Trojan.Siggen20.46441

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\onenote 2010 screen clipper and launcher.lnk

Modifies file system

Creates the following files

%TEMP%\11fa.tmp\batchfile.bat
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\589552e4-8cbd-4c4c-8273-c6b824bc0b71
%TEMP%\{d441b3d0-73aa-4f1b-b32d-2a0dbbf8e4a6}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\81394918-8a99-476a-9266-02ba17c7df28
%TEMP%\{20ea9664-e42e-4158-9dcd-690e120bb922}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a48755df-bbbf-419a-8f7a-f7d4a90fc7c8
%TEMP%\{7466c8ac-ab68-4c8e-a24b-2444170d3428}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\929e150d-edbb-4955-8241-e73c106ece2b
%TEMP%\{63f2f29f-85c5-4d25-8a44-f0ced7251e3e}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\91faa498-2181-4423-acb2-caa6743784da
%TEMP%\{2f6d8ade-8166-46ba-9746-b2c55ab12f03}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\db3a2286-2f0f-4726-bf26-fc9e2c98f883
%TEMP%\{79d4c92d-7328-41b0-8a6a-838b64427124}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\4788bb55-4d53-48fe-a624-32718407c800
%TEMP%\{3779a250-242c-45e3-a911-0ee7d74b03a3}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\708e5f5e-7919-4259-8092-e1a41acc2305
%TEMP%\{8f1bd482-313b-4322-8ac0-cb559699ba1f}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\8bbb5859-417d-4fce-93a7-8e5bb437f475
%TEMP%\{f107fa77-fb55-4450-ab14-ab1ec4d01b51}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\92b1cffb-98bd-489d-85a9-ddc13f5d8369
%TEMP%\{48f5a517-bbba-4316-9b23-4cad5bf432f3}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\704246ff-2a5b-4ba0-a88e-4af01c8d0bb2
%TEMP%\{5fee439c-69c2-416c-8f4d-da3a06dd95f7}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0dde7a88-a5c2-41d6-b34c-e1d9b728cf37
%TEMP%\{132c4308-a056-42a6-a02e-229a3bcf2633}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\b24cf439-e390-48ff-bdc7-91409db805e3
%TEMP%\{4ef08ea4-cb08-49ab-a8f5-47d6073cbdba}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\46cf9adc-e6bd-46d1-845f-9c46d317ddec
%TEMP%\{31c2e852-c406-4de7-ad81-f75b03ce8562}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\06eecbf9-58f1-49d7-82dd-28980b9a6892
%TEMP%\{8240a049-9e5c-49e9-b2e7-aba9cd2d3311}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\2b830d01-9946-49ad-9255-6ee877aba6c9
%TEMP%\{493f0a14-5754-41ef-96f7-d7e51a7e56ce}
%TEMP%\{ca668a1e-007a-42a8-8e27-978f9aa46b18}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\3c756f12-2366-4b0f-afd5-251f64e2b9f9
%TEMP%\{ca06e8d0-cfa0-4292-81d9-8470bb9f9f70}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\c84b9bff-ea49-489d-825d-7959da69a3e1
%TEMP%\{2b51f84f-1877-4197-ad41-b8ba69b5cf10}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\4c20f1ad-9db3-4a48-9712-e80be71c5d6c
%TEMP%\{f7d41e7f-d99b-40de-8c03-5dd2bbcd08ed}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\2c0d8e04-f798-42d3-b3fe-b69d8830e1ca
%TEMP%\{3b46ac91-ad1e-4413-adee-81ddf1e8d0cb}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\cefe7fa9-a52e-4f49-92ee-62ec313eb376
%TEMP%\{0f310be1-55d2-4299-83c1-75aba6e2795e}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\1f5b048b-460f-40ea-9a03-eb303ea49bc0
%TEMP%\{e2c30c16-bc8a-440a-9b59-1f97a4069b4c}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\cb7dd0d6-b3c8-43cd-a74e-1016d2abe1de
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\cd5b7d3b-f3b3-4e4a-a5b9-5bcf1f7525fe
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\8c0c9dc3-6580-45ed-a92e-34f3de617928
%TEMP%\{53ff397b-3a4e-4702-ba60-c3109ecb8e1c}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\78e53d00-7097-45be-a724-8c2c45ca5a4f
%TEMP%\{f4a4cce9-192c-4d46-845c-3a07959c4dd5}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\4d583135-0540-4594-88f6-18029335c6db
%TEMP%\{f8bdd321-4d07-479f-8410-9a9f20fb43ad}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\fa8e557d-435d-46e9-8558-35092df34325
%TEMP%\{2b11a804-7697-4885-b6ae-87d9b7e6146b}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\072835f6-feb1-45f8-8d70-b1a8d9401029
%TEMP%\{dbdddf57-47c0-4e68-b4b9-abc7d85bce04}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\889b10ec-9363-4c82-8e44-c0c294347b64
%TEMP%\{3b7d4b27-96a8-4d54-a45d-7d7eb972d2c3}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\61c58293-8c07-4e0e-aceb-cd73c01098ad
%TEMP%\{fe1e650b-1dea-4c4d-ad97-e4e534d13643}
%TEMP%\{5557ab94-9b93-449d-bd2d-94e44c1444c7}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\adf7e214-49f4-4c55-a2d7-8164c13e6e35
%TEMP%\{0493c7be-37a0-462d-857d-c5f1e351bfb6}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\996131da-4d4a-4279-b667-9d551c285607
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\61f61813-12bf-428e-a621-7547de2caf46
%TEMP%\{f881330e-f622-45fd-b519-b8e0485fde95}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\fc89d2cd-4599-42e6-8d1b-4fd880723fb4
%TEMP%\{090c8daf-d3b3-493e-a9a9-dd44dd13783d}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0ba9d8e0-32de-4c22-bd2a-0680e01a43fc
%TEMP%\{4b2664ff-17e7-469a-8062-d637d2074ae9}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d78126b5-4f59-4ed5-ae3f-77e46f8c9167
%TEMP%\{0577b027-8a38-4117-9602-fae4441c7323}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\c4486040-c610-4618-b3a5-66ceac92b39c
%TEMP%\{8813571c-eef2-4e3c-818f-9a4fd4add193}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\33677f2e-1ba5-4f80-975f-af0626e0b56d
%TEMP%\{1fb25e62-fe1d-412e-b08c-b13d4f642115}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\10ca911c-7fc2-4ed5-9965-88f551ff7fde
%TEMP%\{44c464c7-5d88-4bdd-90fc-92cf3600012b}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\9f30b316-a69f-4bc5-8a08-950c25e91ac9
%TEMP%\{63cf618b-af61-46a1-bdeb-071f6ad8cf25}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\24bd032f-9799-4b6b-a717-83aaca91bbf7
%TEMP%\{03af2bce-57d9-4f89-bd46-d4a97d981553}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\6f62a19f-e332-4aae-9d39-f6f291597a90
%TEMP%\{25370b94-443f-456d-9519-f2b565d1ab29}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0b5020d3-7b17-4f8e-8367-556132218efc
%TEMP%\{a1a8b2c7-6089-4c98-84a7-b8079f0587a0}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\9db21fdf-6d31-44cc-affb-0600a2d3fe02
%TEMP%\{7aef52b8-bf42-48a0-aec3-e21e45cd1438}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\70501987-d6a0-453a-a50c-0d28efe21a26
%TEMP%\{5490b782-2301-4541-bdb6-559bbd5c7bbe}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\9dc38c4c-5874-4997-870c-66e7bc0322c2
%TEMP%\{05e74155-309c-4df5-9811-be6f51ec47c8}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\e3a059f1-fc38-477d-aa3e-5b13470c44f1
%TEMP%\{76ad5771-7c26-448b-8483-3df4e64db522}
%TEMP%\{8acb3672-1216-42ec-be1d-3c007e1f3f01}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\95e370c8-60e6-4fab-9ebd-a61cdb84935a
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\3155d78c-1584-4dec-9449-314a3d550d29
%TEMP%\{3fdb8815-2cef-4d51-add3-ce4ae7fc18cd}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\6dc6ea9d-e309-4d96-af86-75be16a9fa9c
%TEMP%\{d954e526-7bb0-455c-894c-f89ae331cefe}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\c017fc3f-562f-4b66-8c2e-6c88f3a9c989
%TEMP%\{ba96b4f2-843e-47c4-90f0-8165335b21ff}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\475651f1-b0b3-4cee-a1ad-7c686301e2cf
%TEMP%\{d0aae8ee-8bf3-4499-941c-23a232f5b904}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\4ce0a476-ccff-4b8a-8bbf-2167040d2665
%TEMP%\{b99833ca-4e91-4f6a-b016-f11949fd6726}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\afa26fb4-daf5-4c05-a2ac-4f11f0c7f016
%TEMP%\{18396bc3-c2df-4fc9-ae31-c72f8180c0f3}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\02c14a7a-abed-4a36-907f-cf06fb6278c2
%TEMP%\{d6cb768a-f070-4ec5-9482-d46df3bb8b7b}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d6d824da-a504-4fe7-940e-a2455e09b5d9
%TEMP%\{253a6ac5-44eb-42f9-af30-469f54c6d24d}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\bd20a4ed-ddb1-4025-bca5-25853ec3830e
%TEMP%\{7abc9f38-ca2e-459a-8d8d-746ef2982c97}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\81d4fff9-3a82-43ac-80e6-41fcea4509cd
%TEMP%\{342307f7-db32-4a3d-89da-895f1dadaa1d}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\2147f109-1c62-4e69-b80a-c2123d58b00c
%TEMP%\{2e7ca6c3-96f8-4c8b-b996-2407ea8b0bb8}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\af222283-52f9-43f3-a866-7916bb59e5c0
%TEMP%\{89486929-c9ce-45e7-b991-35a31c376d61}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\67a8d4d1-9cdf-4e7e-9cc6-e2522c42c112
%TEMP%\{bc8a3d22-ae82-4b51-b156-4bede4cdcea1}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\5273e1fd-51c0-4978-b06f-b2d159de7a3e
%TEMP%\{7e7d721a-fd68-4359-9784-477b812be7c2}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a3704fa2-8762-46eb-bb24-97a269f2ed03
%TEMP%\{c7da6091-5216-4e0c-a37a-e0fb6b2bda9b}
%TEMP%\{6abbaf2b-aabe-4191-bc0e-e950ed579a0e}
%TEMP%\{98c8fa50-9b45-414c-999f-7e9d6479afa3}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\7d014bed-5d20-470d-9655-bcf9c82d04f6
%TEMP%\{2bf8fa90-252c-409f-a5f2-bd48d9e281ec}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\4f92e887-7fef-4a98-9f74-501f37835639.png
%TEMP%\{c0137095-b1dc-4646-81d2-0f01d136e1bb}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\bdde27ea-6a12-4825-bfac-f600b0f142fa.png
%TEMP%\{89707bf4-a392-4b67-aabf-b5bf3eaca3de}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0ec91619-5478-4e5c-aa1b-8da00a066091.png
%TEMP%\{1768ec0a-8c33-43f8-ba04-96532ca952da}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\2d02d28e-c843-42a7-ba9c-3541f1bd4e3a.png
%TEMP%\{ed2402a9-7328-4a40-a6a0-eb4048ac06ad}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\5318eba9-773d-4fec-9366-6e84f8dfbbc5.png
%TEMP%\{a95716b4-24e7-4549-85fa-d1cb333df413}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d2a0e881-e736-4694-b4e5-62a677ac17bf.png
%TEMP%\{930f1d40-04ff-4247-99d9-cbf29aef6b57}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\bf4e96cf-9460-4049-8172-cfb4bec57f8e.png
%TEMP%\{57262e20-4d9f-4268-91e1-765df3bb0759}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\6d6e34b9-0e90-470c-ada3-2b00b4b8ffac.png
%WINDIR%\inf\outlook\0009\outlperf.ini
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\70c3a864-35fa-4245-802a-dbda1e3f4c00.png
%TEMP%\{10dde506-5dda-46f2-80ca-31cea8f2d16b}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a4f6c176-53e1-47b9-8fe4-8bb920684ff3.png
%TEMP%\{39bf5aec-6897-4289-b39b-c9bd7a08f4e3}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a4fbc2bf-8cc2-4a6d-b3c7-0ef749399e7f.png
%TEMP%\{7919b672-48bd-41d7-9959-c2693ac60e82}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\52c39d7c-6d6b-4ad3-b5e5-c417949d335d.png
%TEMP%\{1bc3ca48-394b-4882-a1af-eed85610b0d8}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\ee4479ee-b960-4d54-abc8-c9e95e2bf81f.png
%TEMP%\{91059f52-246b-4ea6-854d-69455c031870}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\3c6a9801-329c-4eba-9524-2165ac426bef.png
%TEMP%\{96953ee4-2ac4-4646-a93a-1f8e891b32d2}
%WINDIR%\inf\outlook\outlperf.h
%TEMP%\{6fa8c432-7769-482d-9b57-44039b1fb6d9}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a9e6bb3f-0b62-4410-86f7-68bb36989df7.png
%TEMP%\{18e32b43-e5de-43eb-92ba-d3d92d9e5bd8}
%LOCALAPPDATA%\microsoft\forms\frmdata64.dat
%TEMP%\onenote_migrationlog.txt
%HOMEPATH%\documents\onenote notebooks\personal\open notebook.onetoc2
%HOMEPATH%\documents\onenote notebooks\personal\general.one
%TEMP%\onenoteruntimecache\14.0\onenoteruntimecache.onecache
%TEMP%\{d8d779cb-643e-48b4-b93e-a8a8ddfa25bd}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\b2a67a4a-c116-4c88-9fd1-c5b9a23d7929.png
%TEMP%\{19a4d6ab-74a4-484e-aec2-bd91044344b0}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\03809a07-348b-48cc-b08d-f7b8472c133c.png
%TEMP%\{4779a380-a484-4550-a8d1-cd5b28ff29b1}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a507cd65-0038-49e4-8cdb-b6082f566351.png
%TEMP%\{5813168b-4fbc-4841-98ad-063dff40d10e}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\7dceec06-0991-43f4-8af3-601c0ebeb910.png
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache.onecache
%TEMP%\{89b8b6bd-a5d8-46eb-8bc2-888b40be78ea}
%TEMP%\{198413b2-d552-4115-9603-f444bf0c3655}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\e29a7eaf-32ad-400c-9927-05c358358ffc.png
%TEMP%\{3240a7a2-3848-46fd-bd13-247847902df5}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\bb4e150b-7e2a-4556-81dd-590d7ab07dda.png
%TEMP%\{91a7f244-6db6-4965-9d68-c569502d7513}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\1e81fb27-0aa3-4b11-a764-0d9e7e3272ea.png
%TEMP%\{2038d94b-bc73-4e74-9d57-5b44597cbc86}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\62e3dfa2-4350-445b-8693-d1d04a74543c.png
%TEMP%\outlook logging\firstrun.log
%TEMP%\{9adbad5d-f235-4af4-a835-6f3661454bee}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d137f4ab-4b3d-439e-836f-ffbbc700bef1.png
%TEMP%\{c7bf7b71-4105-4915-81ed-507871f1743c}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\e5116f77-b907-4c46-8bfa-006092a6714d.png
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\e51cf594-e321-4d1c-88e7-df9cde80904c.png
%TEMP%\{4d14d75f-3fb9-4074-a04a-68a6e76d8692}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\07a5080e-becd-4719-9a79-fe50b59eb55b.png
%TEMP%\{3c4da137-532b-4799-9406-f4b62bb766f0}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0ff838eb-89b4-4a2f-881a-6e583195d26c.png
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\115556d6-ba8b-4b18-8439-8e9c81ff63a4.png
%TEMP%\{1ab6941b-554d-41be-a56c-824513ef5334}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0d984a6a-e70e-4747-bded-b92173e85c21.png
%TEMP%\{e2877119-1152-48a3-8067-e836c4810bd3}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d13b95bf-2bb1-4c3d-a85c-9ac5e1cb3884.png
%TEMP%\{416ac72a-1836-49b4-8ab8-d3f702e8fe27}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\6a8b0e06-e9a5-4761-afda-29391149e64d.png
%TEMP%\{c06ad5ec-0607-4c84-a985-4197c497ec95}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\42a4aea1-ab77-4cf7-a3cb-14953248ceea.png
%TEMP%\{1178fdae-9407-44f5-a7d0-c812d6920b34}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d024a53a-b32a-417d-8f75-e1998be423af.png
%APPDATA%\microsoft\onenote\14.0\preferences.dat
%TEMP%\{067ce4b4-7a0b-4855-a431-2f2eac0c638c}
%HOMEPATH%\documents\onenote notebooks\personal\unfiled notes.one
%TEMP%\{69ac15ba-4382-43ef-a1b4-a64c6eea3707}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d8c634d0-56f4-4f38-8b3c-8f21b0f6989c
%TEMP%\{2daed1a0-926e-473f-96e8-bde373cb4447}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\1bf85fd8-2752-4457-88c6-58e635274be9
%TEMP%\{38f74e0e-754d-43b2-8c09-325db753843f}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\080158a4-05b2-4392-9dd9-be70cc27d215
%TEMP%\{fe9a87b4-322c-4cd7-a757-327f9023e3a7}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\c74af4e7-e369-4bf8-9a79-9752f94d43cf
%TEMP%\{03571401-9886-4a24-bee5-303a1d89a677}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\8b399897-1cdd-4622-8d42-0218b5374e30
%TEMP%\{3d2b98e2-27c3-4811-b4f1-9dffeda20b6b}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\6f0d52f9-b478-4adc-9f25-e3a894df2df4
%TEMP%\{728776d3-19c2-413a-be2f-4b14a8e02841}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a38314c2-1c90-4034-8095-42260e20eb20
%TEMP%\{b217b517-e1c9-4ba5-9069-767e18834c54}
%TEMP%\{2fdcba21-98c8-40db-90f6-838ce1955922}
%TEMP%\{cda3dbe4-f2cb-4d42-a645-e247f1ac8719}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\f173a3a2-bd1a-460f-b78a-faf2a51f6d91.png
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\be1e893c-ed6d-4ac9-933e-dd5340e7c76f.png
%TEMP%\{e905c7d4-2bd4-4ea0-8c00-482d17de850c}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\b1503304-9b12-4d90-89e7-df30e304e6c2.png
%TEMP%\{22e3ab67-ffde-4103-8bfc-04513d9c19bb}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\c129b038-2a0f-4994-b354-64ed233a0973.png
%TEMP%\{8dd7d35c-a075-4830-b071-774ad9919eac}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\1a16981c-377d-4a10-9522-787f93302c18.png
%TEMP%\{8a0802b3-12a4-4915-b266-21168186d8ff}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\70d1f452-966e-4e28-8da5-8b2eeadbe078.png
%TEMP%\{727aa217-ea3f-418a-b4d7-6aba6b49d5de}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\3506c6f4-6090-46ec-9fb3-0e2963361ba0.png
%TEMP%\{3fa09dbc-f0c1-4405-a246-3555a39bb50e}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\8339d228-5ca6-486f-8793-633aa6af18d8.png
%TEMP%\{61d46fcf-d2f4-4e9c-b589-7f65568cdf9a}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d32a2c63-e181-4374-a527-d8ec3791e0cc.png
%TEMP%\{4bf9d7ab-6e1f-40b3-a702-c5350db84e13}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\7b168dd1-e39e-4b39-918c-53b9e78365e9.png
%TEMP%\{8a3489d0-edb0-47c6-9a6b-e53f36392eb9}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\072143f8-573f-45cb-b0b1-04f7bf2da18e.png
%TEMP%\{a7450e09-ee6f-4798-af04-d72f2b572594}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\5394c05d-dc33-4d24-bd45-2d8954648f28.png
%TEMP%\{b309dc32-9d03-455e-b646-5c8ef2eaadef}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\e7a7c0d5-0e34-4323-9576-f37e394faa8a.png
%TEMP%\{e4acb49d-2350-4998-8633-5bd04038222e}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\79a073b8-0713-4166-af23-3272c394a92a.png
%TEMP%\{945a64f3-13b4-41f8-9eb7-631db7f5b84b}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a6f0f9a9-e50d-4612-9e8e-f5640793680c.png
%TEMP%\{9dcd44e5-28f2-4929-b40f-bdccfdd7c843}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d6f82e07-6756-4003-877a-af43e54f9781.png
%TEMP%\{d7239d8a-379a-4718-85a8-5de4832cac36}
%LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\8fc790b8-6f88-4e18-99e0-1eaa9b021fe2
%APPDATA%\microsoft\templates\open notebook.onetoc2

Deletes the following files

%TEMP%\{067ce4b4-7a0b-4855-a431-2f2eac0c638c}
%TEMP%\{4ef08ea4-cb08-49ab-a8f5-47d6073cbdba}
%TEMP%\{132c4308-a056-42a6-a02e-229a3bcf2633}
%TEMP%\{5fee439c-69c2-416c-8f4d-da3a06dd95f7}
%TEMP%\{48f5a517-bbba-4316-9b23-4cad5bf432f3}
%TEMP%\{f107fa77-fb55-4450-ab14-ab1ec4d01b51}
%TEMP%\{8f1bd482-313b-4322-8ac0-cb559699ba1f}
%TEMP%\{31c2e852-c406-4de7-ad81-f75b03ce8562}
%TEMP%\{79d4c92d-7328-41b0-8a6a-838b64427124}
%TEMP%\{2f6d8ade-8166-46ba-9746-b2c55ab12f03}
%TEMP%\{63f2f29f-85c5-4d25-8a44-f0ced7251e3e}
%TEMP%\{7466c8ac-ab68-4c8e-a24b-2444170d3428}
%TEMP%\{20ea9664-e42e-4158-9dcd-690e120bb922}
%TEMP%\{d441b3d0-73aa-4f1b-b32d-2a0dbbf8e4a6}
%TEMP%\{3779a250-242c-45e3-a911-0ee7d74b03a3}
%TEMP%\{8240a049-9e5c-49e9-b2e7-aba9cd2d3311}
%TEMP%\{493f0a14-5754-41ef-96f7-d7e51a7e56ce}
%TEMP%\{3b7d4b27-96a8-4d54-a45d-7d7eb972d2c3}
%TEMP%\{dbdddf57-47c0-4e68-b4b9-abc7d85bce04}
%TEMP%\{2b11a804-7697-4885-b6ae-87d9b7e6146b}
%TEMP%\{f8bdd321-4d07-479f-8410-9a9f20fb43ad}
%TEMP%\{f4a4cce9-192c-4d46-845c-3a07959c4dd5}
%TEMP%\{53ff397b-3a4e-4702-ba60-c3109ecb8e1c}
%TEMP%\{fe1e650b-1dea-4c4d-ad97-e4e534d13643}
%TEMP%\{e2c30c16-bc8a-440a-9b59-1f97a4069b4c}
%TEMP%\{0f310be1-55d2-4299-83c1-75aba6e2795e}
%TEMP%\{3b46ac91-ad1e-4413-adee-81ddf1e8d0cb}
%TEMP%\{f7d41e7f-d99b-40de-8c03-5dd2bbcd08ed}
%TEMP%\{5557ab94-9b93-449d-bd2d-94e44c1444c7}
%TEMP%\{0493c7be-37a0-462d-857d-c5f1e351bfb6}
%TEMP%\{3fdb8815-2cef-4d51-add3-ce4ae7fc18cd}
%TEMP%\{d954e526-7bb0-455c-894c-f89ae331cefe}
%TEMP%\{5490b782-2301-4541-bdb6-559bbd5c7bbe}
%TEMP%\{7aef52b8-bf42-48a0-aec3-e21e45cd1438}
%TEMP%\{a1a8b2c7-6089-4c98-84a7-b8079f0587a0}
%TEMP%\{25370b94-443f-456d-9519-f2b565d1ab29}
%TEMP%\{03af2bce-57d9-4f89-bd46-d4a97d981553}
%TEMP%\{63cf618b-af61-46a1-bdeb-071f6ad8cf25}
%TEMP%\{44c464c7-5d88-4bdd-90fc-92cf3600012b}
%TEMP%\{1fb25e62-fe1d-412e-b08c-b13d4f642115}
%TEMP%\{8813571c-eef2-4e3c-818f-9a4fd4add193}
%TEMP%\{0577b027-8a38-4117-9602-fae4441c7323}
%TEMP%\{4b2664ff-17e7-469a-8062-d637d2074ae9}
%TEMP%\{090c8daf-d3b3-493e-a9a9-dd44dd13783d}
%TEMP%\{f881330e-f622-45fd-b519-b8e0485fde95}
%TEMP%\{8acb3672-1216-42ec-be1d-3c007e1f3f01}
%TEMP%\{76ad5771-7c26-448b-8483-3df4e64db522}
%TEMP%\{c7da6091-5216-4e0c-a37a-e0fb6b2bda9b}
%TEMP%\{7e7d721a-fd68-4359-9784-477b812be7c2}
%TEMP%\{bc8a3d22-ae82-4b51-b156-4bede4cdcea1}
%TEMP%\{89486929-c9ce-45e7-b991-35a31c376d61}
%TEMP%\{2e7ca6c3-96f8-4c8b-b996-2407ea8b0bb8}
%TEMP%\{342307f7-db32-4a3d-89da-895f1dadaa1d}
%TEMP%\{7abc9f38-ca2e-459a-8d8d-746ef2982c97}
%TEMP%\{253a6ac5-44eb-42f9-af30-469f54c6d24d}
%TEMP%\{d6cb768a-f070-4ec5-9482-d46df3bb8b7b}
%TEMP%\{18396bc3-c2df-4fc9-ae31-c72f8180c0f3}
%TEMP%\{b99833ca-4e91-4f6a-b016-f11949fd6726}
%TEMP%\{d0aae8ee-8bf3-4499-941c-23a232f5b904}
%TEMP%\{ba96b4f2-843e-47c4-90f0-8165335b21ff}
%TEMP%\{05e74155-309c-4df5-9811-be6f51ec47c8}
%TEMP%\{2b51f84f-1877-4197-ad41-b8ba69b5cf10}
%TEMP%\{ca06e8d0-cfa0-4292-81d9-8470bb9f9f70}
%TEMP%\{ca668a1e-007a-42a8-8e27-978f9aa46b18}
%TEMP%\{4779a380-a484-4550-a8d1-cd5b28ff29b1}
%TEMP%\{19a4d6ab-74a4-484e-aec2-bd91044344b0}
%TEMP%\{d8d779cb-643e-48b4-b93e-a8a8ddfa25bd}
%TEMP%\{e4acb49d-2350-4998-8633-5bd04038222e}
%TEMP%\{b309dc32-9d03-455e-b646-5c8ef2eaadef}
%TEMP%\{a7450e09-ee6f-4798-af04-d72f2b572594}
%TEMP%\{8a3489d0-edb0-47c6-9a6b-e53f36392eb9}
%TEMP%\{4bf9d7ab-6e1f-40b3-a702-c5350db84e13}
%TEMP%\{61d46fcf-d2f4-4e9c-b589-7f65568cdf9a}
%TEMP%\{3fa09dbc-f0c1-4405-a246-3555a39bb50e}
%TEMP%\{727aa217-ea3f-418a-b4d7-6aba6b49d5de}
%TEMP%\{8a0802b3-12a4-4915-b266-21168186d8ff}
%TEMP%\{8dd7d35c-a075-4830-b071-774ad9919eac}
%TEMP%\{22e3ab67-ffde-4103-8bfc-04513d9c19bb}
%TEMP%\{e905c7d4-2bd4-4ea0-8c00-482d17de850c}
%TEMP%\{3c4da137-532b-4799-9406-f4b62bb766f0}
%TEMP%\{4d14d75f-3fb9-4074-a04a-68a6e76d8692}
%TEMP%\{91059f52-246b-4ea6-854d-69455c031870}
%TEMP%\{1bc3ca48-394b-4882-a1af-eed85610b0d8}
%TEMP%\{7919b672-48bd-41d7-9959-c2693ac60e82}
%TEMP%\{39bf5aec-6897-4289-b39b-c9bd7a08f4e3}
%TEMP%\{10dde506-5dda-46f2-80ca-31cea8f2d16b}
%TEMP%\{96953ee4-2ac4-4646-a93a-1f8e891b32d2}
%TEMP%\{930f1d40-04ff-4247-99d9-cbf29aef6b57}
%TEMP%\{a95716b4-24e7-4549-85fa-d1cb333df413}
%TEMP%\{ed2402a9-7328-4a40-a6a0-eb4048ac06ad}
%TEMP%\{1768ec0a-8c33-43f8-ba04-96532ca952da}
%TEMP%\{5813168b-4fbc-4841-98ad-063dff40d10e}
%TEMP%\{89b8b6bd-a5d8-46eb-8bc2-888b40be78ea}
%TEMP%\{198413b2-d552-4115-9603-f444bf0c3655}
%TEMP%\{3240a7a2-3848-46fd-bd13-247847902df5}
%TEMP%\{2bf8fa90-252c-409f-a5f2-bd48d9e281ec}
%TEMP%\{b217b517-e1c9-4ba5-9069-767e18834c54}
%TEMP%\{728776d3-19c2-413a-be2f-4b14a8e02841}
%TEMP%\{3d2b98e2-27c3-4811-b4f1-9dffeda20b6b}
%TEMP%\{03571401-9886-4a24-bee5-303a1d89a677}
%TEMP%\{fe9a87b4-322c-4cd7-a757-327f9023e3a7}
%TEMP%\{38f74e0e-754d-43b2-8c09-325db753843f}
%TEMP%\{2daed1a0-926e-473f-96e8-bde373cb4447}
%TEMP%\{69ac15ba-4382-43ef-a1b4-a64c6eea3707}
%TEMP%\{89707bf4-a392-4b67-aabf-b5bf3eaca3de}
%TEMP%\{c0137095-b1dc-4646-81d2-0f01d136e1bb}
%TEMP%\{57262e20-4d9f-4268-91e1-765df3bb0759}
%TEMP%\{6fa8c432-7769-482d-9b57-44039b1fb6d9}
%TEMP%\{c7bf7b71-4105-4915-81ed-507871f1743c}
%TEMP%\{18e32b43-e5de-43eb-92ba-d3d92d9e5bd8}
%TEMP%\{9adbad5d-f235-4af4-a835-6f3661454bee}
%TEMP%\{1178fdae-9407-44f5-a7d0-c812d6920b34}
%TEMP%\{c06ad5ec-0607-4c84-a985-4197c497ec95}
%TEMP%\{416ac72a-1836-49b4-8ab8-d3f702e8fe27}
%TEMP%\{e2877119-1152-48a3-8067-e836c4810bd3}
%TEMP%\{1ab6941b-554d-41be-a56c-824513ef5334}
%TEMP%\{2fdcba21-98c8-40db-90f6-838ce1955922}
%TEMP%\{cda3dbe4-f2cb-4d42-a645-e247f1ac8719}
%TEMP%\{d7239d8a-379a-4718-85a8-5de4832cac36}
%TEMP%\{9dcd44e5-28f2-4929-b40f-bdccfdd7c843}
%TEMP%\{945a64f3-13b4-41f8-9eb7-631db7f5b84b}
%TEMP%\{2038d94b-bc73-4e74-9d57-5b44597cbc86}
%TEMP%\{91a7f244-6db6-4965-9d68-c569502d7513}
%TEMP%\{98c8fa50-9b45-414c-999f-7e9d6479afa3}
%TEMP%\{6abbaf2b-aabe-4191-bc0e-e950ed579a0e}

Network activity

UDP

DNS ASK do##.live.net

Miscellaneous

Searches for the following windows

ClassName: 'mspim_wnd32' WindowName: 'Microsoft Outlook'
ClassName: '' WindowName: 'TF_FloatingLangBar_WndTitle'
ClassName: 'NetUICtrlNotifySink' WindowName: ''
ClassName: 'REListbox20W' WindowName: ''
ClassName: 'OfficeTooltip' WindowName: ''
ClassName: 'MsoCommandBarPopup' WindowName: ''

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\11FA.tmp\batchfile.bat" "
'%ProgramFiles%\microsoft office\office14\outlook.exe'
'%ProgramFiles%\microsoft office\office14\onenote.exe'
'%ProgramFiles%\microsoft office\office14\onenotem.exe'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial