Author: Janus Agcaoili   
 

PUP.Optional.MultiPlug (Malwarebytes), a variant of Win32/Adware.MultiPlug.NA (ESET-NOD32), W32/MultiPlug.O.gen!Eldorado (FProt)

 PLATFORM:

Windows

 OVER ALL RISK RATING:
 DAMAGE POTENTIAL::
 DISTRIBUTION POTENTIAL::
 REPORTED INFECTION:
 INFORMATION EXPOSURE:
Low
Medium
High
Critical

  • Threat Type:
    Potentially Unwanted Application

  • Destructiveness:
    No

  • Encrypted:
    Yes

  • In the wild::
    Yes

  OVERVIEW

INFECTION CHANNEL: Descargado de Internet, Eliminado por otro tipo de malware

Llega como componente integrado en paquetes de malware/grayware/spyware.

Este malware no tiene ninguna rutina de propagación.

Este malware no tiene ninguna rutina de puerta trasera.

Se conecta a determinados sitios Web para enviar y recibir información.

  TECHNICAL DETAILS

File size: 1,600,512 bytes
File type: DLL
Memory resident: Yes
INITIAL SAMPLES RECEIVED DATE: 16 de stycznia de 2017
PAYLOAD: Connects to URLs/IPs, Steals information, Drops files

Detalles de entrada

Llega como componente integrado en paquetes de malware/grayware/spyware.

Instalación

Este malware infiltra una copia de sí mismo en las carpetas siguientes con diferentes nombres de archivo:

  • %ProgramFiles%\PragmaSystem\PragmaSystem.dll <- if it does not exist in this path

Agrega las siguientes exclusiones mutuas para garantizar que solo se ejecuta una de sus copias en todo momento:

  • DA.{Random 8 Hex Characters)
  • DQ.{Random 8 Hex Characters)
  • i{12DA0E6F-5543-440C-BAA2-28BF01070AFA}

Otras modificaciones del sistema

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_{Random 8 Hex Characters}\eae10f9d

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\00000000

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\00000000

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}

HKEY_LOCAL_MACHINE\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}

HKEY_LOCAL_MACHINE\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
00000000

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8

Agrega las siguientes entradas de registro:

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_{Random 8 Hex Characters}\eae10f9d
340d3099 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_{Random 8 Hex Characters}\eae10f9d
dbaf3ce3 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
340d3099 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
dbaf3ce3 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
date = "1484763486"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
date = "1484763486"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
data.0 = "mlBtq3FthP8MNh0123i2uOK9AsZEwjVlZPSh+Do9RSOn+7+86QzIang0vuU1YEu8CKbMH9VNP"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
data.0 = "mlBtq3FthP8MNh0123i2uOK9AsZEwjVlZPSh+Do9RSOn+7+86QzIang0vuU1YEu8CKbMH9VNP"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
data.1 = "CoVg1He7F9xvQWYSUM+EEbfJHRVMQV0qIWJABi5MUHItt2iUFw/SC1i57mDW4E2cXk5/BazOqiu/A2C+hHxSWBx6yItvj8Kzjq/9"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
data.1 = "CoVg1He7F9xvQWYSUM+EEbfJHRVMQV0qIWJABi5MUHItt2iUFw/SC1i57mDW4E2cXk5/BazOqiu/A2C+hHxSWBx6yItvj8Kzjq/9"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
usr.0 = "e64HyV9/XZTVNPRJLF"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
usr.0 = "e64HyV9/XZTVNPRJLF"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
usr.1 = "3SZigVCDWYSUMOQIKE"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
usr.1 = "3SZigVCDWYSUMOQIKE"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
version = "22022132"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
uuid = "7608944168369045675"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
uuid = "7608944168369045675"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
51d2f2ea = "J/Af/XD/GlAi/XD/JlA3/YV/c/Au/Xh////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
51d2f2ea = "J/Af/XD/GlAi/XD/JlA3/YV/c/Au/Xh////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
a2e3b941 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
a2e3b941 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
bbf88800 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
bbf88800 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
state = "0"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
a1dcff5b = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
a1dcff5b = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
340d3099 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
340d3099 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
0e93c3f3 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
0e93c3f3 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
0c230bcb = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
0c230bcb = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
27ddcf6f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
27ddcf6f = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
414bc593 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
414bc593 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
f0bf0bde = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
f0bf0bde = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
c99a5f5c = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
c99a5f5c = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
72758a5d = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
72758a5d = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
e46c271e = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
e46c271e = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
7f69fa1f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
7f69fa1f = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
3c09c42b = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
3c09c42b = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
7367429f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
7367429f = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
0dc3ee96 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
0dc3ee96 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
d1abcdb6 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
d1abcdb6 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
38583bc3 = "Ml/2/CF/M//g/CZ////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
38583bc3 = "Ml/2/CF/M//g/CZ////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
c24899a6 = "VP/g/CV/Vl/2/Cx////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
c24899a6 = "VP/g/CV/Vl/2/Cx////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
65114b36 = "VP/l////"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
65114b36 = "VP/l////"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
6185d035 = "Vx/2/Cx/V//l////"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
6185d035 = "Vx/2/Cx/V//l////"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
c5705860 = "Vx////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
c5705860 = "Vx////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
a0743acc = "N/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
a0743acc = "N/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
c6c5dd44 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
c6c5dd44 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
1520c6f1 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
1520c6f1 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
2d71d5ab = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
2d71d5ab = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
8b9e4cbc = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
8b9e4cbc = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
fe94ce1e = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
fe94ce1e = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
587b5709 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
587b5709 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
lrts = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
lrts = "0"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
mode = "4026531840"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
mode = "4026531840"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
svn = "PragmaSystem"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
svx = ":RegData:"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
svi = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
svt = "1484735930"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\00000000
370856c7 = "\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\00000000
370856c7 = "\x00"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\00000000
493c7345 = "\x00\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\00000000
493c7345 = "\x00\x00"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\00000000
3efeb33e = "\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\00000000
3efeb33e = "\x00"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\00000000
a47da861 = "\x00\x00O\xee\x90\x80 \xe1\x80\x80t\xe3\xa1\xb2"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\00000000
a47da861 = "\x00\x00O\xe5\x88\x90\xe7\xb4\x80\x13\xe1\x80\x81P\xe1\x8c\xa6\xc4\x80\xe5\x90\x90\xee\x90\x80 \xe1\x80\x80txe3\xa1\xb2"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
2e22d94e = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
2e22d94e = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
48bd1aff = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
48bd1aff = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
f6ad6fa6 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
f6ad6fa6 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
d94388d2 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
d94388d2 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
37b7a6d8 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
37b7a6d8 = "UlAr/XJ/c//k////"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
060df2cd = "GlAu/YP/c/Au/YZ/GxAp/YZ/GP/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
060df2cd = "GlAu/YP/c/Au/YZ/GxAp/YZ/GP/j/Xt/axAv/X6////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
e8f9dcc7 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
e8f9dcc7 = "UlAr/XJ/c//k////"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
1c311243 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
1c311243 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
f2c53c49 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
f2c53c49 = "UlAr/XJ/c//k////"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
iiid = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
iiid = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\00000000
370856c7 = "\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\00000000
3efeb33e = "\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\00000000
493c7345 = "\x00\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\00000000
a47da861 = "\x00\x00O\xe5\x88\x90\xe7\xb4\x80\x13\xe1\x80\x81P\xe1\x8c\xa6\xc4\x80\xe5\x90\x90\xee\x90\x80 \xe1\x80\x80t\xe3\xa2\x90"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
060df2cd = "GlAu/YP/c/Au/YZ/GxAp/YZ/GP/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
0c230bcb = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
0dc3ee96 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
0e93c3f3 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
1520c6f1 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
1c311243 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
27ddcf6f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
2d71d5ab = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
2e22d94e = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
340d3099 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
37b7a6d8 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
38583bc3 = "Ml/2/CF/M//g/CZ////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
3c09c42b = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
414bc593 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
48bd1aff = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
51d2f2ea = "J/Af/XD/GlAi/XD/JlA3/YV/c/Au/Xh////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
587b5709 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
6185d035 = "Vx/2/Cx/V//l////"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
65114b36 = "VP/l////"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
72758a5d = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
7367429f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
7f69fa1f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
8b9e4cbc = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
a0743acc = "N/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
a1dcff5b = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
a2e3b941 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
bbf88800 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
c24899a6 = "VP/g/CV/Vl/2/Cx////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
c5705860 = "Vx////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
c6c5dd44 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
c99a5f5c = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
d1abcdb6 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
d94388d2 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
e46c271e = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
e8f9dcc7 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
f0bf0bde = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
f2c53c49 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
f6ad6fa6 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
fe94ce1e = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
data.0 = "mlBtq3FthP8MNh0123i2uOK9AsZEwjVlZPSh+Do9RSOn+7+86QzIang0vuU1YEu8CKbMH9VNP"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
data.1 = "CoVg1He7F9xvQWYSUM+EEbfJHRVMQV0qIWJABi5MUHItt2iUFw/SC1i57mDW4E2cXk5/BazOqiu/A2C+hHxSWBx6yItvj8Kzjq/9"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
date = "1484763486"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
iiid = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
lrts = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
mode = "4026531840"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
state = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
svi = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
svn = "PragmaSystem"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
svt = "1484735930"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
svx = "RegData:"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
usr.0 = "e64HyV9/XZTVNPRJLF"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
usr.1 = "3SZigVCDWYSUMOQIKE"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
uuid = "7608944168369045675"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
version = "22022132"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
LoadAppInit_DLLs = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
00eff4f8 = "%Program Files%\PragmaSystem\PragmaSystem.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
dlpath = "%Program Files%\pragma~1\pragma~1.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
svpath = "%Program Files%\PragmaSystem\PragmaSystem.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
Install_Dir = "%Program Files%\PragmaSystem"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
UninstallString = ""%System%\RUNDLL32.EXE" "%Program Files%\PRAGMA~1\PRAGMA~1.DLL",_uninstall /un"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
QuietUninstallString = ""%System%\RUNDLL32.EXE" "%Program Files%\PRAGMA~1\PRAGMA~1.DLL",_uninstall /un /uq"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
Publisher = "Software Publisher"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
InstallDate = "20140212"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
CategoryName = "RegData:"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
DisplayName = "PragmaSystem"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
Cache = "9428760297565573948"

HKEY_LOCAL_MACHINE\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
n = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
n = "1"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
00000000
370856c7 = "\x00"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
00000000
3efeb33e = "\x00"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
00000000
493c7345 = "\x00\x00"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
00000000
a47da861 = "\x00\x00O"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
060df2cd = "GlAu/YP/c/Au/YZ/GxAp/YZ/GP/j/Xt/axAv/X6////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
0c230bcb = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
0dc3ee96 = "/P////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
0e93c3f3 = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
1520c6f1 = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
1c311243 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
27ddcf6f = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
2d71d5ab = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
2e22d94e = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
340d3099 = "/P////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
37b7a6d8 = "UlAr/XJ/c//k////"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
38583bc3 = "Ml/2/CF/M//g/CZ////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
3c09c42b = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
414bc593 = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
48bd1aff = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
51d2f2ea = "J/Af/XD/GlAi/XD/JlA3/YV/c/Au/Xh////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
587b5709 = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
6185d035 = "Vx/2/Cx/V//l////"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
65114b36 = "VP/l////"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
72758a5d = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
7367429f = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
7f69fa1f = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
8b9e4cbc = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
a0743acc = "N/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
a1dcff5b = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
a2e3b941 = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
bbf88800 = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
c24899a6 = "VP/g/CV/Vl/2/Cx////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
c5705860 = "Vx////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
c6c5dd44 = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
c99a5f5c = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
d1abcdb6 = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
d94388d2 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
e46c271e = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
e8f9dcc7 = "UlAr/XJ/c//k////"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
f0bf0bde = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
f2c53c49 = "UlAr/XJ/c//k////"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
f6ad6fa6 = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
fe94ce1e = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
iiid = "1"

Propagación

Este malware no tiene ninguna rutina de propagación.

Rutina de puerta trasera

Este malware no tiene ninguna rutina de puerta trasera.

Otros detalles

Se conecta al sitio Web siguiente para enviar y recibir información:

  • http://{BLOCKED}fire.info/get/?data={encrypted data}&version=4
  • http://{BLOCKED}sea.info/get/?data={encrypted data}&version=4
  • http://{BLOCKED}cean.com/get/?data={encrypted data}&version=4

Se conecta a los siguientes servidores de tiempo para determinar la fecha actual:

  • www.bbc.com
  • edition.cnn.com
  • time.nist.gov

  SOLUTION

Minimum scan engine: 9.800
SSAPI Pattern-Datei: 1.806.00
SSAPI Pattern veröffentlicht am: 19 de stycznia de 2017

Step 1

Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.

Step 3

Reiniciar en modo seguro

[ learnMore ]

Step 4

Desactivar este servicio de malware

[ learnMore ]
  • Service Name: 00eff4f8
    Display Name: PragmaSystem
    Start Type: SERVICE_AUTO_START
    Binary Pathname: "%System%\rundll32.exe"
    "ProgramFiles%\PragnaSystem\PragnaSystem.dll",serv

Step 5

Eliminar esta clave del Registro

[ learnMore ]

Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.

  • In HKEY_CURRENT_USER\Software\AppDataLow
    • {12DA0E6F-5543-440C-BAA2-28BF01070AFA}
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • {12DA0E6F-5543-440C-BAA2-28BF01070AFA}
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • {GUID 1}
  • In HKEY_USERS\.DEFAULT\Software\AppDataLow
    • {12DA0E6F-5543-440C-BAA2-28BF01070AFA}

Step 6

Reinicie en modo normal y explore el equipo con su producto de Trend Micro para buscar los archivos identificados como PUA_MULTIPLUG.GA En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.

Step 7

Explorar el equipo con su producto de Trend Micro para eliminar los archivos detectados como PUA_MULTIPLUG.GA En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.


Did this description help? Tell us how we did.