont...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "$acl = Get-Acl '"HKLM:\SYSTEM\WPA"'; if ($acl.Access.Where{ $_.IdentityReference -eq 'NT SERVICE\sppsvc' -and $_.AccessControlType -eq 'Deny' -or $acl.Access.IdentityReference -notcontains 'NT...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "$acl = Get-Acl '"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"'; if ($acl.Access.Where{ $_.IdentityReference -eq 'NT SERVICE\sppsvc' -and $_.AccessControlType ...
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\14.0\CVH /f Click2run /k
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\CVH /f Click2run /k
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AppxPackage -name "Microsoft.Office.Desktop""
- '<SYSTEM32>\find.exe' /i "Office"
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun /v InstallPath" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun /v InstallPath
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\ClickToRun /v InstallPath" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\ClickToRun /v InstallPath
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path
- '%WINDIR%\globalization\els\installfiles\setup.exe' /configure Configuratielite.xml (со скрытым окном)
