Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\onenote 2010 screen clipper and launcher.lnk
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache.onecache
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\81394918-8a99-476a-9266-02ba17c7df28
- %TEMP%\{cb8d360b-230c-4d27-a401-d60d5136898d}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a48755df-bbbf-419a-8f7a-f7d4a90fc7c8
- %TEMP%\{a8899174-f0f4-4cd7-b220-2086c1e28bf4}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\929e150d-edbb-4955-8241-e73c106ece2b
- %TEMP%\{a065d086-8cdd-48a6-a8f1-7210bb18419b}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\91faa498-2181-4423-acb2-caa6743784da
- %TEMP%\{6f17dfa5-599a-4c81-a3ef-f6f118b462a5}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\db3a2286-2f0f-4726-bf26-fc9e2c98f883
- %TEMP%\{10ea474a-a11f-447b-92da-2a43ac5ba291}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\708e5f5e-7919-4259-8092-e1a41acc2305
- %TEMP%\{515c7577-9014-4316-ac26-0f313ba646b9}
- %TEMP%\{636ff467-41aa-47d4-8db5-0489aaa5dd16}
- %TEMP%\{afce94c2-15c4-46c0-9ae2-d7a31a079bb6}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\589552e4-8cbd-4c4c-8273-c6b824bc0b71
- %TEMP%\{937fe8c0-60b9-4224-88ec-b228262e06ef}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\92b1cffb-98bd-489d-85a9-ddc13f5d8369
- %TEMP%\{73c132b8-42ec-4f5d-955a-0fbe5bbfdf15}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\704246ff-2a5b-4ba0-a88e-4af01c8d0bb2
- %TEMP%\{ee0d8a19-17fb-4015-b211-d1332c9b0023}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0dde7a88-a5c2-41d6-b34c-e1d9b728cf37
- %TEMP%\{aa42fd31-0113-45a9-8b9e-27739d77cad2}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\b24cf439-e390-48ff-bdc7-91409db805e3
- %TEMP%\{cb98dd5b-5bd6-428a-b3a3-e8b1fa5ce5a6}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\46cf9adc-e6bd-46d1-845f-9c46d317ddec
- %TEMP%\{3755110f-1430-422d-948c-abf01a13d356}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\adf7e214-49f4-4c55-a2d7-8164c13e6e35
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\06eecbf9-58f1-49d7-82dd-28980b9a6892
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\8bbb5859-417d-4fce-93a7-8e5bb437f475
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\3c756f12-2366-4b0f-afd5-251f64e2b9f9
- %TEMP%\{1dc34d6c-c017-4c0c-9dc0-b07cbe40b47b}
- %TEMP%\{af1916c6-7fcc-4f53-b2b6-f35167364bd4}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\c84b9bff-ea49-489d-825d-7959da69a3e1
- %TEMP%\{ecd4065c-7a8b-4eab-b05d-97445cccb494}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\4c20f1ad-9db3-4a48-9712-e80be71c5d6c
- %TEMP%\{7e66a18a-64bd-472e-9fc8-06fa1d1891d3}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\2c0d8e04-f798-42d3-b3fe-b69d8830e1ca
- %TEMP%\{6691b8da-1cb2-4f57-9f50-386a3995ff69}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\cefe7fa9-a52e-4f49-92ee-62ec313eb376
- %TEMP%\{e61db983-8ce4-4c5b-bc14-3ba5fbb93278}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\1f5b048b-460f-40ea-9a03-eb303ea49bc0
- %TEMP%\{290b6a6f-e7e3-4a44-8634-a7ccf5a3e967}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\cd5b7d3b-f3b3-4e4a-a5b9-5bcf1f7525fe
- %TEMP%\{73af2175-8496-4728-aa91-b80c6d404470}
- %TEMP%\{97913646-9959-4252-82db-64a91730e75e}
- %TEMP%\{d6f78b32-2f57-45b9-836f-df5c955b9e7a}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\4788bb55-4d53-48fe-a624-32718407c800
- %TEMP%\{7bc9b56a-e1e0-4a69-aaed-63063b7f465b}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\4d583135-0540-4594-88f6-18029335c6db
- %TEMP%\{0b07b2e1-0900-413f-a486-0c1a82bfdeb0}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\fa8e557d-435d-46e9-8558-35092df34325
- %TEMP%\{fee5ef7e-2fec-45d4-bf76-dd2b624c5bf1}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\072835f6-feb1-45f8-8d70-b1a8d9401029
- %TEMP%\{805ea26d-7c51-437f-af9d-971110d73268}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\889b10ec-9363-4c82-8e44-c0c294347b64
- %TEMP%\{e8163516-ef92-4ffd-8c4a-2b0810222da4}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\61c58293-8c07-4e0e-aceb-cd73c01098ad
- %TEMP%\{b4910f52-b85d-4fe7-9f69-28a11ed173e6}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\2b830d01-9946-49ad-9255-6ee877aba6c9
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\8c0c9dc3-6580-45ed-a92e-34f3de617928
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\78e53d00-7097-45be-a724-8c2c45ca5a4f
- %TEMP%\{b4c7c572-e036-4340-bdd3-996de9d1c67a}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\996131da-4d4a-4279-b667-9d551c285607
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\c017fc3f-562f-4b66-8c2e-6c88f3a9c989
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\fc89d2cd-4599-42e6-8d1b-4fd880723fb4
- %TEMP%\{b6f9ba8e-28ef-4f24-8fac-36eff3f28061}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0ba9d8e0-32de-4c22-bd2a-0680e01a43fc
- %TEMP%\{9461ce1d-cab5-45dd-a21c-770da5d57b8f}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d78126b5-4f59-4ed5-ae3f-77e46f8c9167
- %TEMP%\{5624b21a-f34b-40c7-b88d-af408c96c6f1}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\c4486040-c610-4618-b3a5-66ceac92b39c
- %TEMP%\{529bbe29-c74e-4e95-901a-a75e6dbe02ef}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\33677f2e-1ba5-4f80-975f-af0626e0b56d
- %TEMP%\{6a217c03-518f-4f11-8fdb-cb7265f2ed54}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\10ca911c-7fc2-4ed5-9965-88f551ff7fde
- %TEMP%\{509faed9-c698-435b-8cc5-b648cb0e5887}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\61f61813-12bf-428e-a621-7547de2caf46
- %TEMP%\{1b744747-f5fb-441b-83f7-fde87a75ce31}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\9f30b316-a69f-4bc5-8a08-950c25e91ac9
- %TEMP%\{25e44815-723b-47b3-8383-6360f8149558}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\6f62a19f-e332-4aae-9d39-f6f291597a90
- %TEMP%\{4bbd9062-7a23-4967-9a88-cfb6d93aa1e6}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0b5020d3-7b17-4f8e-8367-556132218efc
- %TEMP%\{91e4e9d0-780f-47fa-9456-9e15c838b400}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\9db21fdf-6d31-44cc-affb-0600a2d3fe02
- %TEMP%\{b2596556-0fa3-46c1-9188-d173e60506bb}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\70501987-d6a0-453a-a50c-0d28efe21a26
- %TEMP%\{b5433603-b878-4172-8bb5-156de5726064}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\9dc38c4c-5874-4997-870c-66e7bc0322c2
- %TEMP%\{f956f68a-1da5-4ca5-8f6e-18ddeae2fa5f}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\e3a059f1-fc38-477d-aa3e-5b13470c44f1
- %TEMP%\{9a9f7976-db47-4202-9239-9ab24dd13cb0}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\24bd032f-9799-4b6b-a717-83aaca91bbf7
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\6dc6ea9d-e309-4d96-af86-75be16a9fa9c
- %TEMP%\{63a42265-81d9-40d7-82d9-cd7c3e8f868b}
- %TEMP%\{031a3f1c-9246-45a7-a931-04df8f6e7ece}
- %TEMP%\{bea3931c-188f-42e3-839b-d3233cb81340}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\475651f1-b0b3-4cee-a1ad-7c686301e2cf
- %TEMP%\{eb53b666-098e-4d4e-8482-7816403158b5}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\4ce0a476-ccff-4b8a-8bbf-2167040d2665
- %TEMP%\{5c2f72a4-427d-4ac3-8d66-074d5de0992d}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\afa26fb4-daf5-4c05-a2ac-4f11f0c7f016
- %TEMP%\{0fc47502-835a-4ac2-8f61-2cb2e552f2cd}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\02c14a7a-abed-4a36-907f-cf06fb6278c2
- %TEMP%\{03474438-f2bf-4a06-9e28-44090abf7176}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d6d824da-a504-4fe7-940e-a2455e09b5d9
- %TEMP%\{caf99f0f-7ca1-4186-80e0-1c0ffcad889b}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\95e370c8-60e6-4fab-9ebd-a61cdb84935a
- %TEMP%\{f574e044-5b37-4b3f-9096-6bd66f377a78}
- %TEMP%\{d2859ae2-bfd5-4591-a5fd-b4ec5dd7567e}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\bd20a4ed-ddb1-4025-bca5-25853ec3830e
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\2147f109-1c62-4e69-b80a-c2123d58b00c
- %TEMP%\{aea6679f-e118-4196-a9d8-9700ebc5e8c3}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\af222283-52f9-43f3-a866-7916bb59e5c0
- %TEMP%\{711c1135-e9f8-481e-85bd-6ae52eb81e13}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\67a8d4d1-9cdf-4e7e-9cc6-e2522c42c112
- %TEMP%\{0bb910b2-eeb3-4533-817d-efce84a2bd7c}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\5273e1fd-51c0-4978-b06f-b2d159de7a3e
- %TEMP%\{1b8e4d49-25c6-4024-8f53-93d9d1f67bf3}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a3704fa2-8762-46eb-bb24-97a269f2ed03
- %TEMP%\{f1999cde-dcbb-4d61-899d-e76f7434ec47}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\3155d78c-1584-4dec-9449-314a3d550d29
- %TEMP%\{e21658da-52e2-4ca4-9e9c-cc7ad8e7824d}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\81d4fff9-3a82-43ac-80e6-41fcea4509cd
- %TEMP%\{7921e01a-c0ea-41e4-9703-5cabee8114a0}
- %TEMP%\{5d72a0b5-dc28-478e-afd9-57ff66296bc2}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\cb7dd0d6-b3c8-43cd-a74e-1016d2abe1de
- %TEMP%\{b8933450-3227-410e-a883-215913784715}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\bdde27ea-6a12-4825-bfac-f600b0f142fa.png
- %TEMP%\{72fe9f84-f02f-4982-ab76-2c69815e3882}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0ec91619-5478-4e5c-aa1b-8da00a066091.png
- %TEMP%\{3e5f3eb2-9a91-4bd1-b0e0-3c43256c3d36}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\2d02d28e-c843-42a7-ba9c-3541f1bd4e3a.png
- %TEMP%\{b87ef6d4-0f03-4384-b0c5-979cee4463bb}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\5318eba9-773d-4fec-9366-6e84f8dfbbc5.png
- %TEMP%\{aeff6016-5c6f-4965-98a4-f7e12278e737}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d2a0e881-e736-4694-b4e5-62a677ac17bf.png
- %TEMP%\{abb2b968-00e7-4f1d-aaab-927a04dad733}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\6d6e34b9-0e90-470c-ada3-2b00b4b8ffac.png
- %TEMP%\{dc368ece-9e60-4ca0-8f7f-3b1f1f46d463}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\4f92e887-7fef-4a98-9f74-501f37835639.png
- %TEMP%\{461c9ae0-ae38-4641-8272-75dfc8dab184}
- %TEMP%\{d67d1fa2-1d2c-419d-bad7-3aa0d51020bc}
- %TEMP%\{f71f6a1d-7e0e-48be-b52a-e37be2a25e0b}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a4fbc2bf-8cc2-4a6d-b3c7-0ef749399e7f.png
- %TEMP%\{04fce79e-7c24-4f7e-9812-d48801298fd5}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\52c39d7c-6d6b-4ad3-b5e5-c417949d335d.png
- %TEMP%\{7627ea80-6fad-46a2-b720-a2dee3b78d10}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\ee4479ee-b960-4d54-abc8-c9e95e2bf81f.png
- %TEMP%\{d015efcc-4345-4437-9f16-259a00674237}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\3c6a9801-329c-4eba-9524-2165ac426bef.png
- %TEMP%\{e71afb31-c4c4-4066-9ec6-fd951773aa73}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\07a5080e-becd-4719-9a79-fe50b59eb55b.png
- %TEMP%\{a563903c-1cbb-40e5-a8c4-6f201b8dc134}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0ff838eb-89b4-4a2f-881a-6e583195d26c.png
- %TEMP%\{4f0a0a71-69e4-48c3-9ab1-4efb2e74042e}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\70c3a864-35fa-4245-802a-dbda1e3f4c00.png
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a4f6c176-53e1-47b9-8fe4-8bb920684ff3.png
- %TEMP%\{d30d4a94-0113-4040-8438-9243d798b1ad}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\e29a7eaf-32ad-400c-9927-05c358358ffc.png
- %HOMEPATH%\documents\onenote notebooks\personal\open notebook.onetoc2
- %HOMEPATH%\documents\onenote notebooks\personal\general.one
- %TEMP%\onenoteruntimecache\14.0\onenoteruntimecache.onecache
- %TEMP%\{d12ecce5-95fd-4be0-91c2-ccf7345fff7d}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\b2a67a4a-c116-4c88-9fd1-c5b9a23d7929.png
- %TEMP%\{5ccb1f4b-3789-4861-b6a1-deb6a6ebe6c1}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\03809a07-348b-48cc-b08d-f7b8472c133c.png
- %TEMP%\{547aa519-5a53-4e2f-a2b5-a70e9a663d66}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a507cd65-0038-49e4-8cdb-b6082f566351.png
- %TEMP%\{cfe10e7e-7003-48a8-938d-e1ad27d05519}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\7dceec06-0991-43f4-8af3-601c0ebeb910.png
- %TEMP%\{8d48a739-80c3-40ea-8667-8d7a15c07947}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\bf4e96cf-9460-4049-8172-cfb4bec57f8e.png
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\b1503304-9b12-4d90-89e7-df30e304e6c2.png
- %TEMP%\onenote_migrationlog.txt
- %TEMP%\{879bb056-abee-4c5a-9bde-fb07fa628ee0}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\bb4e150b-7e2a-4556-81dd-590d7ab07dda.png
- %TEMP%\{3679de17-5423-4e9c-86ac-fe6c4bbd506b}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\1e81fb27-0aa3-4b11-a764-0d9e7e3272ea.png
- %TEMP%\{e6f4bd06-df62-45ce-892f-39c6b0f48a19}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\62e3dfa2-4350-445b-8693-d1d04a74543c.png
- %TEMP%\{16d51ec6-3b1e-45fa-b98a-40f2cf94c3e4}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d137f4ab-4b3d-439e-836f-ffbbc700bef1.png
- %TEMP%\{d9396cd1-1968-47d9-b3d1-c9869f83f3e2}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\e5116f77-b907-4c46-8bfa-006092a6714d.png
- %TEMP%\{bacd90cc-959f-4200-a68a-7afe3cf21f43}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a9e6bb3f-0b62-4410-86f7-68bb36989df7.png
- %TEMP%\{c3ba1f8b-6d84-4cd3-98da-e867d23a5d45}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\e51cf594-e321-4d1c-88e7-df9cde80904c.png
- %TEMP%\{642546ea-9813-4d6a-921a-40435592405a}
- %TEMP%\{8a4dc9c4-6e32-4def-84de-60f2bd2c2c83}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d13b95bf-2bb1-4c3d-a85c-9ac5e1cb3884.png
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\6a8b0e06-e9a5-4761-afda-29391149e64d.png
- %TEMP%\{26ed4873-8a66-4552-b450-1d929b507e59}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\42a4aea1-ab77-4cf7-a3cb-14953248ceea.png
- %TEMP%\{7d242158-1e1b-4eb9-af1e-26cdaad18a80}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d024a53a-b32a-417d-8f75-e1998be423af.png
- %APPDATA%\microsoft\onenote\14.0\preferences.dat
- %TEMP%\{dd3cc345-be97-4a27-85ca-5b73bc53941c}
- %HOMEPATH%\documents\onenote notebooks\personal\unfiled notes.one
- %TEMP%\{b7868c76-a6a8-4ad7-927b-aa7b1d95011e}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d8c634d0-56f4-4f38-8b3c-8f21b0f6989c
- %TEMP%\{91822adf-cc2d-42b2-bb3d-03da78e3675b}
- %TEMP%\{0f06d813-78f0-4cb5-a50e-b54c566bcf54}
- %TEMP%\{d2372d38-f1f8-43e7-9b8f-aaa5a230d709}
- %TEMP%\{363556c0-3261-479f-9acf-31f025a8d650}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\1bf85fd8-2752-4457-88c6-58e635274be9
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\c74af4e7-e369-4bf8-9a79-9752f94d43cf
- %TEMP%\{62c4b661-6723-429c-9979-d6523c9a1cf3}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\8b399897-1cdd-4622-8d42-0218b5374e30
- %TEMP%\{d1b7c26f-55df-44ad-b184-d61171700125}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\6f0d52f9-b478-4adc-9f25-e3a894df2df4
- %TEMP%\{a0acf6f7-5747-4550-8f32-0ec70996507b}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a38314c2-1c90-4034-8095-42260e20eb20
- %TEMP%\{7589cea8-3617-4276-a8e4-6a3012460d05}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\8fc790b8-6f88-4e18-99e0-1eaa9b021fe2
- %TEMP%\{c8ebae85-b022-4bec-83a8-dbff0e500a51}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\7d014bed-5d20-470d-9655-bcf9c82d04f6
- %TEMP%\{4658d62d-7862-4ef6-bb0c-5f3508750e7b}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\080158a4-05b2-4392-9dd9-be70cc27d215
- %TEMP%\{2c57c027-3054-4390-9669-541eb207c195}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\0d984a6a-e70e-4747-bded-b92173e85c21.png
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\115556d6-ba8b-4b18-8439-8e9c81ff63a4.png
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\c129b038-2a0f-4994-b354-64ed233a0973.png
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\1a16981c-377d-4a10-9522-787f93302c18.png
- %TEMP%\{af09e311-2ebf-4162-9f2a-70c8293e388d}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\70d1f452-966e-4e28-8da5-8b2eeadbe078.png
- %TEMP%\{8aa1139d-2c3d-4eac-969f-22edc2458f53}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\3506c6f4-6090-46ec-9fb3-0e2963361ba0.png
- %TEMP%\{3faa2b55-2eee-4163-a5c8-2703efbb13c9}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\8339d228-5ca6-486f-8793-633aa6af18d8.png
- %TEMP%\{2ecf4ede-57c0-445f-82bf-363a45859af6}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d32a2c63-e181-4374-a527-d8ec3791e0cc.png
- %TEMP%\{bc598a92-6994-4a6b-ab2e-8e98ddeb7adf}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\7b168dd1-e39e-4b39-918c-53b9e78365e9.png
- %TEMP%\{2d8fbead-f382-42e1-a1df-daeacadd0ac5}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\072143f8-573f-45cb-b0b1-04f7bf2da18e.png
- %TEMP%\{279de2a9-950a-4ce8-a28a-1fbd2a663e96}
- %TEMP%\{c8d7d36d-8d02-4b5d-bae6-5e8a7a0fd89c}
- %TEMP%\{ef8ef50f-30ba-4d2f-92a4-a3528c7dd538}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\e7a7c0d5-0e34-4323-9576-f37e394faa8a.png
- %TEMP%\{4420630d-baec-4641-ba37-6d525e45d9f3}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\79a073b8-0713-4166-af23-3272c394a92a.png
- %TEMP%\{20cd19cd-869d-4635-9b8a-a905332a5720}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\a6f0f9a9-e50d-4612-9e8e-f5640793680c.png
- %TEMP%\{6e202490-834f-4a33-bcf2-ca2c44805a9c}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\d6f82e07-6756-4003-877a-af43e54f9781.png
- %TEMP%\{590eb07d-78c3-40c3-b88d-cea7f9e6a620}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\be1e893c-ed6d-4ac9-933e-dd5340e7c76f.png
- %TEMP%\{3415cc0d-00f2-4e39-ad85-68304cffceaf}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\f173a3a2-bd1a-460f-b78a-faf2a51f6d91.png
- %TEMP%\{448a9326-ef83-4961-8efe-fb70bf017eba}
- %LOCALAPPDATA%\microsoft\onenote\14.0\onenoteofflinecache_files\5394c05d-dc33-4d24-bd45-2d8954648f28.png
- %TEMP%\{c8afddea-f849-4f0e-a0e7-23589dcb744f}
- %APPDATA%\microsoft\templates\open notebook.onetoc2
Deletes the following files
- %TEMP%\{dd3cc345-be97-4a27-85ca-5b73bc53941c}
- %TEMP%\{cb98dd5b-5bd6-428a-b3a3-e8b1fa5ce5a6}
- %TEMP%\{aa42fd31-0113-45a9-8b9e-27739d77cad2}
- %TEMP%\{ee0d8a19-17fb-4015-b211-d1332c9b0023}
- %TEMP%\{73c132b8-42ec-4f5d-955a-0fbe5bbfdf15}
- %TEMP%\{937fe8c0-60b9-4224-88ec-b228262e06ef}
- %TEMP%\{1dc34d6c-c017-4c0c-9dc0-b07cbe40b47b}
- %TEMP%\{515c7577-9014-4316-ac26-0f313ba646b9}
- %TEMP%\{10ea474a-a11f-447b-92da-2a43ac5ba291}
- %TEMP%\{6f17dfa5-599a-4c81-a3ef-f6f118b462a5}
- %TEMP%\{a065d086-8cdd-48a6-a8f1-7210bb18419b}
- %TEMP%\{a8899174-f0f4-4cd7-b220-2086c1e28bf4}
- %TEMP%\{cb8d360b-230c-4d27-a401-d60d5136898d}
- %TEMP%\{afce94c2-15c4-46c0-9ae2-d7a31a079bb6}
- %TEMP%\{d6f78b32-2f57-45b9-836f-df5c955b9e7a}
- %TEMP%\{97913646-9959-4252-82db-64a91730e75e}
- %TEMP%\{b4910f52-b85d-4fe7-9f69-28a11ed173e6}
- %TEMP%\{e8163516-ef92-4ffd-8c4a-2b0810222da4}
- %TEMP%\{805ea26d-7c51-437f-af9d-971110d73268}
- %TEMP%\{fee5ef7e-2fec-45d4-bf76-dd2b624c5bf1}
- %TEMP%\{0b07b2e1-0900-413f-a486-0c1a82bfdeb0}
- %TEMP%\{7bc9b56a-e1e0-4a69-aaed-63063b7f465b}
- %TEMP%\{af1916c6-7fcc-4f53-b2b6-f35167364bd4}
- %TEMP%\{73af2175-8496-4728-aa91-b80c6d404470}
- %TEMP%\{290b6a6f-e7e3-4a44-8634-a7ccf5a3e967}
- %TEMP%\{e61db983-8ce4-4c5b-bc14-3ba5fbb93278}
- %TEMP%\{6691b8da-1cb2-4f57-9f50-386a3995ff69}
- %TEMP%\{7e66a18a-64bd-472e-9fc8-06fa1d1891d3}
- %TEMP%\{3755110f-1430-422d-948c-abf01a13d356}
- %TEMP%\{636ff467-41aa-47d4-8db5-0489aaa5dd16}
- %TEMP%\{63a42265-81d9-40d7-82d9-cd7c3e8f868b}
- %TEMP%\{f574e044-5b37-4b3f-9096-6bd66f377a78}
- %TEMP%\{b5433603-b878-4172-8bb5-156de5726064}
- %TEMP%\{b2596556-0fa3-46c1-9188-d173e60506bb}
- %TEMP%\{91e4e9d0-780f-47fa-9456-9e15c838b400}
- %TEMP%\{4bbd9062-7a23-4967-9a88-cfb6d93aa1e6}
- %TEMP%\{25e44815-723b-47b3-8383-6360f8149558}
- %TEMP%\{9a9f7976-db47-4202-9239-9ab24dd13cb0}
- %TEMP%\{509faed9-c698-435b-8cc5-b648cb0e5887}
- %TEMP%\{6a217c03-518f-4f11-8fdb-cb7265f2ed54}
- %TEMP%\{529bbe29-c74e-4e95-901a-a75e6dbe02ef}
- %TEMP%\{5624b21a-f34b-40c7-b88d-af408c96c6f1}
- %TEMP%\{9461ce1d-cab5-45dd-a21c-770da5d57b8f}
- %TEMP%\{b6f9ba8e-28ef-4f24-8fac-36eff3f28061}
- %TEMP%\{1b744747-f5fb-441b-83f7-fde87a75ce31}
- %TEMP%\{031a3f1c-9246-45a7-a931-04df8f6e7ece}
- %TEMP%\{d2859ae2-bfd5-4591-a5fd-b4ec5dd7567e}
- %TEMP%\{f1999cde-dcbb-4d61-899d-e76f7434ec47}
- %TEMP%\{1b8e4d49-25c6-4024-8f53-93d9d1f67bf3}
- %TEMP%\{0bb910b2-eeb3-4533-817d-efce84a2bd7c}
- %TEMP%\{711c1135-e9f8-481e-85bd-6ae52eb81e13}
- %TEMP%\{aea6679f-e118-4196-a9d8-9700ebc5e8c3}
- %TEMP%\{7921e01a-c0ea-41e4-9703-5cabee8114a0}
- %TEMP%\{e21658da-52e2-4ca4-9e9c-cc7ad8e7824d}
- %TEMP%\{caf99f0f-7ca1-4186-80e0-1c0ffcad889b}
- %TEMP%\{03474438-f2bf-4a06-9e28-44090abf7176}
- %TEMP%\{0fc47502-835a-4ac2-8f61-2cb2e552f2cd}
- %TEMP%\{5c2f72a4-427d-4ac3-8d66-074d5de0992d}
- %TEMP%\{eb53b666-098e-4d4e-8482-7816403158b5}
- %TEMP%\{bea3931c-188f-42e3-839b-d3233cb81340}
- %TEMP%\{f956f68a-1da5-4ca5-8f6e-18ddeae2fa5f}
- %TEMP%\{ecd4065c-7a8b-4eab-b05d-97445cccb494}
- %TEMP%\{b4c7c572-e036-4340-bdd3-996de9d1c67a}
- %TEMP%\{5d72a0b5-dc28-478e-afd9-57ff66296bc2}
- %TEMP%\{bc598a92-6994-4a6b-ab2e-8e98ddeb7adf}
- %TEMP%\{2ecf4ede-57c0-445f-82bf-363a45859af6}
- %TEMP%\{3faa2b55-2eee-4163-a5c8-2703efbb13c9}
- %TEMP%\{8aa1139d-2c3d-4eac-969f-22edc2458f53}
- %TEMP%\{af09e311-2ebf-4162-9f2a-70c8293e388d}
- %TEMP%\{279de2a9-950a-4ce8-a28a-1fbd2a663e96}
- %TEMP%\{8a4dc9c4-6e32-4def-84de-60f2bd2c2c83}
- %TEMP%\{461c9ae0-ae38-4641-8272-75dfc8dab184}
- %TEMP%\{a563903c-1cbb-40e5-a8c4-6f201b8dc134}
- %TEMP%\{e71afb31-c4c4-4066-9ec6-fd951773aa73}
- %TEMP%\{d015efcc-4345-4437-9f16-259a00674237}
- %TEMP%\{7627ea80-6fad-46a2-b720-a2dee3b78d10}
- %TEMP%\{04fce79e-7c24-4f7e-9812-d48801298fd5}
- %TEMP%\{f71f6a1d-7e0e-48be-b52a-e37be2a25e0b}
- %TEMP%\{4f0a0a71-69e4-48c3-9ab1-4efb2e74042e}
- %TEMP%\{dc368ece-9e60-4ca0-8f7f-3b1f1f46d463}
- %TEMP%\{abb2b968-00e7-4f1d-aaab-927a04dad733}
- %TEMP%\{aeff6016-5c6f-4965-98a4-f7e12278e737}
- %TEMP%\{b87ef6d4-0f03-4384-b0c5-979cee4463bb}
- %TEMP%\{3e5f3eb2-9a91-4bd1-b0e0-3c43256c3d36}
- %TEMP%\{72fe9f84-f02f-4982-ab76-2c69815e3882}
- %TEMP%\{642546ea-9813-4d6a-921a-40435592405a}
- %TEMP%\{d67d1fa2-1d2c-419d-bad7-3aa0d51020bc}
- %TEMP%\{d30d4a94-0113-4040-8438-9243d798b1ad}
- %TEMP%\{bacd90cc-959f-4200-a68a-7afe3cf21f43}
- %TEMP%\{d9396cd1-1968-47d9-b3d1-c9869f83f3e2}
- %TEMP%\{16d51ec6-3b1e-45fa-b98a-40f2cf94c3e4}
- %TEMP%\{2d8fbead-f382-42e1-a1df-daeacadd0ac5}
- %TEMP%\{c8d7d36d-8d02-4b5d-bae6-5e8a7a0fd89c}
- %TEMP%\{ef8ef50f-30ba-4d2f-92a4-a3528c7dd538}
- %TEMP%\{4420630d-baec-4641-ba37-6d525e45d9f3}
- %TEMP%\{c8ebae85-b022-4bec-83a8-dbff0e500a51}
- %TEMP%\{7589cea8-3617-4276-a8e4-6a3012460d05}
- %TEMP%\{a0acf6f7-5747-4550-8f32-0ec70996507b}
- %TEMP%\{d1b7c26f-55df-44ad-b184-d61171700125}
- %TEMP%\{62c4b661-6723-429c-9979-d6523c9a1cf3}
- %TEMP%\{2c57c027-3054-4390-9669-541eb207c195}
- %TEMP%\{4658d62d-7862-4ef6-bb0c-5f3508750e7b}
- %TEMP%\{91822adf-cc2d-42b2-bb3d-03da78e3675b}
- %TEMP%\{b7868c76-a6a8-4ad7-927b-aa7b1d95011e}
- %TEMP%\{7d242158-1e1b-4eb9-af1e-26cdaad18a80}
- %TEMP%\{26ed4873-8a66-4552-b450-1d929b507e59}
- %TEMP%\{363556c0-3261-479f-9acf-31f025a8d650}
- %TEMP%\{0f06d813-78f0-4cb5-a50e-b54c566bcf54}
- %TEMP%\{448a9326-ef83-4961-8efe-fb70bf017eba}
- %TEMP%\{d2372d38-f1f8-43e7-9b8f-aaa5a230d709}
- %TEMP%\{3415cc0d-00f2-4e39-ad85-68304cffceaf}
- %TEMP%\{590eb07d-78c3-40c3-b88d-cea7f9e6a620}
- %TEMP%\{6e202490-834f-4a33-bcf2-ca2c44805a9c}
- %TEMP%\{20cd19cd-869d-4635-9b8a-a905332a5720}
- %TEMP%\{e6f4bd06-df62-45ce-892f-39c6b0f48a19}
- %TEMP%\{3679de17-5423-4e9c-86ac-fe6c4bbd506b}
- %TEMP%\{879bb056-abee-4c5a-9bde-fb07fa628ee0}
- %TEMP%\{c3ba1f8b-6d84-4cd3-98da-e867d23a5d45}
- %TEMP%\{8d48a739-80c3-40ea-8667-8d7a15c07947}
- %TEMP%\{cfe10e7e-7003-48a8-938d-e1ad27d05519}
- %TEMP%\{547aa519-5a53-4e2f-a2b5-a70e9a663d66}
- %TEMP%\{5ccb1f4b-3789-4861-b6a1-deb6a6ebe6c1}
- %TEMP%\{d12ecce5-95fd-4be0-91c2-ccf7345fff7d}
- %TEMP%\{b8933450-3227-410e-a883-215913784715}
- %TEMP%\{c8afddea-f849-4f0e-a0e7-23589dcb744f}
Network activity
UDP
- DNS ASK do##.live.net
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'TF_FloatingLangBar_WndTitle'
- ClassName: 'NetUICtrlNotifySink' WindowName: ''
- ClassName: 'REListbox20W' WindowName: ''
- ClassName: 'OfficeTooltip' WindowName: ''
- ClassName: 'MsoCommandBarPopup' WindowName: ''
Executes the following
- '%ProgramFiles%\Microsoft Office\Office14\ONENOTE.EXE' Analysis Services\Office14\ONENOTE.EXE -Embedding
- '%ProgramFiles%\microsoft office\office14\onenotem.exe'
