AddinUtil.exe

.NET Tool used for updating cache files for Microsoft Office Add-Ins.

Execute

Proxy execution of malicious serialized payload

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.

AddinUtil is executed from the directory where the 'Addins.Store' payload exists, AddinUtil will execute the 'Addins.Store' payload. — MITRE: T1218 — Privileges: User