Trojan.DownLoader32.51594

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\onenote 2010 screen clipper and launcher.lnk

Modifies file system

Creates the following files

%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache.onecache
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\81394918-8a99-476a-9266-02ba17c7df28
%TEMP%\{5a411df5-b487-4ac7-a940-64940fc773cd}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a48755df-bbbf-419a-8f7a-f7d4a90fc7c8
%TEMP%\{74e63cad-7f3d-4035-aea7-f8784b53c0b6}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\929e150d-edbb-4955-8241-e73c106ece2b
%TEMP%\{0acbd2fb-3827-4802-a45b-c56fb551d8e3}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\91faa498-2181-4423-acb2-caa6743784da
%TEMP%\{dca5a480-a9a8-451c-9b73-73f12ca0fb4c}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\db3a2286-2f0f-4726-bf26-fc9e2c98f883
%TEMP%\{183a6c5c-53cb-4fa7-96b4-6e7764325daf}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\708e5f5e-7919-4259-8092-e1a41acc2305
%TEMP%\{a54d7a71-6b90-4cfb-9c55-5fa1225da490}
%TEMP%\{5fe68385-11b3-4186-bb60-b85ce05a3fac}
%TEMP%\{11843067-8a47-41c4-94ef-f75226d404e6}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\589552e4-8cbd-4c4c-8273-c6b824bc0b71
%TEMP%\{4fd7caf9-bd76-4fba-9b15-f84364477aed}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\92b1cffb-98bd-489d-85a9-ddc13f5d8369
%TEMP%\{162abc80-9758-4f51-8323-56005efd3f1f}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\704246ff-2a5b-4ba0-a88e-4af01c8d0bb2
%TEMP%\{5867cbec-ecc2-43fc-affe-168971077439}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0dde7a88-a5c2-41d6-b34c-e1d9b728cf37
%TEMP%\{d3c5cd41-ad79-468d-8e22-3ea368206fc9}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\b24cf439-e390-48ff-bdc7-91409db805e3
%TEMP%\{a824c323-e235-478b-b20b-2e8572cdd78a}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\46cf9adc-e6bd-46d1-845f-9c46d317ddec
%TEMP%\{61a36bbf-f739-43f1-a7db-2b2be50783f4}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\adf7e214-49f4-4c55-a2d7-8164c13e6e35
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\06eecbf9-58f1-49d7-82dd-28980b9a6892
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\8bbb5859-417d-4fce-93a7-8e5bb437f475
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\3c756f12-2366-4b0f-afd5-251f64e2b9f9
%TEMP%\{b082e3b6-5f22-4665-8c43-87bc177fff38}
%TEMP%\{0f76cd37-ac48-4f83-88b9-571594c8e4a3}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\c84b9bff-ea49-489d-825d-7959da69a3e1
%TEMP%\{2d540fb6-0dff-45f4-8734-d1a017cec6c1}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\4c20f1ad-9db3-4a48-9712-e80be71c5d6c
%TEMP%\{53218405-522d-41f8-bed0-91382e448a68}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\2c0d8e04-f798-42d3-b3fe-b69d8830e1ca
%TEMP%\{8b5965ec-7a3a-4151-8409-ba7ac8fca0ae}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\cefe7fa9-a52e-4f49-92ee-62ec313eb376
%TEMP%\{39513277-3a50-4b69-a095-e4cfb9423ede}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\1f5b048b-460f-40ea-9a03-eb303ea49bc0
%TEMP%\{e116411e-c8f9-4196-8753-2a43c653e00e}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\cd5b7d3b-f3b3-4e4a-a5b9-5bcf1f7525fe
%TEMP%\{a1c85a3a-8e02-42bd-8e7d-3af5045f43f7}
%TEMP%\{ce49d6d8-ee9e-49d3-b80b-0622618eb0ff}
%TEMP%\{c6a7fc50-35f3-44c4-8e8c-3aad32df34ae}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\4788bb55-4d53-48fe-a624-32718407c800
%TEMP%\{fe919ce8-e22a-4196-9940-bc6d88d68c18}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\4d583135-0540-4594-88f6-18029335c6db
%TEMP%\{34a2b46e-d3d5-4eac-b1f9-4d71125615cb}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\fa8e557d-435d-46e9-8558-35092df34325
%TEMP%\{de98669f-4c70-4839-a77b-16ee40f502cd}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\072835f6-feb1-45f8-8d70-b1a8d9401029
%TEMP%\{b7d01d80-a95d-480d-ba3d-cd540a5ca315}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\889b10ec-9363-4c82-8e44-c0c294347b64
%TEMP%\{e8d3ed0e-78e5-418b-abe8-10729263cf42}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\61c58293-8c07-4e0e-aceb-cd73c01098ad
%TEMP%\{e530f1af-abac-4e79-acc3-f21d334432e1}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\2b830d01-9946-49ad-9255-6ee877aba6c9
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\8c0c9dc3-6580-45ed-a92e-34f3de617928
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\78e53d00-7097-45be-a724-8c2c45ca5a4f
%TEMP%\{5ea9488c-df58-46f9-8e03-5ef26516b8b5}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\996131da-4d4a-4279-b667-9d551c285607
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\c017fc3f-562f-4b66-8c2e-6c88f3a9c989
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\fc89d2cd-4599-42e6-8d1b-4fd880723fb4
%TEMP%\{ad642cd7-a848-4e19-bb7c-a26cfbd5394b}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0ba9d8e0-32de-4c22-bd2a-0680e01a43fc
%TEMP%\{3e392894-cbbc-45b1-8fc0-65d72ab38b04}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d78126b5-4f59-4ed5-ae3f-77e46f8c9167
%TEMP%\{6121274c-8368-46ff-b46d-ec3668ad32de}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\c4486040-c610-4618-b3a5-66ceac92b39c
%TEMP%\{70dfe460-25d3-42f9-a066-f6d7464cecb8}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\33677f2e-1ba5-4f80-975f-af0626e0b56d
%TEMP%\{18e37e74-e080-49c1-9f95-cc91e43a162e}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\10ca911c-7fc2-4ed5-9965-88f551ff7fde
%TEMP%\{542c91e0-5032-48fc-91ce-8a799561037d}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\61f61813-12bf-428e-a621-7547de2caf46
%TEMP%\{8e2f8ebc-b2e1-4402-9abc-da06cf0a2fa6}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\9f30b316-a69f-4bc5-8a08-950c25e91ac9
%TEMP%\{3322ddaf-b63a-4e96-a917-b3bc518b0945}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\6f62a19f-e332-4aae-9d39-f6f291597a90
%TEMP%\{6cda31ea-4e28-4f4d-bd62-4508e117f3ad}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0b5020d3-7b17-4f8e-8367-556132218efc
%TEMP%\{e6b11988-b13a-4e50-8bf6-381ebe7d47ca}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\9db21fdf-6d31-44cc-affb-0600a2d3fe02
%TEMP%\{b4d2eefc-7469-4212-9789-7597ade4231c}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\70501987-d6a0-453a-a50c-0d28efe21a26
%TEMP%\{20f24637-2c06-44c8-b686-d4f15a4845c4}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\9dc38c4c-5874-4997-870c-66e7bc0322c2
%TEMP%\{a09c4165-6bce-4ccf-a91c-c415385f614f}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\e3a059f1-fc38-477d-aa3e-5b13470c44f1
%TEMP%\{2a547504-8ed5-402c-abfa-7bd528933512}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\24bd032f-9799-4b6b-a717-83aaca91bbf7
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\6dc6ea9d-e309-4d96-af86-75be16a9fa9c
%TEMP%\{7ba9954e-23ae-4b46-927b-8030f480be0a}
%TEMP%\{b1232549-bff5-4dfb-9da8-8adeff208a2a}
%TEMP%\{a5d3f720-0e5b-4ffd-b70a-12e78a579d77}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\475651f1-b0b3-4cee-a1ad-7c686301e2cf
%TEMP%\{4d710095-39a5-4e3c-87aa-546aa8938f3c}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\4ce0a476-ccff-4b8a-8bbf-2167040d2665
%TEMP%\{bd242160-a8d0-45aa-9825-d00ad37e2fcc}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\afa26fb4-daf5-4c05-a2ac-4f11f0c7f016
%TEMP%\{907d5e87-8906-47bc-ae48-9f2fb2ceb27e}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\02c14a7a-abed-4a36-907f-cf06fb6278c2
%TEMP%\{66971620-3e1d-4f4f-8b98-622d28cd2ef6}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d6d824da-a504-4fe7-940e-a2455e09b5d9
%TEMP%\{c51b4cab-b267-4bdf-a1aa-7ea1e16a1240}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\95e370c8-60e6-4fab-9ebd-a61cdb84935a
%TEMP%\{a207df4b-291b-4b30-a9d9-6e83ebbd8ac6}
%TEMP%\{b45e3398-f97f-4ff6-8417-9121c41b761a}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\bd20a4ed-ddb1-4025-bca5-25853ec3830e
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\2147f109-1c62-4e69-b80a-c2123d58b00c
%TEMP%\{e11bed64-17ba-41ed-838b-147ec1ff91a7}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\af222283-52f9-43f3-a866-7916bb59e5c0
%TEMP%\{ab4a424d-0bc0-4888-afce-86788f711c0f}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\67a8d4d1-9cdf-4e7e-9cc6-e2522c42c112
%TEMP%\{23493837-09b7-4d5c-b8ea-cf2cf3ec6683}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\5273e1fd-51c0-4978-b06f-b2d159de7a3e
%TEMP%\{2ad6a747-e835-4129-b64b-abb8ef060686}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a3704fa2-8762-46eb-bb24-97a269f2ed03
%TEMP%\{30665461-9beb-4609-a2fa-7206d1d9a7e8}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\3155d78c-1584-4dec-9449-314a3d550d29
%TEMP%\{b419b0ef-4957-4646-9cf9-ad930dae1a98}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\81d4fff9-3a82-43ac-80e6-41fcea4509cd
%TEMP%\{c85d9b81-522b-4bef-8beb-170328d2b1b6}
%TEMP%\{39089761-304f-48cf-b749-13d186de732b}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\cb7dd0d6-b3c8-43cd-a74e-1016d2abe1de
%TEMP%\{7ecfabfa-d981-4932-bc85-0af503ac22b8}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\bdde27ea-6a12-4825-bfac-f600b0f142fa.png
%TEMP%\{62356a81-c30f-40fc-a43b-9b5289c1e64a}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0ec91619-5478-4e5c-aa1b-8da00a066091.png
%TEMP%\{4d80319f-3bb7-4023-bfd0-13c62a155cb1}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\2d02d28e-c843-42a7-ba9c-3541f1bd4e3a.png
%TEMP%\{7e711976-3189-4e11-9e65-cd7a1423843f}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\5318eba9-773d-4fec-9366-6e84f8dfbbc5.png
%TEMP%\{8214c4d0-ff1c-4122-b0a2-deebb54021c5}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d2a0e881-e736-4694-b4e5-62a677ac17bf.png
%TEMP%\{b8b29091-3319-4795-a19b-85c791f369c3}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\6d6e34b9-0e90-470c-ada3-2b00b4b8ffac.png
%TEMP%\{1028930e-eabc-4cf1-aeb9-abcc0a714a62}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\4f92e887-7fef-4a98-9f74-501f37835639.png
%TEMP%\{d6986eb8-4277-4ba9-8f36-074aa619f097}
%TEMP%\{4e15c13f-e329-4e3a-96d3-ed6c887f1f08}
%TEMP%\{d4ae37c2-7f29-4212-a856-77dba16ef5d8}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a4fbc2bf-8cc2-4a6d-b3c7-0ef749399e7f.png
%TEMP%\{e20a5529-1ba4-46dc-a216-6d91d707a494}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\52c39d7c-6d6b-4ad3-b5e5-c417949d335d.png
%TEMP%\{c4ff960f-822b-47a1-aa18-553ab6133a16}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\ee4479ee-b960-4d54-abc8-c9e95e2bf81f.png
%TEMP%\{58722d78-2798-409e-b3f5-5c87a9f485e3}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\3c6a9801-329c-4eba-9524-2165ac426bef.png
%TEMP%\{455e3893-e216-42fe-9cc5-9ebf1eb7878d}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\07a5080e-becd-4719-9a79-fe50b59eb55b.png
%TEMP%\{0f4d7849-66fe-4555-b56b-9d9fa1f86808}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0ff838eb-89b4-4a2f-881a-6e583195d26c.png
%TEMP%\{246a24ff-c6ab-4cc5-9796-befed1fd5a41}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\70c3a864-35fa-4245-802a-dbda1e3f4c00.png
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a4f6c176-53e1-47b9-8fe4-8bb920684ff3.png
%TEMP%\{eae49ced-b4ed-4eda-8827-26a3c71ee8d0}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\e29a7eaf-32ad-400c-9927-05c358358ffc.png
%HOMEPATH%\documents\onenote notebooks\personal\open notebook.onetoc2
%HOMEPATH%\documents\onenote notebooks\personal\general.one
%TEMP%\onenoteruntimecache\14.0\onenoteruntimecache.onecache
%TEMP%\{af864079-86a7-4e44-beca-edd972a5b766}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\b2a67a4a-c116-4c88-9fd1-c5b9a23d7929.png
%TEMP%\{55a0ebb7-46fa-4d74-ae94-ea71af702437}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\03809a07-348b-48cc-b08d-f7b8472c133c.png
%TEMP%\{37efc097-eddf-4ea4-b9fe-cfba5da1bc00}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a507cd65-0038-49e4-8cdb-b6082f566351.png
%TEMP%\{89fe4aac-b224-44b3-b468-8836d2d9f451}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\7dceec06-0991-43f4-8af3-601c0ebeb910.png
%TEMP%\{a01bd437-efa0-4a21-96d0-b08d2de3a289}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\bf4e96cf-9460-4049-8172-cfb4bec57f8e.png
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\b1503304-9b12-4d90-89e7-df30e304e6c2.png
%TEMP%\onenote_migrationlog.txt
%TEMP%\{41cfe817-c654-4048-b04d-ac7a384e1161}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\bb4e150b-7e2a-4556-81dd-590d7ab07dda.png
%TEMP%\{fd180fda-30be-442b-a7b1-9d5a74c218c5}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\1e81fb27-0aa3-4b11-a764-0d9e7e3272ea.png
%TEMP%\{3a806f99-4905-4763-b263-4f61502b0bd7}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\62e3dfa2-4350-445b-8693-d1d04a74543c.png
%TEMP%\{443e73e2-15c5-4843-8375-9fb6932f6be5}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d137f4ab-4b3d-439e-836f-ffbbc700bef1.png
%TEMP%\{d78fb226-2367-4a3b-8455-ca561159daf9}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\e5116f77-b907-4c46-8bfa-006092a6714d.png
%TEMP%\{097393bd-dd69-44c0-90ce-b2d25672095c}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a9e6bb3f-0b62-4410-86f7-68bb36989df7.png
%TEMP%\{86807913-b067-44ee-b350-464d33846486}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\e51cf594-e321-4d1c-88e7-df9cde80904c.png
%TEMP%\{faab43b0-f460-4e8e-ad88-5dcddf1d81f1}
%TEMP%\{75ceca75-bbe2-4650-8eed-cf932b66f5e6}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d13b95bf-2bb1-4c3d-a85c-9ac5e1cb3884.png
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\6a8b0e06-e9a5-4761-afda-29391149e64d.png
%TEMP%\{415bb480-fa39-4d3c-8ced-34867637528d}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\42a4aea1-ab77-4cf7-a3cb-14953248ceea.png
%TEMP%\{680aa834-4583-4891-a820-6eec5a5c853f}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d024a53a-b32a-417d-8f75-e1998be423af.png
%APPDATA%\microsoft\onenote\14.0\preferences.dat
%TEMP%\{6901e7ad-1318-4d7d-95bb-51489ac51410}
%HOMEPATH%\documents\onenote notebooks\personal\unfiled notes.one
%TEMP%\{06103076-2cfa-4f52-9988-57c286efcc96}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d8c634d0-56f4-4f38-8b3c-8f21b0f6989c
%TEMP%\{a38ae82d-d3d3-413c-8842-a46bcdb47f9f}
%TEMP%\{0e9c18a1-7f91-477f-86ca-906315e2c20b}
%TEMP%\{1100ce34-0ca4-4b60-8366-691a2f37bedc}
%TEMP%\{d7a61fbe-912e-4877-89e8-b3fe6914ae89}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\1bf85fd8-2752-4457-88c6-58e635274be9
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\c74af4e7-e369-4bf8-9a79-9752f94d43cf
%TEMP%\{4368b626-a85a-45b1-af8f-4ef58ced1307}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\8b399897-1cdd-4622-8d42-0218b5374e30
%TEMP%\{3b8d8d84-77cc-45c4-8ed7-202b30cc62a5}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\6f0d52f9-b478-4adc-9f25-e3a894df2df4
%TEMP%\{b28f9056-750c-4c9a-8b36-d91cf15fb6ad}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a38314c2-1c90-4034-8095-42260e20eb20
%TEMP%\{4f8ac4a8-fecb-4d5f-9eea-c51670ed1c88}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\8fc790b8-6f88-4e18-99e0-1eaa9b021fe2
%TEMP%\{89a3ec77-7924-4448-826b-e6c6ce35043a}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\7d014bed-5d20-470d-9655-bcf9c82d04f6
%TEMP%\{9f7899b7-41c3-41f7-8813-9fffe0efadce}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\080158a4-05b2-4392-9dd9-be70cc27d215
%TEMP%\{14a03147-81c6-4d15-99df-2c9a3e5d59e1}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0d984a6a-e70e-4747-bded-b92173e85c21.png
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\115556d6-ba8b-4b18-8439-8e9c81ff63a4.png
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\c129b038-2a0f-4994-b354-64ed233a0973.png
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\1a16981c-377d-4a10-9522-787f93302c18.png
%TEMP%\{61aa5b86-e4ef-431c-ab65-54a426a3fc91}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\70d1f452-966e-4e28-8da5-8b2eeadbe078.png
%TEMP%\{5890cc11-6cdc-4d71-ad16-24c77e1f7d02}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\3506c6f4-6090-46ec-9fb3-0e2963361ba0.png
%TEMP%\{46e27680-e5b9-4ec6-aaae-aeb767e031e1}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\8339d228-5ca6-486f-8793-633aa6af18d8.png
%TEMP%\{6662b662-d68a-4f6a-b3c8-50a06aabdd41}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d32a2c63-e181-4374-a527-d8ec3791e0cc.png
%TEMP%\{830c114e-b2a9-4596-8a3e-05cde181fa9f}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\7b168dd1-e39e-4b39-918c-53b9e78365e9.png
%TEMP%\{8c203a54-264c-4353-a370-52558fd81dee}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\072143f8-573f-45cb-b0b1-04f7bf2da18e.png
%TEMP%\{822137bd-d471-42ad-99e5-2b112b14200b}
%TEMP%\{f119e495-8061-4aa5-a502-bd904e1af2c8}
%TEMP%\{8123c784-4d70-449a-89c2-a14772ae7e30}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\e7a7c0d5-0e34-4323-9576-f37e394faa8a.png
%TEMP%\{ff8526d7-98a4-4790-8849-3c9b7224b1d0}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\79a073b8-0713-4166-af23-3272c394a92a.png
%TEMP%\{b788c9bf-5c1e-4b81-9153-56a1908cffe2}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a6f0f9a9-e50d-4612-9e8e-f5640793680c.png
%TEMP%\{575b89c5-3ace-4266-9f15-6b33a4c96c52}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d6f82e07-6756-4003-877a-af43e54f9781.png
%TEMP%\{ac219f51-f676-4e38-95d4-f6046a9072c0}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\be1e893c-ed6d-4ac9-933e-dd5340e7c76f.png
%TEMP%\{f776d6e5-48d2-4031-a589-1b2543cb9c45}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\f173a3a2-bd1a-460f-b78a-faf2a51f6d91.png
%TEMP%\{a925ee6f-d48d-4eb7-baee-bde63fbe4cdf}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\5394c05d-dc33-4d24-bd45-2d8954648f28.png
%TEMP%\{413febaf-dc51-44a9-8a28-cee88bf0c07e}
%APPDATA%\microsoft\templates\open notebook.onetoc2

Deletes the following files

%TEMP%\{6901e7ad-1318-4d7d-95bb-51489ac51410}
%TEMP%\{a824c323-e235-478b-b20b-2e8572cdd78a}
%TEMP%\{d3c5cd41-ad79-468d-8e22-3ea368206fc9}
%TEMP%\{5867cbec-ecc2-43fc-affe-168971077439}
%TEMP%\{162abc80-9758-4f51-8323-56005efd3f1f}
%TEMP%\{4fd7caf9-bd76-4fba-9b15-f84364477aed}
%TEMP%\{b082e3b6-5f22-4665-8c43-87bc177fff38}
%TEMP%\{a54d7a71-6b90-4cfb-9c55-5fa1225da490}
%TEMP%\{183a6c5c-53cb-4fa7-96b4-6e7764325daf}
%TEMP%\{dca5a480-a9a8-451c-9b73-73f12ca0fb4c}
%TEMP%\{0acbd2fb-3827-4802-a45b-c56fb551d8e3}
%TEMP%\{74e63cad-7f3d-4035-aea7-f8784b53c0b6}
%TEMP%\{5a411df5-b487-4ac7-a940-64940fc773cd}
%TEMP%\{11843067-8a47-41c4-94ef-f75226d404e6}
%TEMP%\{c6a7fc50-35f3-44c4-8e8c-3aad32df34ae}
%TEMP%\{ce49d6d8-ee9e-49d3-b80b-0622618eb0ff}
%TEMP%\{e530f1af-abac-4e79-acc3-f21d334432e1}
%TEMP%\{e8d3ed0e-78e5-418b-abe8-10729263cf42}
%TEMP%\{b7d01d80-a95d-480d-ba3d-cd540a5ca315}
%TEMP%\{de98669f-4c70-4839-a77b-16ee40f502cd}
%TEMP%\{34a2b46e-d3d5-4eac-b1f9-4d71125615cb}
%TEMP%\{fe919ce8-e22a-4196-9940-bc6d88d68c18}
%TEMP%\{0f76cd37-ac48-4f83-88b9-571594c8e4a3}
%TEMP%\{a1c85a3a-8e02-42bd-8e7d-3af5045f43f7}
%TEMP%\{e116411e-c8f9-4196-8753-2a43c653e00e}
%TEMP%\{39513277-3a50-4b69-a095-e4cfb9423ede}
%TEMP%\{8b5965ec-7a3a-4151-8409-ba7ac8fca0ae}
%TEMP%\{53218405-522d-41f8-bed0-91382e448a68}
%TEMP%\{61a36bbf-f739-43f1-a7db-2b2be50783f4}
%TEMP%\{5fe68385-11b3-4186-bb60-b85ce05a3fac}
%TEMP%\{7ba9954e-23ae-4b46-927b-8030f480be0a}
%TEMP%\{a207df4b-291b-4b30-a9d9-6e83ebbd8ac6}
%TEMP%\{20f24637-2c06-44c8-b686-d4f15a4845c4}
%TEMP%\{b4d2eefc-7469-4212-9789-7597ade4231c}
%TEMP%\{e6b11988-b13a-4e50-8bf6-381ebe7d47ca}
%TEMP%\{6cda31ea-4e28-4f4d-bd62-4508e117f3ad}
%TEMP%\{3322ddaf-b63a-4e96-a917-b3bc518b0945}
%TEMP%\{2a547504-8ed5-402c-abfa-7bd528933512}
%TEMP%\{542c91e0-5032-48fc-91ce-8a799561037d}
%TEMP%\{18e37e74-e080-49c1-9f95-cc91e43a162e}
%TEMP%\{70dfe460-25d3-42f9-a066-f6d7464cecb8}
%TEMP%\{6121274c-8368-46ff-b46d-ec3668ad32de}
%TEMP%\{3e392894-cbbc-45b1-8fc0-65d72ab38b04}
%TEMP%\{ad642cd7-a848-4e19-bb7c-a26cfbd5394b}
%TEMP%\{8e2f8ebc-b2e1-4402-9abc-da06cf0a2fa6}
%TEMP%\{b1232549-bff5-4dfb-9da8-8adeff208a2a}
%TEMP%\{b45e3398-f97f-4ff6-8417-9121c41b761a}
%TEMP%\{30665461-9beb-4609-a2fa-7206d1d9a7e8}
%TEMP%\{2ad6a747-e835-4129-b64b-abb8ef060686}
%TEMP%\{23493837-09b7-4d5c-b8ea-cf2cf3ec6683}
%TEMP%\{ab4a424d-0bc0-4888-afce-86788f711c0f}
%TEMP%\{e11bed64-17ba-41ed-838b-147ec1ff91a7}
%TEMP%\{c85d9b81-522b-4bef-8beb-170328d2b1b6}
%TEMP%\{b419b0ef-4957-4646-9cf9-ad930dae1a98}
%TEMP%\{c51b4cab-b267-4bdf-a1aa-7ea1e16a1240}
%TEMP%\{66971620-3e1d-4f4f-8b98-622d28cd2ef6}
%TEMP%\{907d5e87-8906-47bc-ae48-9f2fb2ceb27e}
%TEMP%\{bd242160-a8d0-45aa-9825-d00ad37e2fcc}
%TEMP%\{4d710095-39a5-4e3c-87aa-546aa8938f3c}
%TEMP%\{a5d3f720-0e5b-4ffd-b70a-12e78a579d77}
%TEMP%\{a09c4165-6bce-4ccf-a91c-c415385f614f}
%TEMP%\{2d540fb6-0dff-45f4-8734-d1a017cec6c1}
%TEMP%\{5ea9488c-df58-46f9-8e03-5ef26516b8b5}
%TEMP%\{39089761-304f-48cf-b749-13d186de732b}
%TEMP%\{ac219f51-f676-4e38-95d4-f6046a9072c0}
%TEMP%\{575b89c5-3ace-4266-9f15-6b33a4c96c52}
%TEMP%\{b788c9bf-5c1e-4b81-9153-56a1908cffe2}
%TEMP%\{ff8526d7-98a4-4790-8849-3c9b7224b1d0}
%TEMP%\{8123c784-4d70-449a-89c2-a14772ae7e30}
%TEMP%\{f119e495-8061-4aa5-a502-bd904e1af2c8}
%TEMP%\{8c203a54-264c-4353-a370-52558fd81dee}
%TEMP%\{830c114e-b2a9-4596-8a3e-05cde181fa9f}
%TEMP%\{6662b662-d68a-4f6a-b3c8-50a06aabdd41}
%TEMP%\{46e27680-e5b9-4ec6-aaae-aeb767e031e1}
%TEMP%\{5890cc11-6cdc-4d71-ad16-24c77e1f7d02}
%TEMP%\{61aa5b86-e4ef-431c-ab65-54a426a3fc91}
%TEMP%\{822137bd-d471-42ad-99e5-2b112b14200b}
%TEMP%\{75ceca75-bbe2-4650-8eed-cf932b66f5e6}
%TEMP%\{d6986eb8-4277-4ba9-8f36-074aa619f097}
%TEMP%\{0f4d7849-66fe-4555-b56b-9d9fa1f86808}
%TEMP%\{455e3893-e216-42fe-9cc5-9ebf1eb7878d}
%TEMP%\{58722d78-2798-409e-b3f5-5c87a9f485e3}
%TEMP%\{c4ff960f-822b-47a1-aa18-553ab6133a16}
%TEMP%\{e20a5529-1ba4-46dc-a216-6d91d707a494}
%TEMP%\{d4ae37c2-7f29-4212-a856-77dba16ef5d8}
%TEMP%\{246a24ff-c6ab-4cc5-9796-befed1fd5a41}
%TEMP%\{1028930e-eabc-4cf1-aeb9-abcc0a714a62}
%TEMP%\{b8b29091-3319-4795-a19b-85c791f369c3}
%TEMP%\{8214c4d0-ff1c-4122-b0a2-deebb54021c5}
%TEMP%\{7e711976-3189-4e11-9e65-cd7a1423843f}
%TEMP%\{4d80319f-3bb7-4023-bfd0-13c62a155cb1}
%TEMP%\{f776d6e5-48d2-4031-a589-1b2543cb9c45}
%TEMP%\{a925ee6f-d48d-4eb7-baee-bde63fbe4cdf}
%TEMP%\{1100ce34-0ca4-4b60-8366-691a2f37bedc}
%TEMP%\{0e9c18a1-7f91-477f-86ca-906315e2c20b}
%TEMP%\{89a3ec77-7924-4448-826b-e6c6ce35043a}
%TEMP%\{4f8ac4a8-fecb-4d5f-9eea-c51670ed1c88}
%TEMP%\{b28f9056-750c-4c9a-8b36-d91cf15fb6ad}
%TEMP%\{3b8d8d84-77cc-45c4-8ed7-202b30cc62a5}
%TEMP%\{4368b626-a85a-45b1-af8f-4ef58ced1307}
%TEMP%\{14a03147-81c6-4d15-99df-2c9a3e5d59e1}
%TEMP%\{9f7899b7-41c3-41f7-8813-9fffe0efadce}
%TEMP%\{a38ae82d-d3d3-413c-8842-a46bcdb47f9f}
%TEMP%\{06103076-2cfa-4f52-9988-57c286efcc96}
%TEMP%\{3a806f99-4905-4763-b263-4f61502b0bd7}
%TEMP%\{fd180fda-30be-442b-a7b1-9d5a74c218c5}
%TEMP%\{41cfe817-c654-4048-b04d-ac7a384e1161}
%TEMP%\{86807913-b067-44ee-b350-464d33846486}
%TEMP%\{89fe4aac-b224-44b3-b468-8836d2d9f451}
%TEMP%\{a01bd437-efa0-4a21-96d0-b08d2de3a289}
%TEMP%\{37efc097-eddf-4ea4-b9fe-cfba5da1bc00}
%TEMP%\{55a0ebb7-46fa-4d74-ae94-ea71af702437}
%TEMP%\{af864079-86a7-4e44-beca-edd972a5b766}
%TEMP%\{62356a81-c30f-40fc-a43b-9b5289c1e64a}
%TEMP%\{faab43b0-f460-4e8e-ad88-5dcddf1d81f1}
%TEMP%\{4e15c13f-e329-4e3a-96d3-ed6c887f1f08}
%TEMP%\{eae49ced-b4ed-4eda-8827-26a3c71ee8d0}
%TEMP%\{097393bd-dd69-44c0-90ce-b2d25672095c}
%TEMP%\{d78fb226-2367-4a3b-8455-ca561159daf9}
%TEMP%\{443e73e2-15c5-4843-8375-9fb6932f6be5}
%TEMP%\{680aa834-4583-4891-a820-6eec5a5c853f}
%TEMP%\{415bb480-fa39-4d3c-8ced-34867637528d}
%TEMP%\{d7a61fbe-912e-4877-89e8-b3fe6914ae89}
%TEMP%\{7ecfabfa-d981-4932-bc85-0af503ac22b8}
%TEMP%\{413febaf-dc51-44a9-8a28-cee88bf0c07e}

Network activity

Connects to

'public-trust.com':80

TCP

HTTP GET requests

http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D

'do##.live.net':443

UDP

DNS ASK do##.live.net
DNS ASK oc##.thawte.com
DNS ASK public-trust.com

Miscellaneous

Searches for the following windows

ClassName: 'Onetastic Window' WindowName: 'Onetastic'
ClassName: '' WindowName: 'TF_FloatingLangBar_WndTitle'
ClassName: 'NetUICtrlNotifySink' WindowName: ''
ClassName: 'REListbox20W' WindowName: ''
ClassName: 'OfficeTooltip' WindowName: ''
ClassName: 'MsoCommandBarPopup' WindowName: ''

Executes the following

'%ProgramFiles%\Microsoft Office\Office14\ONENOTE.EXE' Analysis Services\Office14\ONENOTE.EXE -Embedding
'%ProgramFiles%\microsoft office\office14\onenotem.exe'

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial