Analysis by: Janus Agcaoili
ALIASES:

PUP.Optional.MultiPlug (Malwarebytes), a variant of Win32/Adware.MultiPlug.NA (ESET-NOD32), W32/MultiPlug.O.gen!Eldorado (FProt)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Potentially Unwanted Application

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

Infection Channel: Downloaded from the Internet, Dropped by other malware

This potentially unwanted application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It arrives as a component bundled with malware/grayware packages.

It does not have any propagation routine.

It does not have any backdoor routine.

It connects to certain websites to send and receive information. It gathers information and reports it to its servers.

  TECHNICAL DETAILS

File Size: 1,600,512 bytes
File Type: DLL
Memory Resident: Yes
Initial Samples Received Date: 16 Jan 2017
Payload: Connects to URLs/IPs, Steals information, Drops files

Arrival Details

This potentially unwanted application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It arrives as a component bundled with malware/grayware packages.

Installation

This potentially unwanted application drops a copy of itself in the following folders using different file names:

  • %ProgramFiles%\PragmaSystem\PragmaSystem.dll <- if it does not exist in this path

It adds the following mutexes to ensure that only one of its copies runs at any one time:

  • DA.{Random 8 Hex Characters)
  • DQ.{Random 8 Hex Characters)
  • i{12DA0E6F-5543-440C-BAA2-28BF01070AFA}

Autostart Technique

This potentially unwanted application adds and runs the following services:

  • Service Name: 00eff4f8
    Display Name: PragmaSystem
    Start Type: SERVICE_AUTO_START
    Binary Pathname: "%System%\rundll32.exe" "ProgramFiles%\PragnaSystem\PragnaSystem.dll",serv

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other System Modifications

This potentially unwanted application adds the following registry keys:

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_{Random 8 Hex Characters}\eae10f9d

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\00000000

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\00000000

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}

HKEY_LOCAL_MACHINE\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}

HKEY_LOCAL_MACHINE\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
00000000

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8

It adds the following registry entries:

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_{Random 8 Hex Characters}\eae10f9d
340d3099 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_{Random 8 Hex Characters}\eae10f9d
dbaf3ce3 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
340d3099 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
dbaf3ce3 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
date = "1484763486"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
date = "1484763486"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
data.0 = "mlBtq3FthP8MNh0123i2uOK9AsZEwjVlZPSh+Do9RSOn+7+86QzIang0vuU1YEu8CKbMH9VNP"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
data.0 = "mlBtq3FthP8MNh0123i2uOK9AsZEwjVlZPSh+Do9RSOn+7+86QzIang0vuU1YEu8CKbMH9VNP"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
data.1 = "CoVg1He7F9xvQWYSUM+EEbfJHRVMQV0qIWJABi5MUHItt2iUFw/SC1i57mDW4E2cXk5/BazOqiu/A2C+hHxSWBx6yItvj8Kzjq/9"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
data.1 = "CoVg1He7F9xvQWYSUM+EEbfJHRVMQV0qIWJABi5MUHItt2iUFw/SC1i57mDW4E2cXk5/BazOqiu/A2C+hHxSWBx6yItvj8Kzjq/9"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
usr.0 = "e64HyV9/XZTVNPRJLF"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
usr.0 = "e64HyV9/XZTVNPRJLF"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
usr.1 = "3SZigVCDWYSUMOQIKE"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
usr.1 = "3SZigVCDWYSUMOQIKE"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
version = "22022132"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
uuid = "7608944168369045675"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
uuid = "7608944168369045675"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
51d2f2ea = "J/Af/XD/GlAi/XD/JlA3/YV/c/Au/Xh////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
51d2f2ea = "J/Af/XD/GlAi/XD/JlA3/YV/c/Au/Xh////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
a2e3b941 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
a2e3b941 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
bbf88800 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
bbf88800 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
state = "0"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
a1dcff5b = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
a1dcff5b = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
340d3099 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
340d3099 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
0e93c3f3 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
0e93c3f3 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
0c230bcb = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
0c230bcb = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
27ddcf6f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
27ddcf6f = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
414bc593 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
414bc593 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
f0bf0bde = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
f0bf0bde = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
c99a5f5c = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
c99a5f5c = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
72758a5d = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
72758a5d = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
e46c271e = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
e46c271e = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
7f69fa1f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
7f69fa1f = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
3c09c42b = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
3c09c42b = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
7367429f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
7367429f = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
0dc3ee96 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
0dc3ee96 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
d1abcdb6 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
d1abcdb6 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
38583bc3 = "Ml/2/CF/M//g/CZ////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
38583bc3 = "Ml/2/CF/M//g/CZ////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
c24899a6 = "VP/g/CV/Vl/2/Cx////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
c24899a6 = "VP/g/CV/Vl/2/Cx////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
65114b36 = "VP/l////"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
65114b36 = "VP/l////"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
6185d035 = "Vx/2/Cx/V//l////"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
6185d035 = "Vx/2/Cx/V//l////"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
c5705860 = "Vx////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
c5705860 = "Vx////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
a0743acc = "N/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
a0743acc = "N/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
c6c5dd44 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
c6c5dd44 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
1520c6f1 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
1520c6f1 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
2d71d5ab = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
2d71d5ab = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
8b9e4cbc = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
8b9e4cbc = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
fe94ce1e = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
fe94ce1e = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
587b5709 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
587b5709 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
lrts = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
lrts = "0"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
mode = "4026531840"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
mode = "4026531840"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
svn = "PragmaSystem"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
svx = ":RegData:"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
svi = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
svt = "1484735930"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\00000000
370856c7 = "\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\00000000
370856c7 = "\x00"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\00000000
493c7345 = "\x00\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\00000000
493c7345 = "\x00\x00"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\00000000
3efeb33e = "\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\00000000
3efeb33e = "\x00"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\00000000
a47da861 = "\x00\x00O\xee\x90\x80 \xe1\x80\x80t\xe3\xa1\xb2"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\00000000
a47da861 = "\x00\x00O\xe5\x88\x90\xe7\xb4\x80\x13\xe1\x80\x81P\xe1\x8c\xa6\xc4\x80\xe5\x90\x90\xee\x90\x80 \xe1\x80\x80txe3\xa1\xb2"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
2e22d94e = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
2e22d94e = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
48bd1aff = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
48bd1aff = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
f6ad6fa6 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
f6ad6fa6 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
d94388d2 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
d94388d2 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
37b7a6d8 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
37b7a6d8 = "UlAr/XJ/c//k////"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
060df2cd = "GlAu/YP/c/Au/YZ/GxAp/YZ/GP/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
060df2cd = "GlAu/YP/c/Au/YZ/GxAp/YZ/GP/j/Xt/axAv/X6////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
e8f9dcc7 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
e8f9dcc7 = "UlAr/XJ/c//k////"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
1c311243 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
1c311243 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\eae10f9d
f2c53c49 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8\eae10f9d
f2c53c49 = "UlAr/XJ/c//k////"

HKEY_CURRENT_USER\Software\AppDataLow\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
iiid = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
iiid = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\00000000
370856c7 = "\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\00000000
3efeb33e = "\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\00000000
493c7345 = "\x00\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\00000000
a47da861 = "\x00\x00O\xe5\x88\x90\xe7\xb4\x80\x13\xe1\x80\x81P\xe1\x8c\xa6\xc4\x80\xe5\x90\x90\xee\x90\x80 \xe1\x80\x80t\xe3\xa2\x90"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
060df2cd = "GlAu/YP/c/Au/YZ/GxAp/YZ/GP/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
0c230bcb = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
0dc3ee96 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
0e93c3f3 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
1520c6f1 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
1c311243 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
27ddcf6f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
2d71d5ab = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
2e22d94e = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
340d3099 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
37b7a6d8 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
38583bc3 = "Ml/2/CF/M//g/CZ////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
3c09c42b = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
414bc593 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
48bd1aff = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
51d2f2ea = "J/Af/XD/GlAi/XD/JlA3/YV/c/Au/Xh////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
587b5709 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
6185d035 = "Vx/2/Cx/V//l////"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
65114b36 = "VP/l////"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
72758a5d = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
7367429f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
7f69fa1f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
8b9e4cbc = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
a0743acc = "N/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
a1dcff5b = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
a2e3b941 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
bbf88800 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
c24899a6 = "VP/g/CV/Vl/2/Cx////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
c5705860 = "Vx////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
c6c5dd44 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
c99a5f5c = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
d1abcdb6 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
d94388d2 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
e46c271e = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
e8f9dcc7 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
f0bf0bde = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
f2c53c49 = "UlAr/XJ/c//k////"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
f6ad6fa6 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880\eae10f9d
fe94ce1e = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
data.0 = "mlBtq3FthP8MNh0123i2uOK9AsZEwjVlZPSh+Do9RSOn+7+86QzIang0vuU1YEu8CKbMH9VNP"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
data.1 = "CoVg1He7F9xvQWYSUM+EEbfJHRVMQV0qIWJABi5MUHItt2iUFw/SC1i57mDW4E2cXk5/BazOqiu/A2C+hHxSWBx6yItvj8Kzjq/9"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
date = "1484763486"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
iiid = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
lrts = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
mode = "4026531840"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
state = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
svi = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
svn = "PragmaSystem"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
svt = "1484735930"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
svx = "RegData:"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
usr.0 = "e64HyV9/XZTVNPRJLF"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
usr.1 = "3SZigVCDWYSUMOQIKE"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
uuid = "7608944168369045675"

HKEY_LOCAL_MACHINE\SOFTWARE\{GUID 1}\
279535107227880
version = "22022132"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
LoadAppInit_DLLs = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
00eff4f8 = "%Program Files%\PragmaSystem\PragmaSystem.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
dlpath = "%Program Files%\pragma~1\pragma~1.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
svpath = "%Program Files%\PragmaSystem\PragmaSystem.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\
_00eff4f8
Install_Dir = "%Program Files%\PragmaSystem"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
UninstallString = ""%System%\RUNDLL32.EXE" "%Program Files%\PRAGMA~1\PRAGMA~1.DLL",_uninstall /un"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
QuietUninstallString = ""%System%\RUNDLL32.EXE" "%Program Files%\PRAGMA~1\PRAGMA~1.DLL",_uninstall /un /uq"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
Publisher = "Software Publisher"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
InstallDate = "20140212"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
CategoryName = "RegData:"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
DisplayName = "PragmaSystem"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{eff4f8}
Cache = "9428760297565573948"

HKEY_LOCAL_MACHINE\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
n = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
n = "1"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
00000000
370856c7 = "\x00"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
00000000
3efeb33e = "\x00"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
00000000
493c7345 = "\x00\x00"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
00000000
a47da861 = "\x00\x00O"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
060df2cd = "GlAu/YP/c/Au/YZ/GxAp/YZ/GP/j/Xt/axAv/X6////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
0c230bcb = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
0dc3ee96 = "/P////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
0e93c3f3 = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
1520c6f1 = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
1c311243 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
27ddcf6f = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
2d71d5ab = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
2e22d94e = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
340d3099 = "/P////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
37b7a6d8 = "UlAr/XJ/c//k////"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
38583bc3 = "Ml/2/CF/M//g/CZ////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
3c09c42b = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
414bc593 = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
48bd1aff = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
51d2f2ea = "J/Af/XD/GlAi/XD/JlA3/YV/c/Au/Xh////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
587b5709 = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
6185d035 = "Vx/2/Cx/V//l////"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
65114b36 = "VP/l////"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
72758a5d = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
7367429f = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
7f69fa1f = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
8b9e4cbc = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
a0743acc = "N/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
a1dcff5b = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
a2e3b941 = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
bbf88800 = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
c24899a6 = "VP/g/CV/Vl/2/Cx////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
c5705860 = "Vx////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
c6c5dd44 = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
c99a5f5c = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
d1abcdb6 = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
d94388d2 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
e46c271e = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
e8f9dcc7 = "UlAr/XJ/c//k////"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
f0bf0bde = "///%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
f2c53c49 = "UlAr/XJ/c//k////"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
f6ad6fa6 = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8\
eae10f9d
fe94ce1e = "V/////%%"

HKEY_USERS\.DEFAULT\Software\
AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_00eff4f8
iiid = "1"

Propagation

This potentially unwanted application does not have any propagation routine.

Backdoor Routine

This potentially unwanted application does not have any backdoor routine.

Other Details

This potentially unwanted application connects to the following website to send and receive information:

  • http://{BLOCKED}fire.info/get/?data={encrypted data}&version=4
  • http://{BLOCKED}sea.info/get/?data={encrypted data}&version=4
  • http://{BLOCKED}cean.com/get/?data={encrypted data}&version=4

It connects to the following time servers to determine the current date:

  • www.bbc.com
  • edition.cnn.com
  • time.nist.gov

It gathers the following information and reports it to its servers:

  • Browser Information (Version, Compatibility Version, Architecture)
  • OS Information (Version, Architecture, SP)

  SOLUTION

Minimum Scan Engine: 9.800
SSAPI PATTERN File: 1.806.00
SSAPI PATTERN Date: 19 Jan 2017

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Restart in Safe Mode

[ Learn More ]

Step 4

Disable this malware service

[ Learn More ]
  • Service Name: 00eff4f8
    Display Name: PragmaSystem
    Start Type: SERVICE_AUTO_START
    Binary Pathname: "%System%\rundll32.exe"
    "ProgramFiles%\PragnaSystem\PragnaSystem.dll",serv

Step 5

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\Software\AppDataLow
    • {12DA0E6F-5543-440C-BAA2-28BF01070AFA}
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • {12DA0E6F-5543-440C-BAA2-28BF01070AFA}
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • {GUID 1}
  • In HKEY_USERS\.DEFAULT\Software\AppDataLow
    • {12DA0E6F-5543-440C-BAA2-28BF01070AFA}

Step 6

Restart in normal mode and scan your computer with your Trend Micro product for files detected as PUA_MULTIPLUG.GA. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 7

Scan your computer with your Trend Micro product to delete files detected as PUA_MULTIPLUG.GA. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.