Analysé par: Janus Agcaoili   
 

PUP.Optional.MultiPlug (Malwarebytes), a variant of Win32/Adware.MultiPlug.NA (ESET-NOD32), W32/MultiPlug.O.gen!Eldorado (FProt)

 Plate-forme:

Windows

 Overall Risk:
 Dommages potentiels: :
 Distribution potentielle: :
 reportedInfection:
 Information Exposure Rating::
Faible
Medium
Élevé
Critique

  • Type de grayware:
    Potentially Unwanted Application

  • Destructif:
    Non

  • Chiffrement:
    Oui

  • In the wild::
    Oui

  Overview

Voie d'infection: Aus dem Internet heruntergeladen, Fallen gelassen von anderer Malware

Wird als eine Komponente eines Malware-/Grayware-/Spyware-Pakets übertragen.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Verbindet sich mit einer bestimmten Website, um Daten zu versenden und zu empfangen.

  Détails techniques

File size: 1,600,512 bytes
File type: DLL
Memory resident: Oui
Date de réception des premiers échantillons: 16 janvier 2017
Charge malveillante: Connects to URLs/IPs, Steals information, Drops files

Übertragungsdetails

Wird als eine Komponente eines Malware-/Grayware-/Spyware-Pakets übertragen.

Installation

Schleust eine Kopie von sich selbst in folgende Ordner ein, wobei verschiedene Dateinamen verwendet werden:

  • %ProgramFiles%\PragmaSystem\PragmaSystem.dll <- if it does not exist in this path

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

  • DA.{Random 8 Hex Characters)
  • DQ.{Random 8 Hex Characters)
  • i{12DA0E6F-5543-440C-BAA2-28BF01070AFA}

Autostart-Technik

Fügt die folgenden Dienste hinzu und führt sie aus:

  • Service Name: 00eff4f8
    Display Name: PragmaSystem
    Start Type: SERVICE_AUTO_START
    Binary Pathname: "%System%\rundll32.exe" "ProgramFiles%\PragnaSystem\PragnaSystem.dll",serv

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows XP und Server 2003.)

Andere Systemänderungen

Fügt die folgenden Registrierungsschlüssel hinzu:

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_{Random 8 Hex Characters}\eae10f9d

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\00000000

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\00000000

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}

HKEY_LOCAL_MACHINE\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}

HKEY_LOCAL_MACHINE\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
00000000

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8

Fügt die folgenden Registrierungseinträge hinzu:

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_{Random 8 Hex Characters}\eae10f9d
340d3099 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_{Random 8 Hex Characters}\eae10f9d
dbaf3ce3 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
340d3099 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
dbaf3ce3 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
date = "1484763486"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
date = "1484763486"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
data.0 = "mlBtq3FthP8MNh0123i2uOK9AsZEwjVlZPSh+Do9RSOn+7+86QzIang0vuU1YEu8CKbMH9VNP"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
data.0 = "mlBtq3FthP8MNh0123i2uOK9AsZEwjVlZPSh+Do9RSOn+7+86QzIang0vuU1YEu8CKbMH9VNP"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
data.1 = "CoVg1He7F9xvQWYSUM+EEbfJHRVMQV0qIWJABi5MUHItt2iUFw/SC1i57mDW4E2cXk5/BazOqiu/A2C+hHxSWBx6yItvj8Kzjq/9"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
data.1 = "CoVg1He7F9xvQWYSUM+EEbfJHRVMQV0qIWJABi5MUHItt2iUFw/SC1i57mDW4E2cXk5/BazOqiu/A2C+hHxSWBx6yItvj8Kzjq/9"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
usr.0 = "e64HyV9/XZTVNPRJLF"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
usr.0 = "e64HyV9/XZTVNPRJLF"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
usr.1 = "3SZigVCDWYSUMOQIKE"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
usr.1 = "3SZigVCDWYSUMOQIKE"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
version = "22022132"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
uuid = "7608944168369045675"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
uuid = "7608944168369045675"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
51d2f2ea = "J/Af/XD/GlAi/XD/JlA3/YV/c/Au/Xh////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
51d2f2ea = "J/Af/XD/GlAi/XD/JlA3/YV/c/Au/Xh////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
a2e3b941 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
a2e3b941 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
bbf88800 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
bbf88800 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
state = "0"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
a1dcff5b = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
a1dcff5b = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
340d3099 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
340d3099 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
0e93c3f3 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
0e93c3f3 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
0c230bcb = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
0c230bcb = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
27ddcf6f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
27ddcf6f = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
414bc593 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
414bc593 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
f0bf0bde = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
f0bf0bde = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
c99a5f5c = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
c99a5f5c = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
72758a5d = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
72758a5d = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
e46c271e = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
e46c271e = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
7f69fa1f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
7f69fa1f = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
3c09c42b = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
3c09c42b = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
7367429f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
7367429f = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
0dc3ee96 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
0dc3ee96 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
d1abcdb6 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
d1abcdb6 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
38583bc3 = "Ml/2/CF/M//g/CZ////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
38583bc3 = "Ml/2/CF/M//g/CZ////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
c24899a6 = "VP/g/CV/Vl/2/Cx////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
c24899a6 = "VP/g/CV/Vl/2/Cx////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
65114b36 = "VP/l////"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
65114b36 = "VP/l////"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
6185d035 = "Vx/2/Cx/V//l////"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
6185d035 = "Vx/2/Cx/V//l////"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
c5705860 = "Vx////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
c5705860 = "Vx////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
a0743acc = "N/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
a0743acc = "N/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
c6c5dd44 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
c6c5dd44 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
1520c6f1 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
1520c6f1 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
2d71d5ab = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
2d71d5ab = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
8b9e4cbc = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
8b9e4cbc = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
fe94ce1e = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
fe94ce1e = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
587b5709 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
587b5709 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
lrts = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
lrts = "0"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
mode = "4026531840"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
mode = "4026531840"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
svn = "PragmaSystem"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
svx = ":RegData:"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
svi = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
svt = "1484735930"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\00000000
370856c7 = "\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\00000000
370856c7 = "\x00"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\00000000
493c7345 = "\x00\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\00000000
493c7345 = "\x00\x00"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\00000000
3efeb33e = "\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\00000000
3efeb33e = "\x00"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\00000000
a47da861 = "\x00\x00O\xee\x90\x80 \xe1\x80\x80t\xe3\xa1\xb2"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\00000000
a47da861 = "\x00\x00O\xe5\x88\x90\xe7\xb4\x80\x13\xe1\x80\x81P\xe1\x8c\xa6\xc4\x80\xe5\x90\x90\xee\x90\x80 \xe1\x80\x80txe3\xa1\xb2"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
2e22d94e = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
2e22d94e = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
48bd1aff = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
48bd1aff = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
f6ad6fa6 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
f6ad6fa6 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
d94388d2 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
d94388d2 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
37b7a6d8 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
37b7a6d8 = "UlAr/XJ/c//k////"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
060df2cd = "GlAu/YP/c/Au/YZ/GxAp/YZ/GP/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
060df2cd = "GlAu/YP/c/Au/YZ/GxAp/YZ/GP/j/Xt/axAv/X6////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
e8f9dcc7 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
e8f9dcc7 = "UlAr/XJ/c//k////"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
1c311243 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
1c311243 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
f2c53c49 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
f2c53c49 = "UlAr/XJ/c//k////"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
iiid = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
iiid = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\00000000
370856c7 = "\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\00000000
3efeb33e = "\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\00000000
493c7345 = "\x00\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\00000000
a47da861 = "\x00\x00O\xe5\x88\x90\xe7\xb4\x80\x13\xe1\x80\x81P\xe1\x8c\xa6\xc4\x80\xe5\x90\x90\xee\x90\x80 \xe1\x80\x80t\xe3\xa2\x90"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
060df2cd = "GlAu/YP/c/Au/YZ/GxAp/YZ/GP/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
0c230bcb = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
0dc3ee96 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
0e93c3f3 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
1520c6f1 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
1c311243 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
27ddcf6f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
2d71d5ab = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
2e22d94e = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
340d3099 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
37b7a6d8 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
38583bc3 = "Ml/2/CF/M//g/CZ////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
3c09c42b = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
414bc593 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
48bd1aff = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
51d2f2ea = "J/Af/XD/GlAi/XD/JlA3/YV/c/Au/Xh////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
587b5709 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
6185d035 = "Vx/2/Cx/V//l////"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
65114b36 = "VP/l////"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
72758a5d = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
7367429f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
7f69fa1f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
8b9e4cbc = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
a0743acc = "N/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
a1dcff5b = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
a2e3b941 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
bbf88800 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
c24899a6 = "VP/g/CV/Vl/2/Cx////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
c5705860 = "Vx////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
c6c5dd44 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
c99a5f5c = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
d1abcdb6 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
d94388d2 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
e46c271e = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
e8f9dcc7 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
f0bf0bde = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
f2c53c49 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
f6ad6fa6 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
fe94ce1e = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
data.0 = "mlBtq3FthP8MNh0123i2uOK9AsZEwjVlZPSh+Do9RSOn+7+86QzIang0vuU1YEu8CKbMH9VNP"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
data.1 = "CoVg1He7F9xvQWYSUM+EEbfJHRVMQV0qIWJABi5MUHItt2iUFw/SC1i57mDW4E2cXk5/BazOqiu/A2C+hHxSWBx6yItvj8Kzjq/9"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
date = "1484763486"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
iiid = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
lrts = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
mode = "4026531840"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
state = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
svi = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
svn = "PragmaSystem"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
svt = "1484735930"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
svx = "RegData:"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
usr.0 = "e64HyV9/XZTVNPRJLF"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
usr.1 = "3SZigVCDWYSUMOQIKE"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
uuid = "7608944168369045675"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
version = "22022132"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
LoadAppInit_DLLs = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
00eff4f8 = "%Program Files%\PragmaSystem\PragmaSystem.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
dlpath = "%Program Files%\pragma~1\pragma~1.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
svpath = "%Program Files%\PragmaSystem\PragmaSystem.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
Install_Dir = "%Program Files%\PragmaSystem"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
UninstallString = ""%System%\RUNDLL32.EXE" "%Program Files%\PRAGMA~1\PRAGMA~1.DLL",_uninstall /un"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
QuietUninstallString = ""%System%\RUNDLL32.EXE" "%Program Files%\PRAGMA~1\PRAGMA~1.DLL",_uninstall /un /uq"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
Publisher = "Software Publisher"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
InstallDate = "20140212"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
CategoryName = "RegData:"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
DisplayName = "PragmaSystem"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
Cache = "9428760297565573948"

HKEY_LOCAL_MACHINE\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
n = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
n = "1"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
00000000
370856c7 = "\x00"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
00000000
3efeb33e = "\x00"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
00000000
493c7345 = "\x00\x00"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
00000000
a47da861 = "\x00\x00O"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
060df2cd = "GlAu/YP/c/Au/YZ/GxAp/YZ/GP/j/Xt/axAv/X6////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
0c230bcb = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
0dc3ee96 = "/P////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
0e93c3f3 = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
1520c6f1 = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
1c311243 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
27ddcf6f = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
2d71d5ab = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
2e22d94e = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
340d3099 = "/P////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
37b7a6d8 = "UlAr/XJ/c//k////"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
38583bc3 = "Ml/2/CF/M//g/CZ////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
3c09c42b = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
414bc593 = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
48bd1aff = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
51d2f2ea = "J/Af/XD/GlAi/XD/JlA3/YV/c/Au/Xh////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
587b5709 = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
6185d035 = "Vx/2/Cx/V//l////"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
65114b36 = "VP/l////"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
72758a5d = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
7367429f = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
7f69fa1f = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
8b9e4cbc = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
a0743acc = "N/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
a1dcff5b = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
a2e3b941 = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
bbf88800 = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
c24899a6 = "VP/g/CV/Vl/2/Cx////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
c5705860 = "Vx////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
c6c5dd44 = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
c99a5f5c = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
d1abcdb6 = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
d94388d2 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
e46c271e = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
e8f9dcc7 = "UlAr/XJ/c//k////"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
f0bf0bde = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
f2c53c49 = "UlAr/XJ/c//k////"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
f6ad6fa6 = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
fe94ce1e = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
iiid = "1"

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Andere Details

Verbindet sich mit der folgenden Website, um Daten zu versenden und zu empfangen:

  • http://{BLOCKED}fire.info/get/?data={encrypted data}&version=4
  • http://{BLOCKED}sea.info/get/?data={encrypted data}&version=4
  • http://{BLOCKED}cean.com/get/?data={encrypted data}&version=4

Verbindet sich mit den folgenden Zeitservern, um das aktuelle Datum zu ermitteln:

  • www.bbc.com
  • edition.cnn.com
  • time.nist.gov

  Solutions

Moteur de scan minimum: 9.800
SSAPI Pattern File: 1.806.00
SSAPI Pattern Release Date: 19 janvier 2017

Step 1

Für Windows ME und XP Benutzer: Stellen Sie vor einer Suche sicher, dass die Systemwiederherstellung deaktiviert ist, damit der gesamte Computer durchsucht werden kann.

Step 3

Im abgesicherten Modus neu starten

[ learnMore ]

Step 4

Diesen Malware-Dienst deaktivieren

[ learnMore ]
  • Service Name: 00eff4f8
    Display Name: PragmaSystem
    Start Type: SERVICE_AUTO_START
    Binary Pathname: "%System%\rundll32.exe"
    "ProgramFiles%\PragnaSystem\PragnaSystem.dll",serv

Step 5

Diesen Registrierungsschlüssel löschen

[ learnMore ]

Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.

  • In HKEY_CURRENT_USER\Software\AppDataLow
    • {12DA0E6F-5543-440C-BAA2-28BF01070AFA}
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • {12DA0E6F-5543-440C-BAA2-28BF01070AFA}
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • {GUID 1}
  • In HKEY_USERS\.DEFAULT\Software\AppDataLow
    • {12DA0E6F-5543-440C-BAA2-28BF01070AFA}

Step 6

Führen Sie den Neustart im normalen Modus durch, und durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt nach Dateien, die als PUA_MULTIPLUG.GA entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.

Step 7

Durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt, und löschen Sie Dateien, die als PUA_MULTIPLUG.GA entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.


Participez à notre enquête!