Exploit.Siggen.28855

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\onenote 2010 screen clipper and launcher.lnk

Malicious functions

Executes the following (exploit)

'%ProgramFiles%\microsoft office\office14\onenote.exe' "%TEMP%\A9Rdr1ml9_1t8usw9_1zk.tmp\page.one"

Modifies file system

Creates the following files

%TEMP%\a9rdr1ml9_1t8usw9_1zk.tmp\page.one
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\589552e4-8cbd-4c4c-8273-c6b824bc0b71
%TEMP%\{5aebe856-b3a1-42c1-a83f-bab3e5c3cabc}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\81394918-8a99-476a-9266-02ba17c7df28
%TEMP%\{cf85ce0b-9f61-42ad-bf76-72424e423a2a}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\a48755df-bbbf-419a-8f7a-f7d4a90fc7c8
%TEMP%\{559905e7-5556-46e2-8baf-8e7968670b6d}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\929e150d-edbb-4955-8241-e73c106ece2b
%TEMP%\{6442ab89-3c48-4146-9fd5-19ae87819a50}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\91faa498-2181-4423-acb2-caa6743784da
%TEMP%\{abff11dc-247f-462f-be83-6e7742075a1a}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\db3a2286-2f0f-4726-bf26-fc9e2c98f883
%TEMP%\{7093f7cd-180f-436b-84a4-da829aa1a551}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\708e5f5e-7919-4259-8092-e1a41acc2305
%TEMP%\{d896fe47-c082-4d7c-8ae5-603eecab05e7}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\06eecbf9-58f1-49d7-82dd-28980b9a6892
%TEMP%\{b29098c7-de0e-4d0a-80d1-13871c57956f}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\8bbb5859-417d-4fce-93a7-8e5bb437f475
%TEMP%\{e1d23d26-1746-4466-aa6a-690a0707dacd}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\92b1cffb-98bd-489d-85a9-ddc13f5d8369
%TEMP%\{70d0e757-a06b-4bed-9fda-27a840aa3cfe}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\704246ff-2a5b-4ba0-a88e-4af01c8d0bb2
%TEMP%\{2432a9e3-af9e-432a-8650-d52795492956}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\0dde7a88-a5c2-41d6-b34c-e1d9b728cf37
%TEMP%\{96222fcb-55e4-420b-99e0-33e2ff78437c}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\b24cf439-e390-48ff-bdc7-91409db805e3
%TEMP%\{8a72f1a1-7867-4a86-b8b1-0fab4250396e}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\46cf9adc-e6bd-46d1-845f-9c46d317ddec
%TEMP%\{1f00061e-c9f4-464d-acba-671c9a974d37}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\adf7e214-49f4-4c55-a2d7-8164c13e6e35
%TEMP%\{4682ce43-bed5-4ed5-b445-ed7bdceb6b2e}
%TEMP%\{339f6780-c162-4cc6-8f18-87366b27d12c}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\4788bb55-4d53-48fe-a624-32718407c800
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\2b830d01-9946-49ad-9255-6ee877aba6c9
%TEMP%\{f5fcf8b5-90e7-4ad1-9d80-7a2d5c910644}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\3c756f12-2366-4b0f-afd5-251f64e2b9f9
%TEMP%\{fc494751-eff9-46ec-ada2-b07bf20685aa}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\c84b9bff-ea49-489d-825d-7959da69a3e1
%TEMP%\{bb93956b-6c37-4e95-a3e7-e6fc380899bf}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\4c20f1ad-9db3-4a48-9712-e80be71c5d6c
%TEMP%\{5fc4d192-810b-42d2-96e1-acb8aa1158c9}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\2c0d8e04-f798-42d3-b3fe-b69d8830e1ca
%TEMP%\{279bb9fb-5e01-4bc8-a194-a48d85239a99}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\cefe7fa9-a52e-4f49-92ee-62ec313eb376
%TEMP%\{2c7bff3b-99e5-4644-97b9-77467fa1c89c}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\1f5b048b-460f-40ea-9a03-eb303ea49bc0
%TEMP%\{fa1d2089-9296-4e92-941c-266fd54b7b4e}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\cd5b7d3b-f3b3-4e4a-a5b9-5bcf1f7525fe
%TEMP%\{03cf8eae-974c-4e79-bb59-d31731dad8d1}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\8c0c9dc3-6580-45ed-a92e-34f3de617928
%TEMP%\{a274c1f0-89a6-4f9a-a8e0-510937a5ab3e}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\78e53d00-7097-45be-a724-8c2c45ca5a4f
%TEMP%\{d2ca055f-63b3-4d20-a123-75b48e079e75}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\4d583135-0540-4594-88f6-18029335c6db
%TEMP%\{2167d9ed-9db5-4f80-bff9-175da68c366e}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\fa8e557d-435d-46e9-8558-35092df34325
%TEMP%\{a429f4c4-3237-4d19-ab96-8844c996e389}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\072835f6-feb1-45f8-8d70-b1a8d9401029
%TEMP%\{ba5dd030-129a-46ba-a313-20b992d38da2}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\889b10ec-9363-4c82-8e44-c0c294347b64
%TEMP%\{179bbc8f-d56d-4556-a023-61528b54f4b7}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\61c58293-8c07-4e0e-aceb-cd73c01098ad
%TEMP%\{8728e076-22bf-4dec-9736-f276ef39d847}
%TEMP%\{31bb65ce-3442-46d4-8704-05648f0ac234}
%TEMP%\{6c14cde1-f984-4d6a-adaf-7f0fdd936ef4}
%TEMP%\{76a6db93-d78f-48d1-bb9f-cdfdfe80907f}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\6dc6ea9d-e309-4d96-af86-75be16a9fa9c
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\fc89d2cd-4599-42e6-8d1b-4fd880723fb4
%TEMP%\{47c601aa-51f2-4e96-8404-980241703936}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\0ba9d8e0-32de-4c22-bd2a-0680e01a43fc
%TEMP%\{ed4b8208-a3e5-4b8d-ad09-071925732e45}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\d78126b5-4f59-4ed5-ae3f-77e46f8c9167
%TEMP%\{8618bbdd-2af8-46ee-a516-7dbbf6e0ee77}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\c4486040-c610-4618-b3a5-66ceac92b39c
%TEMP%\{5e802413-3e7a-46f0-8eff-f805943f170c}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\33677f2e-1ba5-4f80-975f-af0626e0b56d
%TEMP%\{80d2ffcf-ff51-4eef-8cca-bf05c69fb819}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\10ca911c-7fc2-4ed5-9965-88f551ff7fde
%TEMP%\{fe79f97a-6761-4c66-a34a-27bd3d494c62}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\9f30b316-a69f-4bc5-8a08-950c25e91ac9
%TEMP%\{142cbc3d-1d83-4b18-b22a-2e4a69e97fd7}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\24bd032f-9799-4b6b-a717-83aaca91bbf7
%TEMP%\{86169017-6e36-4ed3-96d3-fc8c4255169d}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\6f62a19f-e332-4aae-9d39-f6f291597a90
%TEMP%\{91afaab5-9b66-4d64-9d0c-a29940f01420}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\0b5020d3-7b17-4f8e-8367-556132218efc
%TEMP%\{bab3d8b8-4669-47a7-9eaa-2a2e1c41ba92}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\9db21fdf-6d31-44cc-affb-0600a2d3fe02
%TEMP%\{8145bb7e-22c3-498c-85c1-d0429086d506}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\70501987-d6a0-453a-a50c-0d28efe21a26
%TEMP%\{309265fd-fdd3-4d79-ab56-1759ad583729}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\9dc38c4c-5874-4997-870c-66e7bc0322c2
%TEMP%\{a2de14eb-87cf-4ee3-b7f4-ec0f092cf587}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\e3a059f1-fc38-477d-aa3e-5b13470c44f1
%TEMP%\{12f93f8f-df5b-42ef-857b-2712358909f8}
%APPDATA%\microsoft\templates\open notebook.onetoc2
%TEMP%\{9e5f9a48-fbe8-4e43-a0de-94a94cb0a250}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\cb7dd0d6-b3c8-43cd-a74e-1016d2abe1de
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\61f61813-12bf-428e-a621-7547de2caf46
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\95e370c8-60e6-4fab-9ebd-a61cdb84935a
%TEMP%\{726ba6e3-1336-4e45-810e-a0f545532bdc}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\c017fc3f-562f-4b66-8c2e-6c88f3a9c989
%TEMP%\{aa5b1a73-162d-417d-a133-a7391db2646a}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\475651f1-b0b3-4cee-a1ad-7c686301e2cf
%TEMP%\{b8ffe123-3cb0-44f1-a444-cb67a2c8e0a5}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\4ce0a476-ccff-4b8a-8bbf-2167040d2665
%TEMP%\{363e9b87-c777-4b5c-b88b-757f6a6992dd}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\afa26fb4-daf5-4c05-a2ac-4f11f0c7f016
%TEMP%\{c9479dd3-5e33-4477-bd8c-669e1426d971}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\02c14a7a-abed-4a36-907f-cf06fb6278c2
%TEMP%\{1a4320e7-675a-4fe8-9740-869570892af5}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\d6d824da-a504-4fe7-940e-a2455e09b5d9
%TEMP%\{c7a9506a-ac08-4b80-83b4-48196c5e982c}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\bd20a4ed-ddb1-4025-bca5-25853ec3830e
%TEMP%\{da26542b-1cca-4fdf-97fa-406b0bab0cc0}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\81d4fff9-3a82-43ac-80e6-41fcea4509cd
%TEMP%\{fc19cca6-5c35-44e0-9520-90e5d36372a3}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\2147f109-1c62-4e69-b80a-c2123d58b00c
%TEMP%\{f089d676-212a-4eb1-b720-9b8a3efceb01}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\af222283-52f9-43f3-a866-7916bb59e5c0
%TEMP%\{b4e9bd13-51fe-4112-aaef-932af5a958d2}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\67a8d4d1-9cdf-4e7e-9cc6-e2522c42c112
%TEMP%\{3de751b2-7466-47b8-ad0c-a068812d3c40}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\5273e1fd-51c0-4978-b06f-b2d159de7a3e
%TEMP%\{a7d6d1b7-553b-4845-ac14-25ccbe6b1f5c}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\a3704fa2-8762-46eb-bb24-97a269f2ed03
%TEMP%\{02650448-6308-48dd-bbd1-026a6647e2b6}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\3155d78c-1584-4dec-9449-314a3d550d29
%TEMP%\{e0d3075e-cc74-4492-b507-e49383abbbcd}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\996131da-4d4a-4279-b667-9d551c285607
%TEMP%\{6bb96399-513e-4367-a3ee-1ac340fd93bb}
%TEMP%\{4381ed36-5663-4843-9221-466886e9666e}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\c129b038-2a0f-4994-b354-64ed233a0973.png
%TEMP%\{c11085de-0898-4d47-bc10-e54dfec67708}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\bdde27ea-6a12-4825-bfac-f600b0f142fa.png
%TEMP%\{c40c8535-a452-42d3-a0fa-dfba760e1401}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\0ec91619-5478-4e5c-aa1b-8da00a066091.png
%TEMP%\{7a56b2dc-40e5-446f-b06b-47caeb9f61f6}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\2d02d28e-c843-42a7-ba9c-3541f1bd4e3a.png
%TEMP%\{6ac45c49-b32f-40cc-81be-58e92fca5bbe}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\5318eba9-773d-4fec-9366-6e84f8dfbbc5.png
%TEMP%\{7f1a389b-23c8-4e4c-9c86-0911666fbaaa}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\d2a0e881-e736-4694-b4e5-62a677ac17bf.png
%TEMP%\{08eae5ee-9f2a-4f95-b73e-5c65177af679}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\6d6e34b9-0e90-470c-ada3-2b00b4b8ffac.png
%TEMP%\{092900c1-8460-4c5f-b03f-6f5a6b1c5eb8}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\70c3a864-35fa-4245-802a-dbda1e3f4c00.png
%TEMP%\{13f1b1a0-0f92-4266-b763-8855ff899c42}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\a4f6c176-53e1-47b9-8fe4-8bb920684ff3.png
%TEMP%\{306b3015-bd4e-4cd4-9134-dc88c2ddc5f3}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\a4fbc2bf-8cc2-4a6d-b3c7-0ef749399e7f.png
%TEMP%\{1545be77-a221-443c-97e9-d671dbd3c457}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\52c39d7c-6d6b-4ad3-b5e5-c417949d335d.png
%TEMP%\{ce824508-01e3-4315-a84a-182ec2b26690}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\ee4479ee-b960-4d54-abc8-c9e95e2bf81f.png
%TEMP%\{a7871a0b-f4bb-4f9b-bacf-ecbd76d6cb84}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\3c6a9801-329c-4eba-9524-2165ac426bef.png
%TEMP%\{bfccf0c1-c8b1-4fb7-931a-868b4d327b5f}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\07a5080e-becd-4719-9a79-fe50b59eb55b.png
%TEMP%\{cdd37622-1228-4377-99eb-35894c7c9c88}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\0ff838eb-89b4-4a2f-881a-6e583195d26c.png
%TEMP%\{057d28f7-b4db-4da3-bfe2-c9a4c64841bd}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\4f92e887-7fef-4a98-9f74-501f37835639.png
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\b1503304-9b12-4d90-89e7-df30e304e6c2.png
%TEMP%\{7cc7ae73-5bcc-47e0-9fa0-50128ea3fc01}
%TEMP%\{d5b9f482-3da7-4c57-9357-2a77dfa6b3a9}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache.onecache
%TEMP%\onenote_migrationlog.txt
%HOMEPATH%\documents\onenote notebooks\personal\open notebook.onetoc2
%HOMEPATH%\documents\onenote notebooks\personal\general.one
%TEMP%\onenoteruntimecache\14.0\onenoteruntimecache.onecache
%TEMP%\{a124b7be-0985-4da5-b299-9c322dcac909}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\b2a67a4a-c116-4c88-9fd1-c5b9a23d7929.png
%TEMP%\{5b27c621-9601-4b2a-ae8b-a252236bcad1}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\03809a07-348b-48cc-b08d-f7b8472c133c.png
%TEMP%\{7d1bc180-3bd1-4dd9-8c47-ea3172b11ff1}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\a507cd65-0038-49e4-8cdb-b6082f566351.png
%TEMP%\{6d8f2efc-be3c-4293-938f-7a8d44e8c5a2}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\7dceec06-0991-43f4-8af3-601c0ebeb910.png
%TEMP%\{f07ef80e-1d7a-48b9-8448-49efc0bda918}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\e51cf594-e321-4d1c-88e7-df9cde80904c.png
%TEMP%\{a4afdeb3-d702-4c3f-b0d6-1179cb1dce48}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\e29a7eaf-32ad-400c-9927-05c358358ffc.png
%TEMP%\{617bac11-1adb-4c0e-9299-d2f04979783e}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\bb4e150b-7e2a-4556-81dd-590d7ab07dda.png
%TEMP%\{567a0eda-72c2-40f2-b4de-28ecd84c1f4b}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\1e81fb27-0aa3-4b11-a764-0d9e7e3272ea.png
%TEMP%\{929fa6ff-5c0b-4595-b231-0f6c84f9792d}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\62e3dfa2-4350-445b-8693-d1d04a74543c.png
%TEMP%\{5c87b367-be65-43b3-bdaa-ffeb8377acb6}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\d137f4ab-4b3d-439e-836f-ffbbc700bef1.png
%TEMP%\{e20321db-ac90-4581-9b71-9a348e27a0d6}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\e5116f77-b907-4c46-8bfa-006092a6714d.png
%TEMP%\{5c0d0e7a-f0cb-4701-80fe-818e46934619}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\a9e6bb3f-0b62-4410-86f7-68bb36989df7.png
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\bf4e96cf-9460-4049-8172-cfb4bec57f8e.png
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\0d984a6a-e70e-4747-bded-b92173e85c21.png
%TEMP%\{77355429-7d34-4ac0-9371-475a441de4d0}
%TEMP%\{1cf6a725-cc15-4b4c-bd50-4ac1c7885b5e}
%TEMP%\{72674424-b10d-4f18-b7a1-b95737e4c541}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\6a8b0e06-e9a5-4761-afda-29391149e64d.png
%TEMP%\{9646a999-e608-48fe-a69a-da0806bde21d}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\42a4aea1-ab77-4cf7-a3cb-14953248ceea.png
%TEMP%\{6d4ef92b-4b66-4024-a415-456c591921a6}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\d024a53a-b32a-417d-8f75-e1998be423af.png
%APPDATA%\microsoft\onenote\14.0\preferences.dat
%TEMP%\{f1dcc338-c394-4390-b2f2-7fb9f1a5b347}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\31d8411a-636a-4089-bd25-5d9567817973.hta
%TEMP%\{805a9568-0267-42fd-aec0-7513a4f7eaed}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\3f548814-e1be-493f-9087-9b7427a015cb.png
%TEMP%\{e5cc3d34-6fe1-4d63-b7dd-921d53797c38}
%HOMEPATH%\documents\onenote notebooks\personal\unfiled notes.one
%TEMP%\{8b39908e-2693-42d9-94fb-5288d12d5d0c}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\d8c634d0-56f4-4f38-8b3c-8f21b0f6989c
%TEMP%\{c77f822d-8822-451a-b838-547f3ff48ea6}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\1bf85fd8-2752-4457-88c6-58e635274be9
%TEMP%\{ace838ef-609b-4bc1-872c-7cc4858db066}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\080158a4-05b2-4392-9dd9-be70cc27d215
%TEMP%\{da18dfa7-e71e-4b40-8367-980c53b42a13}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\c74af4e7-e369-4bf8-9a79-9752f94d43cf
%TEMP%\{0c98998d-f8c8-481c-a0d9-b35dbd950655}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\8b399897-1cdd-4622-8d42-0218b5374e30
%TEMP%\{3ea6b224-1d62-4758-bd91-9ab6f971eac1}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\6f0d52f9-b478-4adc-9f25-e3a894df2df4
%TEMP%\{d6cc64e3-a380-49bd-8fa2-8db974d46e4e}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\a38314c2-1c90-4034-8095-42260e20eb20
%TEMP%\{0e652254-479a-4cc4-bdf8-c4d2af9f2140}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\8fc790b8-6f88-4e18-99e0-1eaa9b021fe2
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\d13b95bf-2bb1-4c3d-a85c-9ac5e1cb3884.png
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\7d014bed-5d20-470d-9655-bcf9c82d04f6
%TEMP%\{3dc6110e-60ef-4268-b329-fda5678f4107}
%TEMP%\{73992d2e-e7b5-4136-8dd5-11f2fb80a0f1}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\1a16981c-377d-4a10-9522-787f93302c18.png
%TEMP%\{6b1aad23-e1cf-4c37-8bf0-861b41822467}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\70d1f452-966e-4e28-8da5-8b2eeadbe078.png
%TEMP%\{282b5742-8fd1-4c97-97a6-48ab99179fc9}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\3506c6f4-6090-46ec-9fb3-0e2963361ba0.png
%TEMP%\{acacb1ec-875e-49e0-a49b-aff5fe242f93}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\8339d228-5ca6-486f-8793-633aa6af18d8.png
%TEMP%\{9f9c178f-2bce-437d-840c-babf882b69bb}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\d32a2c63-e181-4374-a527-d8ec3791e0cc.png
%TEMP%\{f6f663f5-f3d1-44ff-a4a2-c64784d60841}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\7b168dd1-e39e-4b39-918c-53b9e78365e9.png
%TEMP%\{f99e0dc5-2ade-42ab-9075-9863a533785a}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\072143f8-573f-45cb-b0b1-04f7bf2da18e.png
%TEMP%\{957e070a-ec1c-4a20-9548-a051221d7313}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\5394c05d-dc33-4d24-bd45-2d8954648f28.png
%TEMP%\{8c40796b-779e-44de-9117-4e1eb5fd6535}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\e7a7c0d5-0e34-4323-9576-f37e394faa8a.png
%TEMP%\{10c0cc34-2af1-404b-a39c-46a715374567}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\79a073b8-0713-4166-af23-3272c394a92a.png
%TEMP%\{9dccabe0-8f66-4237-be79-03f0af0b10d8}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\a6f0f9a9-e50d-4612-9e8e-f5640793680c.png
%TEMP%\{ce748d83-a871-4330-9726-372f372f3d32}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\d6f82e07-6756-4003-877a-af43e54f9781.png
%TEMP%\{c646f069-e791-4008-b6b2-cb22ba833f2e}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\be1e893c-ed6d-4ac9-933e-dd5340e7c76f.png
%TEMP%\{e52b8c9c-9718-4ac3-9464-a5b8843a75cd}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\f173a3a2-bd1a-460f-b78a-faf2a51f6d91.png
%TEMP%\{e4ad5514-5182-4b07-9e5f-cc06481d627a}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\115556d6-ba8b-4b18-8439-8e9c81ff63a4.png
%TEMP%\{b54a5446-ca9c-49c8-ae51-d2b44a4f5b4d}
<LS_APPDATA>\microsoft\onenote\14.0\onenoteofflinecache_files\f42c6845-52ab-4c6a-a5db-1d6d7274bbcf.hta

Deletes the following files

%TEMP%\{f1dcc338-c394-4390-b2f2-7fb9f1a5b347}
%TEMP%\{339f6780-c162-4cc6-8f18-87366b27d12c}
%TEMP%\{1f00061e-c9f4-464d-acba-671c9a974d37}
%TEMP%\{8a72f1a1-7867-4a86-b8b1-0fab4250396e}
%TEMP%\{96222fcb-55e4-420b-99e0-33e2ff78437c}
%TEMP%\{2432a9e3-af9e-432a-8650-d52795492956}
%TEMP%\{70d0e757-a06b-4bed-9fda-27a840aa3cfe}
%TEMP%\{e1d23d26-1746-4466-aa6a-690a0707dacd}
%TEMP%\{b29098c7-de0e-4d0a-80d1-13871c57956f}
%TEMP%\{d896fe47-c082-4d7c-8ae5-603eecab05e7}
%TEMP%\{7093f7cd-180f-436b-84a4-da829aa1a551}
%TEMP%\{abff11dc-247f-462f-be83-6e7742075a1a}
%TEMP%\{6442ab89-3c48-4146-9fd5-19ae87819a50}
%TEMP%\{559905e7-5556-46e2-8baf-8e7968670b6d}
%TEMP%\{bb93956b-6c37-4e95-a3e7-e6fc380899bf}
%TEMP%\{cf85ce0b-9f61-42ad-bf76-72424e423a2a}
%TEMP%\{4682ce43-bed5-4ed5-b445-ed7bdceb6b2e}
%TEMP%\{31bb65ce-3442-46d4-8704-05648f0ac234}
%TEMP%\{8728e076-22bf-4dec-9736-f276ef39d847}
%TEMP%\{179bbc8f-d56d-4556-a023-61528b54f4b7}
%TEMP%\{ba5dd030-129a-46ba-a313-20b992d38da2}
%TEMP%\{a429f4c4-3237-4d19-ab96-8844c996e389}
%TEMP%\{2167d9ed-9db5-4f80-bff9-175da68c366e}
%TEMP%\{d2ca055f-63b3-4d20-a123-75b48e079e75}
%TEMP%\{a274c1f0-89a6-4f9a-a8e0-510937a5ab3e}
%TEMP%\{03cf8eae-974c-4e79-bb59-d31731dad8d1}
%TEMP%\{fa1d2089-9296-4e92-941c-266fd54b7b4e}
%TEMP%\{2c7bff3b-99e5-4644-97b9-77467fa1c89c}
%TEMP%\{279bb9fb-5e01-4bc8-a194-a48d85239a99}
%TEMP%\{5aebe856-b3a1-42c1-a83f-bab3e5c3cabc}
%TEMP%\{5fc4d192-810b-42d2-96e1-acb8aa1158c9}
%TEMP%\{6bb96399-513e-4367-a3ee-1ac340fd93bb}
%TEMP%\{6c14cde1-f984-4d6a-adaf-7f0fdd936ef4}
%TEMP%\{a2de14eb-87cf-4ee3-b7f4-ec0f092cf587}
%TEMP%\{309265fd-fdd3-4d79-ab56-1759ad583729}
%TEMP%\{8145bb7e-22c3-498c-85c1-d0429086d506}
%TEMP%\{bab3d8b8-4669-47a7-9eaa-2a2e1c41ba92}
%TEMP%\{91afaab5-9b66-4d64-9d0c-a29940f01420}
%TEMP%\{86169017-6e36-4ed3-96d3-fc8c4255169d}
%TEMP%\{142cbc3d-1d83-4b18-b22a-2e4a69e97fd7}
%TEMP%\{fe79f97a-6761-4c66-a34a-27bd3d494c62}
%TEMP%\{80d2ffcf-ff51-4eef-8cca-bf05c69fb819}
%TEMP%\{5e802413-3e7a-46f0-8eff-f805943f170c}
%TEMP%\{8618bbdd-2af8-46ee-a516-7dbbf6e0ee77}
%TEMP%\{ed4b8208-a3e5-4b8d-ad09-071925732e45}
%TEMP%\{47c601aa-51f2-4e96-8404-980241703936}
%TEMP%\{aa5b1a73-162d-417d-a133-a7391db2646a}
%TEMP%\{726ba6e3-1336-4e45-810e-a0f545532bdc}
%TEMP%\{e0d3075e-cc74-4492-b507-e49383abbbcd}
%TEMP%\{02650448-6308-48dd-bbd1-026a6647e2b6}
%TEMP%\{a7d6d1b7-553b-4845-ac14-25ccbe6b1f5c}
%TEMP%\{3de751b2-7466-47b8-ad0c-a068812d3c40}
%TEMP%\{b4e9bd13-51fe-4112-aaef-932af5a958d2}
%TEMP%\{f089d676-212a-4eb1-b720-9b8a3efceb01}
%TEMP%\{fc19cca6-5c35-44e0-9520-90e5d36372a3}
%TEMP%\{da26542b-1cca-4fdf-97fa-406b0bab0cc0}
%TEMP%\{c7a9506a-ac08-4b80-83b4-48196c5e982c}
%TEMP%\{1a4320e7-675a-4fe8-9740-869570892af5}
%TEMP%\{c9479dd3-5e33-4477-bd8c-669e1426d971}
%TEMP%\{363e9b87-c777-4b5c-b88b-757f6a6992dd}
%TEMP%\{b8ffe123-3cb0-44f1-a444-cb67a2c8e0a5}
%TEMP%\{9e5f9a48-fbe8-4e43-a0de-94a94cb0a250}
%TEMP%\{fc494751-eff9-46ec-ada2-b07bf20685aa}
%TEMP%\{f5fcf8b5-90e7-4ad1-9d80-7a2d5c910644}
%TEMP%\{4381ed36-5663-4843-9221-466886e9666e}
%TEMP%\{ce824508-01e3-4315-a84a-182ec2b26690}
%TEMP%\{1545be77-a221-443c-97e9-d671dbd3c457}
%TEMP%\{306b3015-bd4e-4cd4-9134-dc88c2ddc5f3}
%TEMP%\{13f1b1a0-0f92-4266-b763-8855ff899c42}
%TEMP%\{092900c1-8460-4c5f-b03f-6f5a6b1c5eb8}
%TEMP%\{08eae5ee-9f2a-4f95-b73e-5c65177af679}
%TEMP%\{7f1a389b-23c8-4e4c-9c86-0911666fbaaa}
%TEMP%\{6ac45c49-b32f-40cc-81be-58e92fca5bbe}
%TEMP%\{7a56b2dc-40e5-446f-b06b-47caeb9f61f6}
%TEMP%\{c40c8535-a452-42d3-a0fa-dfba760e1401}
%TEMP%\{c11085de-0898-4d47-bc10-e54dfec67708}
%TEMP%\{7cc7ae73-5bcc-47e0-9fa0-50128ea3fc01}
%TEMP%\{bfccf0c1-c8b1-4fb7-931a-868b4d327b5f}
%TEMP%\{d5b9f482-3da7-4c57-9357-2a77dfa6b3a9}
%TEMP%\{e20321db-ac90-4581-9b71-9a348e27a0d6}
%TEMP%\{5c87b367-be65-43b3-bdaa-ffeb8377acb6}
%TEMP%\{929fa6ff-5c0b-4595-b231-0f6c84f9792d}
%TEMP%\{567a0eda-72c2-40f2-b4de-28ecd84c1f4b}
%TEMP%\{617bac11-1adb-4c0e-9299-d2f04979783e}
%TEMP%\{a4afdeb3-d702-4c3f-b0d6-1179cb1dce48}
%TEMP%\{f07ef80e-1d7a-48b9-8448-49efc0bda918}
%TEMP%\{6d8f2efc-be3c-4293-938f-7a8d44e8c5a2}
%TEMP%\{7d1bc180-3bd1-4dd9-8c47-ea3172b11ff1}
%TEMP%\{5b27c621-9601-4b2a-ae8b-a252236bcad1}
%TEMP%\{a124b7be-0985-4da5-b299-9c322dcac909}
%TEMP%\{e5cc3d34-6fe1-4d63-b7dd-921d53797c38}
%TEMP%\{805a9568-0267-42fd-aec0-7513a4f7eaed}
%TEMP%\{5c0d0e7a-f0cb-4701-80fe-818e46934619}
%TEMP%\{cdd37622-1228-4377-99eb-35894c7c9c88}
%TEMP%\{a7871a0b-f4bb-4f9b-bacf-ecbd76d6cb84}
%TEMP%\{057d28f7-b4db-4da3-bfe2-c9a4c64841bd}
%TEMP%\{77355429-7d34-4ac0-9371-475a441de4d0}
%TEMP%\{e4ad5514-5182-4b07-9e5f-cc06481d627a}
%TEMP%\{0e652254-479a-4cc4-bdf8-c4d2af9f2140}
%TEMP%\{d6cc64e3-a380-49bd-8fa2-8db974d46e4e}
%TEMP%\{3ea6b224-1d62-4758-bd91-9ab6f971eac1}
%TEMP%\{0c98998d-f8c8-481c-a0d9-b35dbd950655}
%TEMP%\{da18dfa7-e71e-4b40-8367-980c53b42a13}
%TEMP%\{ace838ef-609b-4bc1-872c-7cc4858db066}
%TEMP%\{c77f822d-8822-451a-b838-547f3ff48ea6}
%TEMP%\{8b39908e-2693-42d9-94fb-5288d12d5d0c}
%TEMP%\{6d4ef92b-4b66-4024-a415-456c591921a6}
%TEMP%\{9646a999-e608-48fe-a69a-da0806bde21d}
%TEMP%\{72674424-b10d-4f18-b7a1-b95737e4c541}
%TEMP%\{3dc6110e-60ef-4268-b329-fda5678f4107}
%TEMP%\{73992d2e-e7b5-4136-8dd5-11f2fb80a0f1}
%TEMP%\{e52b8c9c-9718-4ac3-9464-a5b8843a75cd}
%TEMP%\{b54a5446-ca9c-49c8-ae51-d2b44a4f5b4d}
%TEMP%\{c646f069-e791-4008-b6b2-cb22ba833f2e}
%TEMP%\{ce748d83-a871-4330-9726-372f372f3d32}
%TEMP%\{9dccabe0-8f66-4237-be79-03f0af0b10d8}
%TEMP%\{10c0cc34-2af1-404b-a39c-46a715374567}
%TEMP%\{8c40796b-779e-44de-9117-4e1eb5fd6535}
%TEMP%\{957e070a-ec1c-4a20-9548-a051221d7313}
%TEMP%\{f99e0dc5-2ade-42ab-9075-9863a533785a}
%TEMP%\{f6f663f5-f3d1-44ff-a4a2-c64784d60841}
%TEMP%\{9f9c178f-2bce-437d-840c-babf882b69bb}
%TEMP%\{acacb1ec-875e-49e0-a49b-aff5fe242f93}
%TEMP%\{282b5742-8fd1-4c97-97a6-48ab99179fc9}
%TEMP%\{6b1aad23-e1cf-4c37-8bf0-861b41822467}
%TEMP%\{1cf6a725-cc15-4b4c-bd50-4ac1c7885b5e}
%TEMP%\{12f93f8f-df5b-42ef-857b-2712358909f8}
%TEMP%\{76a6db93-d78f-48d1-bb9f-cdfdfe80907f}

Network activity

UDP

DNS ASK do##.live.net

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'TF_FloatingLangBar_WndTitle'
ClassName: 'NetUICtrlNotifySink' WindowName: ''
ClassName: 'REListbox20W' WindowName: ''
ClassName: 'OfficeTooltip' WindowName: ''
ClassName: 'MsoCommandBarPopup' WindowName: ''

Executes the following

'%ProgramFiles%\microsoft office\office14\onenotem.exe'

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial