Trojan.Siggen21.9818

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\ClickToRunSvc] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\ClickToRunSvc] 'ImagePath' = '"%CommonProgramFiles%\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service'

Создает следующие сервисы

'ClickToRunSvc' "%CommonProgramFiles%\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

Изменения в файловой системе

Создает следующие файлы

%TEMP%\qndqtxlfs-20230719-1920.log
%TEMP%\qndqtxlfs-20230719-1921.log
%ProgramFiles%\microsoft office 15\clientx64\officeclicktorun.exe
%WINDIR%\temp\qndqtxlfs-20230719-1921.log
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\office\otele\officeclicktorun.exe.db-journal
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\office\otele\officeclicktorun.exe.db
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\office\otele\officeclicktorun.exe.db-shm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\office\otele\officeclicktorun.exe.db-wal
%LOCALAPPDATA%\microsoft\office\otele\officeclicktorun.exe.db-journal
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\vcruntime140.dll
%ProgramFiles%\microsoft office 15\clientx64\integratedoffice.exe
%LOCALAPPDATA%\microsoft\office\otele\officeclicktorun.exe.db
%WINDIR%\temp\cabe178.tmp
%WINDIR%\temp\tare179.tmp
%WINDIR%\temp\cabe199.tmp
%WINDIR%\temp\tare19a.tmp
%WINDIR%\temp\bitd79f.tmp
%WINDIR%\temp\officec2r1d07584d-06a2-42ae-9143-dfea19a39c22\bite353.tmp
%WINDIR%\temp\cabe469.tmp
%WINDIR%\temp\tare46a.tmp
%LOCALAPPDATA%\microsoft\office\otele\officeclicktorun.exe.db-shm
%LOCALAPPDATA%\microsoft\office\otele\officeclicktorun.exe.db-wal
%WINDIR%\temp\tare537.tmp
%WINDIR%\temp\cabe536.tmp
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\subsystemcontroller.man
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\frequentofficeupdateschedule.xml
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\i640.cab.cat
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\i640.hash
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\inspectorofficegadget.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\integratedoffice.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\mavinject32.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msix.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\ucrtbase.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\concrt140.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\vccorlib140.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msvcp120.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\officec2rcom.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\officeclicktorun.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\offreg.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\repoman.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\servicewatcherschedule.xml
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\sharedperformance.man
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\streamserver.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msvcp140.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msvcr120.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\officec2rclient.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvmanifest.dll
%WINDIR%\temp\cabe557.tmp
%WINDIR%\temp\tar2790.tmp
%WINDIR%\temp\tar3844.tmp
%WINDIR%\temp\cab3c99.tmp
%WINDIR%\temp\tar3c9a.tmp
%WINDIR%\temp\cab3d85.tmp
%WINDIR%\temp\tar3d96.tmp
%WINDIR%\temp\cab3dc5.tmp
%WINDIR%\temp\tar3dc6.tmp
%WINDIR%\temp\cab278f.tmp
%WINDIR%\temp\cab48df.tmp
%WINDIR%\temp\cab3843.tmp
%WINDIR%\temp\cab538b.tmp
%WINDIR%\temp\cab5457.tmp
%WINDIR%\temp\tar5458.tmp
%WINDIR%\temp\cab5ed5.tmp
%WINDIR%\temp\tar5ed6.tmp
%WINDIR%\temp\cab5f15.tmp
%WINDIR%\temp\tar5f16.tmp
%ALLUSERSPROFILE%\microsoft\clicktorun\productreleases\734d6d1f-7187-4905-9de1-e94e246f2d21\x-none.16\stream.x64.x-none.man.dat
%WINDIR%\temp\tar48e0.tmp
%WINDIR%\temp\tar2721.tmp
%WINDIR%\temp\tar538c.tmp
%WINDIR%\temp\cab2720.tmp
%WINDIR%\temp\tar26b2.tmp
%WINDIR%\temp\cabf724.tmp
%WINDIR%\temp\cabfa71.tmp
%WINDIR%\temp\tarfa72.tmp
%WINDIR%\temp\cabfbba.tmp
%WINDIR%\temp\tarfbbb.tmp
%WINDIR%\temp\cabcbd.tmp
%WINDIR%\temp\tarcbe.tmp
%WINDIR%\temp\cab1047.tmp
%WINDIR%\temp\tar1048.tmp
%WINDIR%\temp\cab10e5.tmp
%WINDIR%\temp\tarf725.tmp
%WINDIR%\temp\tar10e6.tmp
%WINDIR%\temp\tar1146.tmp
%WINDIR%\temp\cab2257.tmp
%WINDIR%\temp\tar2258.tmp
%WINDIR%\temp\cab22b7.tmp
%WINDIR%\temp\tar22b8.tmp
%WINDIR%\temp\cab268f.tmp
%WINDIR%\temp\tar2690.tmp
%WINDIR%\temp\cab26b1.tmp
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\clienteventlogmessages.man
%WINDIR%\temp\cab1145.tmp
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\cpprestsdk.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\clientcapabilities.json
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rui.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.zh-tw.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-private-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-process-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-runtime-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-stdio-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-string-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-time-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-utility-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-locale-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-filesystem-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-multibyte-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\apiclient.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvclientisv.man
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvfilesystemmetadata.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvintegration.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvapi.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvstreamingmanager.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvsubsystemcontroller.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvsubsystems32.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvcatalog.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvcleaner.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvclient.man
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-heap-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-environment-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvsubsystems64.dll
%TEMP%\office.validateerror.scratch
%TEMP%\bit479a.tmp
%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\bit497e.tmp
%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9officec2rd13640e6-294d-4436-8e03-014657aa2740\v64.hash
%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9officec2rd13640e6-294d-4436-8e03-014657aa2740\versiondescriptor.xml
%TEMP%\bit55af.tmp
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\bit5801.tmp
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2aofficec2r81fb11cf-dbd5-4041-bb6b-28e000b6bba1\v64.hash
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2aofficec2r81fb11cf-dbd5-4041-bb6b-28e000b6bba1\versiondescriptor.xml
%TEMP%\office.validateresult.scratch
%TEMP%\bit5aef.tmp
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-file-l1-2-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-file-l2-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-localization-l1-2-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-processthreads-l1-1-1.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-synch-l1-2-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-timezone-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-xstate-l2-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-conio-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\officec2rb59647c5-0e5b-4c6b-a87f-571a58363ee2\bit5c86.tmp
%ALLUSERSPROFILE%\microsoft\clicktorun\productreleases\734d6d1f-7187-4905-9de1-e94e246f2d21\es-es.16\stream.x64.es-es.man.dat
%WINDIR%\temp\tare558.tmp
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvvirtualization.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvscripting.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.lv-lv.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ms-my.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.nb-no.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.nl-nl.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.pl-pl.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.pt-br.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.pt-pt.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.kk-kz.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ro-ro.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.lt-lt.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sk-sk.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sr-latn-rs.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sv-se.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.th-th.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.tr-tr.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.uk-ua.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.vi-vn.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.zh-cn.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ru-ru.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-math-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sl-si.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ko-kr.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ja-jp.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.it-it.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvshnotify.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2r32.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2r64.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rheartbeatconfig.xml
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ar-sa.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.bg-bg.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.cs-cz.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.da-dk.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvpolicy.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.de-de.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.en-us.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.es-es.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.et-ee.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.fi-fi.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.fr-fr.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.he-il.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.hi-in.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.hr-hr.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.hu-hu.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.el-gr.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.id-id.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvorchestration.dll
%LOCALAPPDATA%\microsoft\office\otele\officec2rclient.exe.db-shm

Присваивает атрибут 'скрытый' для следующих файлов

%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\bit497e.tmp
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\bit5801.tmp
%TEMP%\officec2rb59647c5-0e5b-4c6b-a87f-571a58363ee2\bit5c86.tmp
%WINDIR%\temp\officec2r1d07584d-06a2-42ae-9143-dfea19a39c22\bite353.tmp

Удаляет следующие файлы

%TEMP%\office.validateerror.scratch
%WINDIR%\temp\cab278f.tmp
%WINDIR%\temp\tar2721.tmp
%WINDIR%\temp\cab2720.tmp
%WINDIR%\temp\tar26b2.tmp
%WINDIR%\temp\cab26b1.tmp
%WINDIR%\temp\cab3843.tmp
%WINDIR%\temp\tar2690.tmp
%WINDIR%\temp\tar22b8.tmp
%WINDIR%\temp\cab22b7.tmp
%WINDIR%\temp\tar2258.tmp
%WINDIR%\temp\cab2257.tmp
%WINDIR%\temp\tar1146.tmp
%WINDIR%\temp\cab1145.tmp
%WINDIR%\temp\cab268f.tmp
%WINDIR%\temp\cabf724.tmp
%WINDIR%\temp\tar3844.tmp
%WINDIR%\temp\cab5f15.tmp
%WINDIR%\temp\tar5ed6.tmp
%WINDIR%\temp\cab5ed5.tmp
%WINDIR%\temp\tar5458.tmp
%WINDIR%\temp\cab5457.tmp
%WINDIR%\temp\tar538c.tmp
%WINDIR%\temp\tar10e6.tmp
%WINDIR%\temp\tar2790.tmp
%WINDIR%\temp\cab48df.tmp
%WINDIR%\temp\tar3dc6.tmp
%WINDIR%\temp\cab3dc5.tmp
%WINDIR%\temp\tar3d96.tmp
%WINDIR%\temp\cab3d85.tmp
%WINDIR%\temp\tar3c9a.tmp
%WINDIR%\temp\tar48e0.tmp
%WINDIR%\temp\cab3c99.tmp
%WINDIR%\temp\cab10e5.tmp
%WINDIR%\temp\tar1048.tmp
%WINDIR%\temp\cab1047.tmp
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\v64.hash
%TEMP%\office.validateresult.scratch
%TEMP%\v64checkreachablefe0ef53d-35cb-4928-aec7-bbdf80e05998
%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\v64.cab
%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\v64.hash
%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\versiondescriptor.xml
%WINDIR%\temp\tar5f16.tmp
%TEMP%\v64_16.0.12527.22286checkreachable1845d132-02f4-4030-b25a-c3d9db22ffff
%WINDIR%\temp\tare179.tmp
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\versiondescriptor.xml
%TEMP%\i640checkreachable49884224-15e6-4a8c-9623-db9fba8eeea8
%TEMP%\officec2rb59647c5-0e5b-4c6b-a87f-571a58363ee2\i640.cab
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\office\otele\officeclicktorun.exe.db-journal
%LOCALAPPDATA%\microsoft\office\otele\officeclicktorun.exe.db-journal
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\v64_16.0.12527.22286.cab
%WINDIR%\temp\cab538b.tmp
%WINDIR%\temp\cabe199.tmp
%WINDIR%\temp\cabe469.tmp
%WINDIR%\temp\tare19a.tmp
%WINDIR%\temp\tarcbe.tmp
%WINDIR%\temp\cabcbd.tmp
%WINDIR%\temp\tarfbbb.tmp
%WINDIR%\temp\cabfbba.tmp
%WINDIR%\temp\tarfa72.tmp
%WINDIR%\temp\s643082checkreachableaaadbcd1-0d78-41fd-8ed3-984faa4f41ba
%WINDIR%\temp\cabfa71.tmp
%WINDIR%\temp\cabe178.tmp
%WINDIR%\temp\tare558.tmp
%WINDIR%\temp\cabe557.tmp
%WINDIR%\temp\tare537.tmp
%WINDIR%\temp\cabe536.tmp
%WINDIR%\temp\tare46a.tmp
%WINDIR%\temp\tarf725.tmp
%WINDIR%\temp\officec2r1d07584d-06a2-42ae-9143-dfea19a39c22\s643082.cab

Перемещает следующие файлы

%TEMP%\bit479a.tmp в %TEMP%\v64checkreachablefe0ef53d-35cb-4928-aec7-bbdf80e05998
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.tr-tr.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.tr-tr.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.th-th.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.th-th.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sv-se.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.sv-se.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sr-latn-rs.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.sr-latn-rs.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sl-si.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.sl-si.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sk-sk.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.sk-sk.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ru-ru.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.ru-ru.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ro-ro.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.ro-ro.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.pt-pt.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.pt-pt.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.pt-br.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.pt-br.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.pl-pl.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.pl-pl.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.nl-nl.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.nl-nl.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.vi-vn.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.vi-vn.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.uk-ua.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.uk-ua.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.lv-lv.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.lv-lv.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.lt-lt.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.lt-lt.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ko-kr.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.ko-kr.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.kk-kz.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.kk-kz.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ja-jp.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.ja-jp.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.it-it.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.it-it.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.id-id.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.id-id.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.hu-hu.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.hu-hu.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.hr-hr.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.hr-hr.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.hi-in.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.hi-in.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.he-il.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.he-il.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.fr-fr.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.fr-fr.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.nb-no.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.nb-no.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-time-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-time-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.zh-cn.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.zh-cn.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\vcruntime140.dll в %CommonProgramFiles%\microsoft shared\clicktorun\vcruntime140.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\vccorlib140.dll в %CommonProgramFiles%\microsoft shared\clicktorun\vccorlib140.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\ucrtbase.dll в %CommonProgramFiles%\microsoft shared\clicktorun\ucrtbase.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\subsystemcontroller.man в %CommonProgramFiles%\microsoft shared\clicktorun\subsystemcontroller.man
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\streamserver.dll в %CommonProgramFiles%\microsoft shared\clicktorun\streamserver.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\sharedperformance.man в %CommonProgramFiles%\microsoft shared\clicktorun\sharedperformance.man
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\servicewatcherschedule.xml в %CommonProgramFiles%\microsoft shared\clicktorun\servicewatcherschedule.xml
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\repoman.dll в %CommonProgramFiles%\microsoft shared\clicktorun\repoman.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\offreg.dll в %CommonProgramFiles%\microsoft shared\clicktorun\offreg.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\officeclicktorun.exe в %CommonProgramFiles%\microsoft shared\clicktorun\officeclicktorun.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\officec2rcom.dll в %CommonProgramFiles%\microsoft shared\clicktorun\officec2rcom.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\officec2rclient.exe в %CommonProgramFiles%\microsoft shared\clicktorun\officec2rclient.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msvcr120.dll в %CommonProgramFiles%\microsoft shared\clicktorun\msvcr120.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msvcp140.dll в %CommonProgramFiles%\microsoft shared\clicktorun\msvcp140.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msvcp120.dll в %CommonProgramFiles%\microsoft shared\clicktorun\msvcp120.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msix.dll в %CommonProgramFiles%\microsoft shared\clicktorun\msix.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\mavinject32.exe в %CommonProgramFiles%\microsoft shared\clicktorun\mavinject32.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\integratedoffice.exe в %CommonProgramFiles%\microsoft shared\clicktorun\integratedoffice.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\inspectorofficegadget.exe в %CommonProgramFiles%\microsoft shared\clicktorun\inspectorofficegadget.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\i640.hash в %CommonProgramFiles%\microsoft shared\clicktorun\i640.hash
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\i640.cab.cat в %CommonProgramFiles%\microsoft shared\clicktorun\i640.cab.cat
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\frequentofficeupdateschedule.xml в %CommonProgramFiles%\microsoft shared\clicktorun\frequentofficeupdateschedule.xml
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\cpprestsdk.dll в %CommonProgramFiles%\microsoft shared\clicktorun\cpprestsdk.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\concrt140.dll в %CommonProgramFiles%\microsoft shared\clicktorun\concrt140.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\clienteventlogmessages.man в %CommonProgramFiles%\microsoft shared\clicktorun\clienteventlogmessages.man
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\clientcapabilities.json в %CommonProgramFiles%\microsoft shared\clicktorun\clientcapabilities.json
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rui.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rui.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.fi-fi.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.fi-fi.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ms-my.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.ms-my.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.et-ee.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.et-ee.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.es-es.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.es-es.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.en-us.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.en-us.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-synch-l1-2-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-core-synch-l1-2-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-process-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-process-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-private-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-private-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-multibyte-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-multibyte-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-math-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-math-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-locale-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-locale-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-heap-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-heap-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-filesystem-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-filesystem-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-environment-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-environment-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-convert-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-convert-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-conio-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-conio-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-xstate-l2-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-core-xstate-l2-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-timezone-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-core-timezone-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-processthreads-l1-1-1.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-core-processthreads-l1-1-1.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-stdio-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-stdio-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-localization-l1-2-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-core-localization-l1-2-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-file-l2-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-core-file-l2-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-file-l1-2-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-core-file-l1-2-0.dll
%TEMP%\officec2rb59647c5-0e5b-4c6b-a87f-571a58363ee2\bit5c86.tmp в %TEMP%\officec2rb59647c5-0e5b-4c6b-a87f-571a58363ee2\i640.cab
%TEMP%\bit5aef.tmp в %TEMP%\i640checkreachable49884224-15e6-4a8c-9623-db9fba8eeea8
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2aofficec2r81fb11cf-dbd5-4041-bb6b-28e000b6bba1\versiondescriptor.xml в %TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\versiondescriptor.xml
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2aofficec2r81fb11cf-dbd5-4041-bb6b-28e000b6bba1\v64.hash в %TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\v64.hash
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\bit5801.tmp в %TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\v64_16.0.12527.22286.cab
%TEMP%\bit55af.tmp в %TEMP%\v64_16.0.12527.22286checkreachable1845d132-02f4-4030-b25a-c3d9db22ffff
%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9officec2rd13640e6-294d-4436-8e03-014657aa2740\versiondescriptor.xml в %TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\versiondescriptor.xml
%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9officec2rd13640e6-294d-4436-8e03-014657aa2740\v64.hash в %TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\v64.hash
%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\bit497e.tmp в %TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\v64.cab
%WINDIR%\temp\bitd79f.tmp в %WINDIR%\temp\s643082checkreachableaaadbcd1-0d78-41fd-8ed3-984faa4f41ba
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.zh-tw.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.zh-tw.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-string-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-string-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\apiclient.dll в %CommonProgramFiles%\microsoft shared\clicktorun\apiclient.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-runtime-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-runtime-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.el-gr.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.el-gr.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.de-de.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.de-de.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.da-dk.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.da-dk.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.cs-cz.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.cs-cz.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.bg-bg.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.bg-bg.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ar-sa.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.ar-sa.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rheartbeatconfig.xml в %CommonProgramFiles%\microsoft shared\clicktorun\c2rheartbeatconfig.xml
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2r64.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2r64.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2r32.dll в %CommonProgramFiles%\microsoft shared\clicktorun\c2r32.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvshnotify.exe в %CommonProgramFiles%\microsoft shared\clicktorun\appvshnotify.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvscripting.dll в %CommonProgramFiles%\microsoft shared\clicktorun\appvscripting.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvpolicy.dll в %CommonProgramFiles%\microsoft shared\clicktorun\appvpolicy.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvorchestration.dll в %CommonProgramFiles%\microsoft shared\clicktorun\appvorchestration.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvmanifest.dll в %CommonProgramFiles%\microsoft shared\clicktorun\appvmanifest.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvvirtualization.dll в %CommonProgramFiles%\microsoft shared\clicktorun\appvisvvirtualization.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvsubsystems64.dll в %CommonProgramFiles%\microsoft shared\clicktorun\appvisvsubsystems64.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvsubsystems32.dll в %CommonProgramFiles%\microsoft shared\clicktorun\appvisvsubsystems32.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvsubsystemcontroller.dll в %CommonProgramFiles%\microsoft shared\clicktorun\appvisvsubsystemcontroller.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvstreamingmanager.dll в %CommonProgramFiles%\microsoft shared\clicktorun\appvisvstreamingmanager.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvapi.dll в %CommonProgramFiles%\microsoft shared\clicktorun\appvisvapi.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvintegration.dll в %CommonProgramFiles%\microsoft shared\clicktorun\appvintegration.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvfilesystemmetadata.dll в %CommonProgramFiles%\microsoft shared\clicktorun\appvfilesystemmetadata.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvclientisv.man в %CommonProgramFiles%\microsoft shared\clicktorun\appvclientisv.man
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvclient.man в %CommonProgramFiles%\microsoft shared\clicktorun\appvclient.man
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvcleaner.exe в %CommonProgramFiles%\microsoft shared\clicktorun\appvcleaner.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvcatalog.dll в %CommonProgramFiles%\microsoft shared\clicktorun\appvcatalog.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-utility-l1-1-0.dll в %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-utility-l1-1-0.dll
%WINDIR%\temp\officec2r1d07584d-06a2-42ae-9143-dfea19a39c22\bite353.tmp в %WINDIR%\temp\officec2r1d07584d-06a2-42ae-9143-dfea19a39c22\s643082.cab

Подменяет следующие файлы

%TEMP%\office.validateresult.scratch
%TEMP%\office.validateerror.scratch
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\office\otele\officeclicktorun.exe.db-journal
%LOCALAPPDATA%\microsoft\office\otele\officeclicktorun.exe.db-journal

Сетевая активность

Подключается к

'ne#######s.officeapps.live.com':443
'ec#.#ffice.com':443
'mr########gr.officeapps.live.com':443
'officecdn.microsoft.com':80
'self.events.data.microsoft.com':443

TCP

Запросы HTTP GET

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

Другие

'ec#.#ffice.com':443
'ne#######s.officeapps.live.com':443
'mr########gr.officeapps.live.com':443
'self.events.data.microsoft.com':443

UDP

DNS ASK ne#######s.officeapps.live.com
DNS ASK ec#.#ffice.com
DNS ASK mr########gr.officeapps.live.com
DNS ASK officecdn.microsoft.com
DNS ASK self.events.data.microsoft.com
DNS ASK microsoft.com

Другое

Создает и запускает на исполнение

'%CommonProgramFiles%\microsoft shared\clicktorun\officeclicktorun.exe' platform=x64 culture=es-es productstoadd=AccessRuntimeRetail.16_es-es_x-none cdnbaseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl.16=http://officecdn.mic...
'%CommonProgramFiles%\microsoft shared\clicktorun\officeclicktorun.exe' /service
'%CommonProgramFiles%\microsoft shared\clicktorun\officec2rclient.exe' /progressandlaunch AppTargets="root\office16\msaccess.exe" ManualUpgrade=False ScenarioToTrack="Scenario:{FB9843BB-0D8A-4347-A227-C759C3FC9103}@INSTALL"
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath '%TEMP%\Offic...' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath '%TEMP%\Offic...

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней