Worm.Generic.896010_7af9988781 – Adaware

HEUR:Trojan.Win32.Generic (Kaspersky), Worm.Generic.896010 (B) (Emsisoft), Worm.Generic.896010 (AdAware), Trojan.NSIS.StartPage.FD, TrojanDropperVtimrun.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Worm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 7af9988781b8b1bd909d466b20bdf8b6

SHA1: a248583574734e6a9fcd49aa3142f29cb72120f9

SHA256: 263b22f3ac018d40beac936f583a832ed5bf940d6f13af870be4c2a92cb405a7

SSDeep: 196608:1OHZv4Yr9wMWByNtOAh8UQu8KVRDhoN6frd8SdUJRz0/6O3drx93OPV01pPJXd B:o5v4YJ/gymAKUQYHhoN6/mYiO3drSsPL

Size: 11798016 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2008-01-19 07:47:29

Analyzed on: WindowsXP SP3 32-bit

Summary: Worm. A program that is primarily replicating on networks or removable drives.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Worm creates the following process(es):

%original file name%.exe:564

The Worm injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:564 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\Tiara's Moonshine Mod G9S2-V60 Installer.exe (183607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\crypted.exe (9260 bytes)

Registry activity

The process %original file name%.exe:564 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 B4 F6 1D C4 70 E3 61 18 DD B9 F7 B8 C2 9B 5D"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

Dropped PE files

MD5	File path
b1d95c5a4e00145d268ec91261abab3b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IXP000.TMP\Tiara's Moonshine Mod G9S2-V60 Installer.exe
3b41cdc7ba92427772a70263cee90a47	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IXP000.TMP\crypted.exe
a1bba35c752b36f575350cb7ddf238e4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsk2.tmp\AdvSplash.dll
36e0280c371781af52c2638934c62be5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsk2.tmp\BgImage.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:564
Delete the original Worm file.
Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\Tiara's Moonshine Mod G9S2-V60 Installer.exe (183607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\crypted.exe (9260 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: HD Player
Product Version: 6.0.6001.18000
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WEXTRACT.EXE
Internal Name: Wextract
File Version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
File Description: Win32 Cabinet Self-Extractor
Comments:
Language: English (United States)

Company Name: Microsoft CorporationProduct Name: HD Player Product Version: 6.0.6001.18000Legal Copyright: (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: WEXTRACT.EXE Internal Name: Wextract File Version: 6.0.6001.18000 (longhorn_rtm.080118-1840)File Description: Win32 Cabinet Self-Extractor Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	43488	43520	4.55206	9ee0e124f68a3a1c8fa64ad51ff9fa45
.data	49152	8800	1536	4.57321	f3764284f4d25ed35f75b9c16e1ab608
.rsrc	61440	11751424	11748352	5.54466	48da8d0b25ff02e8a11898cf3bd4ae21
.reloc	11812864	3280	3584	3.33839	6ecf5ec5c89c4b613322d7793c0bd979

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Worm connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_564:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

msvcrt.dll

COMCTL32.dll

VERSION.dll

advapi32.dll

wininit.ini

advpack.dll

Software\Microsoft\Windows\CurrentVersion\App Paths

setupapi.dll

setupx.dll

IXPd.TMP

TMP4351$.TMP

FINISHMSG

USRQCMD

ADMQCMD

msdownld.tmp

wextract.pdb

PSSSSSSh

RegCloseKey

RegOpenKeyExA

RegQueryInfoKeyA

RegCreateKeyExA

GetWindowsDirectoryA

ExitWindowsEx

MsgWaitForMultipleObjects

_acmdln

_amsg_exit

rundll32.exe %s,InstallHinfSection %s 128 %s

SHELL32.DLL

Software\Microsoft\Windows\CurrentVersion\RunOnce

PendingFileRenameOperations

System\CurrentControlSet\Control\Session Manager\FileRenameOperations

wextract_cleanup%d

%s /D:%s

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"

Command.com /c %s

zcÃ

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\

33333330

3333333

33333333

Tiara's Moonshine Mod G9S2-V60 Installer.exe

crypted.exe

.hs-K8

C-U}L

.fh"c

j!.fcwi

.PNV[P

:n.TR

Ã–J)2

%S"[-

%%sqBNEX

.dQ|N

.ICrB

!k.YT

w~.ZI

.m.Po

Fyef.lB

w4.lG

T.TFhl

B%sYQ

jYC%c

9.VhJ

Is,%X

o).cz

5.tZ\

|.nH`C

=_.Gk

".qqx-

2`/2)(07

k.pGFYSK

%d~HL

yv'w.he

.AY )v

;QQ.WC

7Q.hG{

,E\%F

]o{%C

.ELs]

'.uU;

nf%ug

.lYUq c

h%D

Gx.dn

r7eÃ’

R^%uc

.Cj8Q

.gH)

}d%U1

/T%XQ

ON,j.LL

.AyqAf

TCpH_

Ov%d}

T(/}

.QZf'ut

.Eq>2

.G-bJ}

Co,.LWl

i .AA

.hsA~

*rZx-y}

2[%U5

qx.TV

.yT&,

2N%8xr

.qMv;

lFÃž

z.Cdkn

M%}l%xXV

j}.mO6;r

%D"_&

Sb.HK

S[.TKW

Ng3%CW@W

EÃ¿c

Ze.Wi

.gr;P

g%X4Us

6%XSR

|.QT\

z.Es,

`%c;K

].nIxd

x>.WvP`

B.Ix-VNJ

./1%F

$\%cW

%C]hn

}X.nY6

.ecK@

%xMDZ

">V!D1'

U\Uz)%U6

b-.wT

('.Dj

%s:6$5

.kEMm

le.Af

Vh.CR

V%xl}

.XYccj7

%uiq3

.HgK8

.Zg0H

Uqm.ju

P 6o%4s

.tI@i

.GJx\

5.SF7b

`.yt:^

HL.yEvS

G.qs.m

.kzBv

X*.YgS

%sg .Y

Zdrq%U

6?%uc

.zz\^0

7=M~%X

.mIqg

I[.nWT

9D.YL

yk-Uek}

a&&4%x'

#.UZj

&/wWeq%C&g

O?-L}

t%X{

bIOs.un

%cYna

%s8W{

.fjE!

R%c:G

.UBWy

Ã»(:

x%s/I

VO.SC

|.ber

%XSHN

$L9\%D

.NfPn

kn.pB

.DnKTo!~P

:).ya

70,%ds

0.BCy

.ek(

.stYo

' 2%x

E}C.pV

ÃuyNj

7.Jue

%c-lS

s.tS)

fhQE.Tq

e.vOr@

%d($?|c

*S.qT

}.iSSf}L

md.wV

n^%fk

~q2%uH

.Um\q

.aowl

%Cj&Mn

H.lcs

1n%uLV

t.MbjqszK

.NJoM

.Qw='

>H$Ju%sX

-o.nA

#2K.ME3

Ã:G

6%Y%s

%DhUI

dN.Td

0%cJ2;

{^w.*%cV

Q~D.NNOf

.hF >

T.SHXd

(Q.fN

Cs,%s

R.ZJ7

WGb%C|

9)Ã‡1

4V.qS

& Ã“E

T.SBSaF8

&.Shl4

E.aH-

.hgp,

kC.vh

".Kv3Fx2

[zQSShwZ

p.dLPf

l.uyQ

qQV.Bc`

%xXXo:

4.BY*

wAcs%D

{g%u/V

L3.PN&\

{(U L.Ko

t%8sV6

mr-.Ld

k.nQH

.yE;R

.hN$S

\).%Xq

.VTn5YS`

.gHe}

~.sy~e

-.WPT

.ODoc

F.Rh#m2

!.LS"

=--8L.LZ

.Kwqk]

.BYt":

F.MBg>

[i.Ka

eE%c=

.tNpr

!0.tT

0-dZ}p)

3NT.Wsk

4.nsb

\%Ux96

n>|

]-a.Cm

XW.Hn

.CAg2

kEyF

5Bf).HX2

.xT?W

y*%sE#

=S,.GY

tcpn~

cgNy.kE

%0sdA

p2Å’

}9H-%F

o.Of_

5.gvG

.vt 6

%k.By_B

.drY.%

xT1|.Kn

[n:qh-i}n)ZJ

.Uppj

cl.Dy2

@7.YMX

j/.HB

-.Qx3.

UTG%d

LÃŽ@

.bFCw

~.kED

.aV_q

k.IlC

s;.ay

fTP[n8

H.Sn?r

]%dKv

%Xl) l

g'Â

il&Ã™H,3!

&jW:C$.re

!H.fnaq

U.JnC

C.iee

.iVpk

"j.MBf

Iu.BH

S.Ol0

wA~,%x

i%D)9:

.fC1yOr

l&X.pb!I

8I.lc

.Ip/ PC

=V.rLa

f.QXy

!?.vw

.IK!-a

S%O%U

2.qkC

k.IMk

'.wws\

&Ã’W

a&.XrW1U

)!%D]

.MHC"

nd.sU

2g%SS,!

.jDy`/

8A%XUJ FHu(

#%FL-zyH%

%X:W{d

.YVG=J

zyx%2s$

E)a%X

cMdM#

>[%fj

2FVe.cH

.bQ:E

.AnYk

%uO(0b

.ToFe

.bFUl

>sqL:Y

KG.Ij

%D>_y

`C"LKÃ™"8e

%c\{v

{A[%XzVi

%s;^7##

|{XN%s

%S!L(

(D.VIK

~Y%dQ8c

5vl%x

.oVzP

,}Â

1b1s|.knZ

v.byw

.thzw

n%Sdh

o%ds5

R%D'>

Y.sH?

$.TjJ

\].gd

m.spo

.Ay&S}

%U_{^rx

65.Az

Tx.fi

1%u

Q.QJrg

X7W%X

B.MOH6

.MDA/

Q.Btd

gJ/.tbC

OlN.oV

?#.fW

.OgTd

.frt'

-/2,04}

DmP".p3.WV

R.qP"

.vxiCj

v6%s&

Zt.ok

%Umxo.

\ui>kZE.gK

.Rn_1e

@ .sB

%x!0g

.hh?1

.Zr4J[

%c|r;

0H.lM

.iL3F

U}.MEf

#MS.cw

lj.ux

? |%UK

75.dd

%Dyemq{

|=;]%D

m.zYl

/%fl6

.WH8k

.levZ

&.dp-

j.ZN'

.OK1>

R.KT1

/ %d;

.KV9

%d?)b

!.UCn

j8CmD

WssHf?

%u3{s

Ãž,gw

SqLa

MF\N.chu;

b4,!%X

^U#.zc

x.YS4

K.hP;

.lY;Cl

.XY33g

-G}4C

Kj.Ca

1-%Xc

>RO.dN

OU%cr

-qSW}

^.fn}J

>.yd&

E..aX

R.TMO

.sO;^

.xWyv

(N.ey0

X^P.HOM0

}3.CcL

.eOX)

%Xd>z

%x)jf (

.LN,.

Ãnn

bw[-%f

YrU.Eo%C

.F%uk

TK%XT

.jfSmG

.nKBM

|#%dP

k_Ã

J_ '%cz

,.dpy

3%s*K

$(%xU

a0(%X

sho&%f

.YWu`N

ED.ax

g-u}w

!y.eSx

H.Lb!Y

#f6

[.sb$

$..RS

\p.Dm

X%xsnZQ

,^d%C

%X@bp

(%XF@

\S%sX

-%CnaF

tCpl

vX%FR

v=)%X

#L.jj

%C|#p

3.jIf

0H.JbcF

.Ux!T

.sx:q

q'%7X

.RSyBg

H.St5pX

\.ZN

M:Fb.TG

f%uMeqI

.sACr

(%FjJ

.Wb4N

Md3Q$%D

s.QO\U

{1E6.wd

R.kx'

.QGoB

q__

EY-ebQ}

Pa.RE

,A.aL

;.GhX;

X.RSml

.kD4t

3.Td\x

#,.fB

d%fPAM-

..IDW

-v.vp

bV?%C

%x)X5

.yY:LUF

&E%Fg

Bd&"$.UX

O.Qk>hjo2

o)g.iHw

oT%.d

Mq9N.cI

4.pe"D

mY%fqua

Sb.ff

o^%FY

nOr.sA

YY%u

%x%4}f1

89mX.hK

|.hzD

.gk=3DP

}%U(U

7(WEB

%dru{

.XI\*

_6.Tzp

l.pm3Z

}H.an

.EdGP

-.OLVa

(&k%D

..IV[Py

M .BEm

%s)aW

R4[7%d

.tn4F

;#oÃ‰

.db%G

%f?7m

XT.lV7

u.auR

t].kR

.PU5Z

.Ci>]0z

n.dP/

cLc-x}

%C}n_

io-N}

"G7%x)5

vk2%X

ku9%S

).iSI

~-9rc3}

,b.Jt8

h%c>{#

~.Dcy

a}S,.Un\

CRtB

.sX?

>FEMgls%s

m%x-\

.tST&

F/.Qnf'

.rQ!y

HW.pqf5

Pr.Hl

.PI)WC

?MZ%UG

.lW[n

.bF"N>

)N%S-

(.HtK

/.PY/

`.Jz] (

].Lb`

}VF%C

Cx%fG

.XL;g

eQ.bW

K.IOz

s6%Cw> D

(v.Qc

iNU%F

|$.QI

%fv^j

t/%S?

VD%.c

_.b]%d

_.By:

.yE|Y

n%S

<.jcy>

.Fhkd

%cG:6T_

aHn%U

v.AGQ

t!rx%DMo

GV.Ij

.%.Dj

{B.Qi

Ã½B9#0-

_.Pqk

Q7,

2V.Gb

/|%D*

1\441]01(:

Db^O4%x

v\.Ax

J.jdB

.bknN

p.Dy;z

xU.Zd(

\3.AK

{*%D$I/8

.DuWN

X.En`

.jmL5](

/.rEoT

.jO>f5

e{%.s

E.PF-

5F.OSKZ5'

}~.jv

'&&&!&'!!

%.wV;zJ

t].XTW

Mays%S"

U.GA8zK2?

!C.bT

x77%%s

.nOh_Y

C{V%c

ZEsFQ

i-.lMr

8-H}&

1%x/s

Q.ECff.k

.ukLDP

.PDyM

L.vjN

t%UD%

l.MGM

!@.zP

.rl-V

s.BHe

bq.Pp

/.HaUQxZ

auDph

ekEY3

=m.ZU

%XC/w

M<.kg>

.ka-H

~:3Q%f

^].po

U@Q.ZiY

.Nn)v

J.Vhj

U %uY/@

yl.EC

Bb.LHz9

%SJp~K

.JQSU

wJO.Re

#g.Vk

3-%%c_d

-UÃ´)

nU.uP

'.usUE^

B%Du

w<.eon>

:$%SZ

.VC@d

:.vjl

TF.hL

%fpwxb8Q

,%x)v

^K.oq

cc'%s

i{!%F

;%xm48

N|r%S

fTPh

-=,E% G;%X

C.BS4

-)l%x$

.uiSD^

Z[Ãžj

|b}t{.KZ

.sq-,

Z@Ã¼'

gAu8.LB

P).pD

K%x

Ow.UFo

~-c}Q

n.em1

NY.nn]L

%XZoa

ALW9%d^

%fj6K%N

UCRtba

;*V.go

N.uM-3

t?pU.Qk

-x3KnEJ}#

"t.fSe

k)%D~

$xR%.c

u"..Cb

I.ch8

A5%dr

'.zL=

;`%U}6

.FKp(

Zc.YU

!?1tX.Rj

'6.Ef

2 .IvP

ly.fTkUI

dS.RO

|..HL

v.Ms$d`Z

h.YNuk

Na.Uq

%Fh\]/

Jm.Gy

FoHÃ™?Y

6`IU.om{

v%XZ,

g]nLW*A.bj

8URL

J%D>"

7.XlU

.Rd>}j\C3

G#.uC

Ã,*

.DTV1

$.LSu0

RO?hN%,|{.KS

.um:%

7'.hO

;16D&%f

.fSJ*

)%fsr

!Xc%d

qL-5}

}f.oy

?C v

.OSPf

3`-3hJ}]%

AV.wxn

\>.oyF

6.QrZ(?9g

~Z.zFK

]T.KK

WJr&Cz.Ir

dD#%DJmy

L.ma[

V%c!W

I/.Co5

a4V.ZhO

pl.Dr

x%UDN

c-G.Iv

s5g%UX

.%Fh_

.QQx5

LUP%S

Z%.rO

NjQ.jX

/n%fs

.trC.a

.Wh04

.IoFq

G.Rl5J

M.nm0m

=k.On&k4

q%CXI

Pz[tcP

%X8D.

)?Ã

en.CX

oB!.MO

-P.aii

gO%CP

P%CQ8

lY/'J.wA&

vIo%d

4Pd%u

>%S%EWA

5Q.az

-P%s1

sQLq

'iD|.Tm9z@

5.JI(

%2x *

sz-t %C

LF8hcC%C

}%%x8

.Lo&5]

&.Swt

.YG_w

%sbW6

S:.upWJ

\.Hw#Y

%cn'|

Z?UDP

`.FWC

t C@%UJ@ZBP

;2b%u^uP

i{Q\v.di

l.NT1

,x.bd

W%slB

Lq%dgc

C&%x_

'K%Cj

L#k%U

-D.hD

K%uFdkK

%x3f,W,Q

xy.tW

%SJiT

D!.zD

(.boF

U %C)

gB;%U Qw

i%u!i

Â7/

IM.KH

/.OE-/

[.EsK

fTPL

Y>j.Sm

x.BdF0

.hu0

\{i.DX

%6xdf

=W.lk

> X.UP

.nU19

%si.B

%h%UN

?>195=3;7

@ .hDn\

!WB~.an=6

6%uSRF

n%Xww

m%U":24

.ZxA,

X%F,F

Q.VU)

.hLe1

uNr%f

e.iFN

dD.DlG

t..sl

.kRzK

\i.QY

.NCy9

P4[F*;.ud^w

.Kbcc

.JFe}

Y58%C[

.Ar~[4AM4&1

y.Om9:6

M- ;%F

2GHj.Ke

.Gvu4

4qV%Xi

&i.aL

X$(D.cY

c.wkig

QÃŽe

0.fJN%

-4{o'.(%Uj

?%D=H

z9[:b%C

@(@%s

.IeLOd

J.oitp

8.OlrW;

"'.Vd

0%xVB

.gpcD

~;ij.vOI

N%F#%

u %fg

.gd*"

.Bo="

ÃŒN1

j0Ã–

B5V.mA

7%sTA

.yIBfu

2%c$c7

GP"%X

.yAIj"

nO.LeSE

FM.mj

n.NLc

_.ybX"

/.lN@c

%D%X~

G.XI[

%sk[S{

ÃŸqK

%U4Rg

U.Gkj

GE.Vm

$%d}?

K gY19%f

.LsKn7

.Xm!R

@.JsK

Yrf-

3=t.by

uY.Js

W1.wm>3

.Bfkr

.tZD_

MY.YIV

%u.YlU

.vNFH

.C%X9

7&Ã±

.cfRk

upC%u

1K,Xl/%c

*7%St

N.hv]F

`%SW/^

.Yi/rY

}b-%f

Q:.kdBm

>%CXI

k_) %d

VwM%UO

]R.PY

/.feu

*4a%x

gPSc.XF

W4.Ac

Vo%Cj@

Ã‰t3

LIÃ3

5pj%f

Tqkey

w/;N%U

.gv]3

Cz>%Cj

%XLIVX

j^i?bY%s

/-xQ}

=]B%dT

9.DQ?1

,,/.eN|

V%Sj|

Uh.jP

G%cy$f

;k%s

tJ1!%s

'8.yKr

%f*)?

{%SIg"

.DOo*

.Il1,

Pn.qj

93`.mm

XF#%x

h%7UQ

y.an

-%2ut

w.kPR

xF%u$

Ã—Gh

D|FTP

.Jbz9

.nRb[=U

3.eTP

d&P.ve

:=~@.Im

.rm1L

T?c|.sEN

9:.Kf;

^KJ%FH7?Z@t

]'Z%s

.COq|

.yX:..

.XBU>\>

T]X{%f

q1.uq

^.BCX

Nh'EL.lf

%S0>x

tV.NaF>

-d19}

Webu

UftP

%.F

.Ea4\

'.HkIy

D.wA"?

tsexE

.hZ^u

"T.Lo4

{o2.pv

?.eoY

[.hbk

1%sF3

E.Wj"

1.Kkz

.Ukl)

Ox.Sl

'.MSj

{.hinP

~.bPZw

=.DDAL

-T.JkK

.iHvhc?!B5

c.G%U

?%cv7

MQi{%D

#.fE]

Q.CF(

Y.SO~

Izf.Tn

vZ~Ã‹

.xn5Lh'

%X?b`y

0N.oq

D.Lu>dd

.uxR(

2P%c#

D^L$%d

.fo4

"crypted.exe"

"Tiara's Moonshine Mod G9S2-V60 Installer.exe"

Kernel32.dll

Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.

CFailed to get disk space information from: %s.

System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?

8Unable to retrieve operating system version information.!Memory allocation request failed.

Filetable full.ÃŠn not change to destination folder.

Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.

(Error creating process . Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.

Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install

Could not create folder '%s'

To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.

Error retrieving Windows folder

$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .

System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.

/C: -- Override Install Command defined by author.

eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?

Could not find the file: %s.

:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.

6.0.6001.18000 (longhorn_rtm.080118-1840)

WEXTRACT.EXE

Windows

Operating System

6.0.6001.18000

Tiara's Moonshine Mod G9S2-V60 Installer.exe_312:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|/":

ME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsk2.tmp\BgImage.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsk2.tmp\BgImage.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsk2.tmp

.reloc

SSSSSSh

WINMM.dll

BgImage.dll

'.HkIy

D.wA"?

.gmRyOL

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\spltmp.wav

spltmp.wav

\Temp\nsk2.tmp\BgImage.dll

l15.ini if You Wish to Restore Font Back to Default)

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsk2.tmp

"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\Tiara's Moonshine Mod G9S2-V60 Installer.exe"

C:\Nexon\Mabinogi

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP

Tiara's Moonshine Mod G9S2-V60 Installer.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\Tiara's Moonshine Mod G9S2-V60 Installer.exe