Trojan.Siggen21.9818

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\ClickToRunSvc] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\ClickToRunSvc] 'ImagePath' = '"%CommonProgramFiles%\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service'

Creates the following services

'ClickToRunSvc' "%CommonProgramFiles%\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

Modifies file system

Creates the following files

%TEMP%\qndqtxlfs-20230719-1920.log
%TEMP%\qndqtxlfs-20230719-1921.log
%ProgramFiles%\microsoft office 15\clientx64\officeclicktorun.exe
%WINDIR%\temp\qndqtxlfs-20230719-1921.log
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\office\otele\officeclicktorun.exe.db-journal
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\office\otele\officeclicktorun.exe.db
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\office\otele\officeclicktorun.exe.db-shm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\office\otele\officeclicktorun.exe.db-wal
%LOCALAPPDATA%\microsoft\office\otele\officeclicktorun.exe.db-journal
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\vcruntime140.dll
%ProgramFiles%\microsoft office 15\clientx64\integratedoffice.exe
%LOCALAPPDATA%\microsoft\office\otele\officeclicktorun.exe.db
%WINDIR%\temp\cabe178.tmp
%WINDIR%\temp\tare179.tmp
%WINDIR%\temp\cabe199.tmp
%WINDIR%\temp\tare19a.tmp
%WINDIR%\temp\bitd79f.tmp
%WINDIR%\temp\officec2r1d07584d-06a2-42ae-9143-dfea19a39c22\bite353.tmp
%WINDIR%\temp\cabe469.tmp
%WINDIR%\temp\tare46a.tmp
%LOCALAPPDATA%\microsoft\office\otele\officeclicktorun.exe.db-shm
%LOCALAPPDATA%\microsoft\office\otele\officeclicktorun.exe.db-wal
%WINDIR%\temp\tare537.tmp
%WINDIR%\temp\cabe536.tmp
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\subsystemcontroller.man
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\frequentofficeupdateschedule.xml
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\i640.cab.cat
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\i640.hash
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\inspectorofficegadget.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\integratedoffice.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\mavinject32.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msix.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\ucrtbase.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\concrt140.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\vccorlib140.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msvcp120.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\officec2rcom.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\officeclicktorun.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\offreg.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\repoman.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\servicewatcherschedule.xml
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\sharedperformance.man
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\streamserver.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msvcp140.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msvcr120.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\officec2rclient.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvmanifest.dll
%WINDIR%\temp\cabe557.tmp
%WINDIR%\temp\tar2790.tmp
%WINDIR%\temp\tar3844.tmp
%WINDIR%\temp\cab3c99.tmp
%WINDIR%\temp\tar3c9a.tmp
%WINDIR%\temp\cab3d85.tmp
%WINDIR%\temp\tar3d96.tmp
%WINDIR%\temp\cab3dc5.tmp
%WINDIR%\temp\tar3dc6.tmp
%WINDIR%\temp\cab278f.tmp
%WINDIR%\temp\cab48df.tmp
%WINDIR%\temp\cab3843.tmp
%WINDIR%\temp\cab538b.tmp
%WINDIR%\temp\cab5457.tmp
%WINDIR%\temp\tar5458.tmp
%WINDIR%\temp\cab5ed5.tmp
%WINDIR%\temp\tar5ed6.tmp
%WINDIR%\temp\cab5f15.tmp
%WINDIR%\temp\tar5f16.tmp
%ALLUSERSPROFILE%\microsoft\clicktorun\productreleases\734d6d1f-7187-4905-9de1-e94e246f2d21\x-none.16\stream.x64.x-none.man.dat
%WINDIR%\temp\tar48e0.tmp
%WINDIR%\temp\tar2721.tmp
%WINDIR%\temp\tar538c.tmp
%WINDIR%\temp\cab2720.tmp
%WINDIR%\temp\tar26b2.tmp
%WINDIR%\temp\cabf724.tmp
%WINDIR%\temp\cabfa71.tmp
%WINDIR%\temp\tarfa72.tmp
%WINDIR%\temp\cabfbba.tmp
%WINDIR%\temp\tarfbbb.tmp
%WINDIR%\temp\cabcbd.tmp
%WINDIR%\temp\tarcbe.tmp
%WINDIR%\temp\cab1047.tmp
%WINDIR%\temp\tar1048.tmp
%WINDIR%\temp\cab10e5.tmp
%WINDIR%\temp\tarf725.tmp
%WINDIR%\temp\tar10e6.tmp
%WINDIR%\temp\tar1146.tmp
%WINDIR%\temp\cab2257.tmp
%WINDIR%\temp\tar2258.tmp
%WINDIR%\temp\cab22b7.tmp
%WINDIR%\temp\tar22b8.tmp
%WINDIR%\temp\cab268f.tmp
%WINDIR%\temp\tar2690.tmp
%WINDIR%\temp\cab26b1.tmp
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\clienteventlogmessages.man
%WINDIR%\temp\cab1145.tmp
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\cpprestsdk.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\clientcapabilities.json
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rui.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.zh-tw.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-private-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-process-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-runtime-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-stdio-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-string-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-time-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-utility-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-locale-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-filesystem-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-multibyte-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\apiclient.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvclientisv.man
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvfilesystemmetadata.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvintegration.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvapi.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvstreamingmanager.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvsubsystemcontroller.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvsubsystems32.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvcatalog.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvcleaner.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvclient.man
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-heap-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-environment-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvsubsystems64.dll
%TEMP%\office.validateerror.scratch
%TEMP%\bit479a.tmp
%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\bit497e.tmp
%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9officec2rd13640e6-294d-4436-8e03-014657aa2740\v64.hash
%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9officec2rd13640e6-294d-4436-8e03-014657aa2740\versiondescriptor.xml
%TEMP%\bit55af.tmp
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\bit5801.tmp
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2aofficec2r81fb11cf-dbd5-4041-bb6b-28e000b6bba1\v64.hash
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2aofficec2r81fb11cf-dbd5-4041-bb6b-28e000b6bba1\versiondescriptor.xml
%TEMP%\office.validateresult.scratch
%TEMP%\bit5aef.tmp
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-file-l1-2-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-file-l2-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-localization-l1-2-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-processthreads-l1-1-1.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-synch-l1-2-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-timezone-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-xstate-l2-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-conio-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\officec2rb59647c5-0e5b-4c6b-a87f-571a58363ee2\bit5c86.tmp
%ALLUSERSPROFILE%\microsoft\clicktorun\productreleases\734d6d1f-7187-4905-9de1-e94e246f2d21\es-es.16\stream.x64.es-es.man.dat
%WINDIR%\temp\tare558.tmp
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvvirtualization.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvscripting.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.lv-lv.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ms-my.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.nb-no.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.nl-nl.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.pl-pl.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.pt-br.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.pt-pt.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.kk-kz.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ro-ro.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.lt-lt.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sk-sk.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sr-latn-rs.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sv-se.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.th-th.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.tr-tr.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.uk-ua.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.vi-vn.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.zh-cn.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ru-ru.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-math-l1-1-0.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sl-si.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ko-kr.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ja-jp.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.it-it.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvshnotify.exe
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2r32.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2r64.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rheartbeatconfig.xml
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ar-sa.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.bg-bg.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.cs-cz.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.da-dk.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvpolicy.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.de-de.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.en-us.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.es-es.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.et-ee.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.fi-fi.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.fr-fr.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.he-il.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.hi-in.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.hr-hr.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.hu-hu.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.el-gr.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.id-id.dll
%CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvorchestration.dll
%LOCALAPPDATA%\microsoft\office\otele\officec2rclient.exe.db-shm

Sets the 'hidden' attribute to the following files

%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\bit497e.tmp
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\bit5801.tmp
%TEMP%\officec2rb59647c5-0e5b-4c6b-a87f-571a58363ee2\bit5c86.tmp
%WINDIR%\temp\officec2r1d07584d-06a2-42ae-9143-dfea19a39c22\bite353.tmp

Deletes the following files

%TEMP%\office.validateerror.scratch
%WINDIR%\temp\cab278f.tmp
%WINDIR%\temp\tar2721.tmp
%WINDIR%\temp\cab2720.tmp
%WINDIR%\temp\tar26b2.tmp
%WINDIR%\temp\cab26b1.tmp
%WINDIR%\temp\cab3843.tmp
%WINDIR%\temp\tar2690.tmp
%WINDIR%\temp\tar22b8.tmp
%WINDIR%\temp\cab22b7.tmp
%WINDIR%\temp\tar2258.tmp
%WINDIR%\temp\cab2257.tmp
%WINDIR%\temp\tar1146.tmp
%WINDIR%\temp\cab1145.tmp
%WINDIR%\temp\cab268f.tmp
%WINDIR%\temp\cabf724.tmp
%WINDIR%\temp\tar3844.tmp
%WINDIR%\temp\cab5f15.tmp
%WINDIR%\temp\tar5ed6.tmp
%WINDIR%\temp\cab5ed5.tmp
%WINDIR%\temp\tar5458.tmp
%WINDIR%\temp\cab5457.tmp
%WINDIR%\temp\tar538c.tmp
%WINDIR%\temp\tar10e6.tmp
%WINDIR%\temp\tar2790.tmp
%WINDIR%\temp\cab48df.tmp
%WINDIR%\temp\tar3dc6.tmp
%WINDIR%\temp\cab3dc5.tmp
%WINDIR%\temp\tar3d96.tmp
%WINDIR%\temp\cab3d85.tmp
%WINDIR%\temp\tar3c9a.tmp
%WINDIR%\temp\tar48e0.tmp
%WINDIR%\temp\cab3c99.tmp
%WINDIR%\temp\cab10e5.tmp
%WINDIR%\temp\tar1048.tmp
%WINDIR%\temp\cab1047.tmp
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\v64.hash
%TEMP%\office.validateresult.scratch
%TEMP%\v64checkreachablefe0ef53d-35cb-4928-aec7-bbdf80e05998
%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\v64.cab
%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\v64.hash
%TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\versiondescriptor.xml
%WINDIR%\temp\tar5f16.tmp
%TEMP%\v64_16.0.12527.22286checkreachable1845d132-02f4-4030-b25a-c3d9db22ffff
%WINDIR%\temp\tare179.tmp
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\versiondescriptor.xml
%TEMP%\i640checkreachable49884224-15e6-4a8c-9623-db9fba8eeea8
%TEMP%\officec2rb59647c5-0e5b-4c6b-a87f-571a58363ee2\i640.cab
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\office\otele\officeclicktorun.exe.db-journal
%LOCALAPPDATA%\microsoft\office\otele\officeclicktorun.exe.db-journal
%TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\v64_16.0.12527.22286.cab
%WINDIR%\temp\cab538b.tmp
%WINDIR%\temp\cabe199.tmp
%WINDIR%\temp\cabe469.tmp
%WINDIR%\temp\tare19a.tmp
%WINDIR%\temp\tarcbe.tmp
%WINDIR%\temp\cabcbd.tmp
%WINDIR%\temp\tarfbbb.tmp
%WINDIR%\temp\cabfbba.tmp
%WINDIR%\temp\tarfa72.tmp
%WINDIR%\temp\s643082checkreachableaaadbcd1-0d78-41fd-8ed3-984faa4f41ba
%WINDIR%\temp\cabfa71.tmp
%WINDIR%\temp\cabe178.tmp
%WINDIR%\temp\tare558.tmp
%WINDIR%\temp\cabe557.tmp
%WINDIR%\temp\tare537.tmp
%WINDIR%\temp\cabe536.tmp
%WINDIR%\temp\tare46a.tmp
%WINDIR%\temp\tarf725.tmp
%WINDIR%\temp\officec2r1d07584d-06a2-42ae-9143-dfea19a39c22\s643082.cab

Moves the following files

from %TEMP%\bit479a.tmp to %TEMP%\v64checkreachablefe0ef53d-35cb-4928-aec7-bbdf80e05998
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.tr-tr.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.tr-tr.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.th-th.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.th-th.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sv-se.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.sv-se.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sr-latn-rs.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.sr-latn-rs.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sl-si.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.sl-si.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.sk-sk.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.sk-sk.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ru-ru.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.ru-ru.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ro-ro.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.ro-ro.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.pt-pt.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.pt-pt.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.pt-br.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.pt-br.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.pl-pl.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.pl-pl.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.nl-nl.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.nl-nl.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.vi-vn.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.vi-vn.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.uk-ua.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.uk-ua.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.lv-lv.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.lv-lv.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.lt-lt.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.lt-lt.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ko-kr.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.ko-kr.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.kk-kz.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.kk-kz.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ja-jp.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.ja-jp.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.it-it.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.it-it.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.id-id.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.id-id.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.hu-hu.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.hu-hu.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.hr-hr.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.hr-hr.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.hi-in.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.hi-in.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.he-il.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.he-il.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.fr-fr.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.fr-fr.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.nb-no.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.nb-no.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-time-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-time-l1-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.zh-cn.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.zh-cn.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\vcruntime140.dll to %CommonProgramFiles%\microsoft shared\clicktorun\vcruntime140.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\vccorlib140.dll to %CommonProgramFiles%\microsoft shared\clicktorun\vccorlib140.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\ucrtbase.dll to %CommonProgramFiles%\microsoft shared\clicktorun\ucrtbase.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\subsystemcontroller.man to %CommonProgramFiles%\microsoft shared\clicktorun\subsystemcontroller.man
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\streamserver.dll to %CommonProgramFiles%\microsoft shared\clicktorun\streamserver.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\sharedperformance.man to %CommonProgramFiles%\microsoft shared\clicktorun\sharedperformance.man
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\servicewatcherschedule.xml to %CommonProgramFiles%\microsoft shared\clicktorun\servicewatcherschedule.xml
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\repoman.dll to %CommonProgramFiles%\microsoft shared\clicktorun\repoman.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\offreg.dll to %CommonProgramFiles%\microsoft shared\clicktorun\offreg.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\officeclicktorun.exe to %CommonProgramFiles%\microsoft shared\clicktorun\officeclicktorun.exe
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\officec2rcom.dll to %CommonProgramFiles%\microsoft shared\clicktorun\officec2rcom.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\officec2rclient.exe to %CommonProgramFiles%\microsoft shared\clicktorun\officec2rclient.exe
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msvcr120.dll to %CommonProgramFiles%\microsoft shared\clicktorun\msvcr120.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msvcp140.dll to %CommonProgramFiles%\microsoft shared\clicktorun\msvcp140.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msvcp120.dll to %CommonProgramFiles%\microsoft shared\clicktorun\msvcp120.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\msix.dll to %CommonProgramFiles%\microsoft shared\clicktorun\msix.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\mavinject32.exe to %CommonProgramFiles%\microsoft shared\clicktorun\mavinject32.exe
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\integratedoffice.exe to %CommonProgramFiles%\microsoft shared\clicktorun\integratedoffice.exe
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\inspectorofficegadget.exe to %CommonProgramFiles%\microsoft shared\clicktorun\inspectorofficegadget.exe
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\i640.hash to %CommonProgramFiles%\microsoft shared\clicktorun\i640.hash
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\i640.cab.cat to %CommonProgramFiles%\microsoft shared\clicktorun\i640.cab.cat
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\frequentofficeupdateschedule.xml to %CommonProgramFiles%\microsoft shared\clicktorun\frequentofficeupdateschedule.xml
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\cpprestsdk.dll to %CommonProgramFiles%\microsoft shared\clicktorun\cpprestsdk.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\concrt140.dll to %CommonProgramFiles%\microsoft shared\clicktorun\concrt140.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\clienteventlogmessages.man to %CommonProgramFiles%\microsoft shared\clicktorun\clienteventlogmessages.man
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\clientcapabilities.json to %CommonProgramFiles%\microsoft shared\clicktorun\clientcapabilities.json
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rui.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rui.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.fi-fi.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.fi-fi.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ms-my.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.ms-my.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.et-ee.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.et-ee.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.es-es.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.es-es.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.en-us.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.en-us.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-synch-l1-2-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-core-synch-l1-2-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-process-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-process-l1-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-private-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-private-l1-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-multibyte-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-multibyte-l1-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-math-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-math-l1-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-locale-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-locale-l1-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-heap-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-heap-l1-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-filesystem-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-filesystem-l1-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-environment-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-environment-l1-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-convert-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-convert-l1-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-conio-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-conio-l1-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-xstate-l2-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-core-xstate-l2-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-timezone-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-core-timezone-l1-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-processthreads-l1-1-1.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-core-processthreads-l1-1-1.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-stdio-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-stdio-l1-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-localization-l1-2-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-core-localization-l1-2-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-file-l2-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-core-file-l2-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-core-file-l1-2-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-core-file-l1-2-0.dll
from %TEMP%\officec2rb59647c5-0e5b-4c6b-a87f-571a58363ee2\bit5c86.tmp to %TEMP%\officec2rb59647c5-0e5b-4c6b-a87f-571a58363ee2\i640.cab
from %TEMP%\bit5aef.tmp to %TEMP%\i640checkreachable49884224-15e6-4a8c-9623-db9fba8eeea8
from %TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2aofficec2r81fb11cf-dbd5-4041-bb6b-28e000b6bba1\versiondescriptor.xml to %TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\versiondescriptor.xml
from %TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2aofficec2r81fb11cf-dbd5-4041-bb6b-28e000b6bba1\v64.hash to %TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\v64.hash
from %TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\bit5801.tmp to %TEMP%\officec2r47aa0cb7-c930-4507-9a0c-9fec80ebbc2a\v64_16.0.12527.22286.cab
from %TEMP%\bit55af.tmp to %TEMP%\v64_16.0.12527.22286checkreachable1845d132-02f4-4030-b25a-c3d9db22ffff
from %TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9officec2rd13640e6-294d-4436-8e03-014657aa2740\versiondescriptor.xml to %TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\versiondescriptor.xml
from %TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9officec2rd13640e6-294d-4436-8e03-014657aa2740\v64.hash to %TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\v64.hash
from %TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\bit497e.tmp to %TEMP%\officec2r8c179c78-708e-4370-ba55-aedca2790be9\v64.cab
from %WINDIR%\temp\bitd79f.tmp to %WINDIR%\temp\s643082checkreachableaaadbcd1-0d78-41fd-8ed3-984faa4f41ba
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.zh-tw.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.zh-tw.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-string-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-string-l1-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\apiclient.dll to %CommonProgramFiles%\microsoft shared\clicktorun\apiclient.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-runtime-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-runtime-l1-1-0.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.el-gr.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.el-gr.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.de-de.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.de-de.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.da-dk.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.da-dk.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.cs-cz.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.cs-cz.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.bg-bg.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.bg-bg.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rintl.ar-sa.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2rintl.ar-sa.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2rheartbeatconfig.xml to %CommonProgramFiles%\microsoft shared\clicktorun\c2rheartbeatconfig.xml
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2r64.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2r64.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\c2r32.dll to %CommonProgramFiles%\microsoft shared\clicktorun\c2r32.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvshnotify.exe to %CommonProgramFiles%\microsoft shared\clicktorun\appvshnotify.exe
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvscripting.dll to %CommonProgramFiles%\microsoft shared\clicktorun\appvscripting.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvpolicy.dll to %CommonProgramFiles%\microsoft shared\clicktorun\appvpolicy.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvorchestration.dll to %CommonProgramFiles%\microsoft shared\clicktorun\appvorchestration.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvmanifest.dll to %CommonProgramFiles%\microsoft shared\clicktorun\appvmanifest.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvvirtualization.dll to %CommonProgramFiles%\microsoft shared\clicktorun\appvisvvirtualization.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvsubsystems64.dll to %CommonProgramFiles%\microsoft shared\clicktorun\appvisvsubsystems64.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvsubsystems32.dll to %CommonProgramFiles%\microsoft shared\clicktorun\appvisvsubsystems32.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvsubsystemcontroller.dll to %CommonProgramFiles%\microsoft shared\clicktorun\appvisvsubsystemcontroller.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvstreamingmanager.dll to %CommonProgramFiles%\microsoft shared\clicktorun\appvisvstreamingmanager.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvisvapi.dll to %CommonProgramFiles%\microsoft shared\clicktorun\appvisvapi.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvintegration.dll to %CommonProgramFiles%\microsoft shared\clicktorun\appvintegration.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvfilesystemmetadata.dll to %CommonProgramFiles%\microsoft shared\clicktorun\appvfilesystemmetadata.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvclientisv.man to %CommonProgramFiles%\microsoft shared\clicktorun\appvclientisv.man
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvclient.man to %CommonProgramFiles%\microsoft shared\clicktorun\appvclient.man
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvcleaner.exe to %CommonProgramFiles%\microsoft shared\clicktorun\appvcleaner.exe
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\appvcatalog.dll to %CommonProgramFiles%\microsoft shared\clicktorun\appvcatalog.dll
from %CommonProgramFiles%\microsoft shared\clicktorunofficec2r06f46ba1-c476-40ff-bd38-0b2d4e4c9654\api-ms-win-crt-utility-l1-1-0.dll to %CommonProgramFiles%\microsoft shared\clicktorun\api-ms-win-crt-utility-l1-1-0.dll
from %WINDIR%\temp\officec2r1d07584d-06a2-42ae-9143-dfea19a39c22\bite353.tmp to %WINDIR%\temp\officec2r1d07584d-06a2-42ae-9143-dfea19a39c22\s643082.cab

Substitutes the following files

%TEMP%\office.validateresult.scratch
%TEMP%\office.validateerror.scratch
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\office\otele\officeclicktorun.exe.db-journal
%LOCALAPPDATA%\microsoft\office\otele\officeclicktorun.exe.db-journal

Network activity

Connects to

'ne#######s.officeapps.live.com':443
'ec#.#ffice.com':443
'mr########gr.officeapps.live.com':443
'officecdn.microsoft.com':80
'self.events.data.microsoft.com':443

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

Other

'ec#.#ffice.com':443
'ne#######s.officeapps.live.com':443
'mr########gr.officeapps.live.com':443
'self.events.data.microsoft.com':443

UDP

DNS ASK ne#######s.officeapps.live.com
DNS ASK ec#.#ffice.com
DNS ASK mr########gr.officeapps.live.com
DNS ASK officecdn.microsoft.com
DNS ASK self.events.data.microsoft.com
DNS ASK microsoft.com

Miscellaneous

Creates and executes the following

'%CommonProgramFiles%\microsoft shared\clicktorun\officeclicktorun.exe' platform=x64 culture=es-es productstoadd=AccessRuntimeRetail.16_es-es_x-none cdnbaseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl.16=http://officecdn.mic...
'%CommonProgramFiles%\microsoft shared\clicktorun\officeclicktorun.exe' /service
'%CommonProgramFiles%\microsoft shared\clicktorun\officec2rclient.exe' /progressandlaunch AppTargets="root\office16\msaccess.exe" ManualUpgrade=False ScenarioToTrack="Scenario:{FB9843BB-0D8A-4347-A227-C759C3FC9103}@INSTALL"
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath '%TEMP%\Offic...' (with hidden window)

Executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath '%TEMP%\Offic...

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial