Trojan.Siggen34.18030

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\cauceagentinstaller

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\CauceAgent] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\CauceAgent] 'ImagePath' = '%ProgramFiles(x86)%\CauceAgent\CauceAgent_00.13.27.exe /s'

Creates the following services

'CauceAgent' %ProgramFiles(x86)%\CauceAgent\CauceAgent_00.13.27.exe /s

Modifies file system

Creates the following files

%ProgramFiles(x86)%\cauceagent\cauceagentinstaller_00.13.27.log
C:\temp\cauceagentinstalltask\cauceagentinstaller.exe
%TEMP%\aut13f1.tmp
%ProgramFiles(x86)%\cauceagent\cauceagent_00.13.27.exe
%TEMP%\aut1cbc.tmp
%ProgramFiles(x86)%\cauceagent\uninstall.bat
%WINDIR%\temp\ocr20a3.tmp\src\lib\cauce.rb
%WINDIR%\temp\ocr20a3.tmp\src\lib\dhcptest.exe
%WINDIR%\temp\ocr20a3.tmp\src\lib\wget_cauceagent.exe
%WINDIR%\temp\ocr20a3.tmp\src\lib\swinventory.exe
%WINDIR%\temp\ocr20a3.tmp\src\lib\options.rb
%WINDIR%\temp\ocr20a3.tmp\src\lib\log.rb
%WINDIR%\temp\ocr20a3.tmp\src\lib\inventory.rb
%WINDIR%\temp\ocr20a3.tmp\src\lib\upload.rb
%WINDIR%\temp\ocr20a3.tmp\src\lib\download.rb
%WINDIR%\temp\ocr20a3.tmp\src\lib\win32filetime.rb
%WINDIR%\temp\ocr20a3.tmp\src\lib\execute.rb
%WINDIR%\temp\ocr20a3.tmp\src\lib\ocra_cleaner.rb
%WINDIR%\temp\ocr20a3.tmp\src\lib\environment.rb
%WINDIR%\temp\ocr20a3.tmp\src\lib\licensing.rb
%WINDIR%\temp\ocr20a3.tmp\src\lib\tickle.rb
%WINDIR%\temp\ocr20a3.tmp\src\lib\domaintxt.rb
%WINDIR%\temp\ocr20a3.tmp\bin\ruby.exe
%WINDIR%\temp\ocr20a3.tmp\bin\msvcrt-ruby200.dll
%WINDIR%\temp\ocr20a3.tmp\bin\libffi-6.dll
%WINDIR%\temp\ocr20a3.tmp\bin\libeay32.dll
%WINDIR%\temp\ocr20a3.tmp\bin\ssleay32.dll
%WINDIR%\temp\ocr20a3.tmp\bin\zlib1.dll
%WINDIR%\temp\ocr20a3.tmp\bin\libyaml-0-2.dll
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\specifications\default\psych-2.0.0.gemspec
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\specifications\ffi-1.9.25-x86-mingw32.gemspec
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\specifications\net-ldap-0.19.0.gemspec
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\specifications\net-ping-2.0.8.gemspec
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\specifications\ocra-1.3.11.gemspec
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\specifications\win32-service-0.8.8.gemspec
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\encdb.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\iso_8859_1.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\transdb.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\rbconfig.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\rubygems\compatibility.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\rubygems\defaults.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\rubygems\deprecate.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\rubygems\errors.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\rubygems\version.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\rubygems\requirement.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\rubygems\platform.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\rubygems\specification.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\rubygems\exceptions.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\rubygems\defaults\operating_system.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\utf_16le.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\utf_16_32.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\rubygems\core_ext\kernel_gem.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\thread.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\monitor.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\rubygems\core_ext\kernel_require.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\rubygems.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\rubygems\dependency.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\rubygems\path_support.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\single_byte.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\dl.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\fiddle.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\fiddle\function.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\fiddle\closure.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\fiddle.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\dl.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\win32api.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\win32ole.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\fiddle\value.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\fiddle\pack.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\fiddle\struct.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\fiddle\cparser.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\fiddle\import.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\win32\registry.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\ostruct.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\digest.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\digest.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\openssl.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\openssl\bn.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\openssl\cipher.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\stringio.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\openssl\config.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\openssl\digest.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\openssl\x509.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\openssl\buffering.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\fcntl.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\openssl\ssl.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\openssl.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\socket.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\socket.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ldap\version.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ber\ber_parser.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ber\core_ext\string.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ber\core_ext\array.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ber\core_ext\integer.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ber\core_ext\true_class.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ber\core_ext\false_class.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ber\core_ext.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ber.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ldap\pdu.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ldap\filter.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ldap\dataset.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\digest\sha1.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\digest\sha2.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\digest\sha2.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\digest\md5.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\base64.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\securerandom.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ldap\password.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ldap\entry.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ldap\instrumentation.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ldap\connection.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ldap\error.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ldap\auth_adapter.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ldap\auth_adapter\simple.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ldap\auth_adapter\sasl.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\lib\net\ldap.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\syntax_error.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\psych.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\nodes\node.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\nodes\stream.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\nodes\document.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\nodes\sequence.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\nodes\scalar.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\nodes\mapping.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\nodes\alias.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\nodes.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\streaming.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\visitors\visitor.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\strscan.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\scalar_scanner.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\visitors\to_ruby.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\visitors\emitter.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\visitors\yaml_tree.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\json\ruby_events.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\visitors\json_tree.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\visitors\depth_first.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\visitors.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\handler.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\tree_builder.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\parser.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\omap.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\set.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\coder.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\core_ext.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\date_core.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\date\format.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\date.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\deprecated.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\stream.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\json\yaml_events.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\json\tree_builder.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\json\stream.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych\handlers\document_stream.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\psych.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\yaml.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\timeout.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ping-2.0.8\lib\net\ping\ping.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ping-2.0.8\lib\net\ping\tcp.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\ipaddr.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\net\protocol.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\uri\common.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\uri\generic.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\uri\ftp.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\uri\http.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\uri\https.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\uri\ldap.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\uri\ldaps.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\uri\mailto.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\uri.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\zlib.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\net\http\exceptions.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\net\http\header.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\net\http\generic_request.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\net\http\request.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\net\http\requests.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\net\http\response.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\net\http\responses.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\net\http\proxy_delta.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\net\http\backward.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\net\http.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\cgi\core.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\cgi\util.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\cgi\cookie.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\cgi.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\etc.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\fileutils.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\english.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\types.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\library.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\errno.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\pointer.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\memorypointer.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\struct_layout_builder.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\struct.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\union.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\managedstruct.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\callback.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\io.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\autopointer.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\variadic.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\enum.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\ffi.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\win32-service-0.8.8\lib\win32\windows\helper.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\win32-service-0.8.8\lib\win32\windows\constants.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\win32-service-0.8.8\lib\win32\windows\structs.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\win32-service-0.8.8\lib\win32\windows\functions.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\win32-service-0.8.8\lib\win32\daemon.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\dl\callback.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\cgi\html.rb
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\big5.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\cp949.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\emacs_mule.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\euc_jp.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\euc_kr.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\euc_tw.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\gb18030.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\gb2312.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\gbk.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\iso_8859_10.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\iso_8859_11.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\iso_8859_13.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\iso_8859_14.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\iso_8859_15.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\iso_8859_16.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\iso_8859_2.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\iso_8859_3.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\iso_8859_4.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\iso_8859_5.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\iso_8859_6.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\iso_8859_7.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\iso_8859_8.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\iso_8859_9.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\koi8_r.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\koi8_u.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\shift_jis.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\big5.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\chinese.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\emoji.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\emoji_iso2022_kddi.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\emoji_sjis_docomo.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\emoji_sjis_kddi.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\emoji_sjis_softbank.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\escape.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\gb18030.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\gbk.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\iso2022.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\japanese.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\japanese_euc.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\japanese_sjis.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\korean.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\trans\utf8_mac.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\utf_16be.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\utf_32be.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\utf_32le.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\windows_1251.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\2.0.0\i386-mingw32\enc\windows_31j.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\.gitignore
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\.gitmodules
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\.travis.yml
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\.yardopts
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\appveyor.yml
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\copying
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\ffi.gemspec
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\gemfile
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\2.0\ffi_c.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\2.1\ffi_c.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\2.2\ffi_c.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\2.3\ffi_c.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\2.4\ffi_c.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\2.5\ffi_c.so
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\aarch64-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\arm-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\i386-cygwin\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\i386-darwin\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\i386-freebsd\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\i386-gnu\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\i386-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\i386-netbsd\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\i386-openbsd\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\i386-solaris\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\i386-windows\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\ia64-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\mips-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\mips64-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\mips64el-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\mipsel-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\mipsisa32r6-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\mipsisa32r6el-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\mipsisa64r6-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\mipsisa64r6el-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\powerpc-aix\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\powerpc-darwin\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\powerpc-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\powerpc64-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\s390-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\s390x-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\sparc-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\sparc-solaris\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\sparc64-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\sparcv9-solaris\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\x86_64-cygwin\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\x86_64-darwin\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\x86_64-freebsd\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\x86_64-linux\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\x86_64-netbsd\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\x86_64-openbsd\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\x86_64-solaris\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ffi-1.9.25-x86-mingw32\lib\ffi\platform\x86_64-windows\types.conf
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ldap-0.19.0\hacking.rdoc
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ping-2.0.8\gemfile
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ping-2.0.8\gemfile.lock
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\net-ping-2.0.8\net-ping.gemspec
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ocra-1.3.11\bin\ocra
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ocra-1.3.11\share\ocra\edicon.exe
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ocra-1.3.11\share\ocra\lzma.exe
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ocra-1.3.11\share\ocra\stub.exe
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\ocra-1.3.11\share\ocra\stubw.exe
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\win32-service-0.8.8\appveyor.yml
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\win32-service-0.8.8\certs\djberg96_pub.pem
%WINDIR%\temp\ocr20a3.tmp\lib\ruby\gems\2.0.0\gems\win32-service-0.8.8\win32-service.gemspec
%ProgramFiles(x86)%\cauceagent\cauceagent.log

Deletes following files that it created itself

%TEMP%\aut13f1.tmp
%TEMP%\aut1cbc.tmp
C:\temp\cauceagentinstalltask\cauceagentinstaller.exe
<SYSTEM32>\tasks\cauceagentinstaller

Network activity

Connects to

'<LOCALNET>..28.2':636
'localhost':636

UDP

DNS ASK Do###########s.medusa.gobiernodecanarias.net
DNS ASK me####.##biernodecanarias.net
DNS ASK Do######sZones.workgroup

Miscellaneous

Creates and executes the following

'%ProgramFiles(x86)%\cauceagent\cauceagent_00.13.27.exe' /s
'%WINDIR%\temp\ocr20a3.tmp\bin\ruby.exe' "%WINDIR%\TEMP\ocr20A3.tmp\src\lib\cauce.rb" /s

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /TN CauceAgentInstaller /F
'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /tn CauceAgentInstaller /tr "c:\temp\CauceAgentInstallTask\CauceAgentInstaller.exe" /sc onstart /ru "SYSTEM"
'%WINDIR%\syswow64\sc.exe' failure CauceAgent reset= 86400 actions= restart/60000/restart/60000/restart/60000
'%WINDIR%\syswow64\schtasks.exe' /create /tn CauceAgentInstaller /tr "c:\temp\CauceAgentInstallTask\CauceAgentInstaller.exe" /sc onstart /ru "SYSTEM"
'%WINDIR%\syswow64\schtasks.exe' /delete /TN CauceAgentInstaller /F
'%WINDIR%\syswow64\netstat.exe' -e -s -p icmp
'%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /TN CauceAgentInstaller /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /tn CauceAgentInstaller /tr "c:\temp\CauceAgentInstallTask\CauceAgentInstaller.exe" /sc onstart /ru "SYSTEM"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' failure CauceAgent reset= 86400 actions= restart/60000/restart/60000/restart/60000' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней