Skip to content

Instantly share code, notes, and snippets.

@sysopfb

sysopfb/RE_Notes

Created April 19, 2019 16:37
Show Gist options
  • Save sysopfb/fe60dfb0ecec3c8465bf804ccf8c6944 to your computer and use it in GitHub Desktop.
Save sysopfb/fe60dfb0ecec3c8465bf804ccf8c6944 to your computer and use it in GitHub Desktop.
Download ZIP
Notes for hancitor/chanitor e4ad65ade2f04e05a886b398ef08261f5858b15cc822ef29b604cecaac3036b5 crypter
Raw
RE_Notes
Fast travel:
VirtualProtect on text section before xor decoding next layer
next layer resolves dependencies and then virtualallocs before main code begins
Detection notes:
single byte xor of bytecode is incredibly easy to signature on
Finding kernel32:
004087A1 55 PUSH EBP
004087A2 8BEC MOV EBP,ESP
004087A4 81EC 08020000 SUB ESP,208
004087AA 53 PUSH EBX
004087AB 56 PUSH ESI
004087AC 57 PUSH EDI
004087AD 60 PUSHAD
004087AE FC CLD
004087AF 33D2 XOR EDX,EDX
004087B1 64:8B15 30000000 MOV EDX,DWORD PTR FS:[30]
004087B8 8B52 0C MOV EDX,DWORD PTR DS:[EDX+C]
004087BB 8B52 14 MOV EDX,DWORD PTR DS:[EDX+14]
004087BE 8B72 28 MOV ESI,DWORD PTR DS:[EDX+28]
004087C1 6A 18 PUSH 18
004087C3 59 POP ECX
004087C4 33FF XOR EDI,EDI
004087C6 33C0 XOR EAX,EAX
004087C8 AC LODS BYTE PTR DS:[ESI]
004087C9 3C 61 CMP AL,61
004087CB 7C 02 JL SHORT e4ad65ad.004087CF
004087CD 2C 20 SUB AL,20
004087CF C1CF 0D ROR EDI,0D
004087D2 03F8 ADD EDI,EAX
004087D4 ^E2 F0 LOOPD SHORT e4ad65ad.004087C6
004087D6 81FF 5BBC4A6A CMP EDI,6A4ABC5B
004087DC 8B5A 10 MOV EBX,DWORD PTR DS:[EDX+10]
004087DF 8B12 MOV EDX,DWORD PTR DS:[EDX]
004087E1 ^75 DB JNZ SHORT e4ad65ad.004087BE
Finds the second occurrence of 0x70c5ba88 after copying itself over
Jumps to that address +4 over the hardcoded needle
16 byte RC4
key
001C0455 A7 68 FD 23 1E A3 B9 CF §hý#£¹Ï
001C045D 68 E5 DE EF C1 AD E1 34 håÞïÁ­á4
sbox snippet after KSA
0018FD80 65 4C 04 35 08 29 BE 94 eL)¾”
0018FD88 64 B8 DA 03 A1 61 4A 80 d¸Ú¡aJ€
0018FD90 7D BF 0B E6 21 49 9F 85 }¿æ!IŸ…
0018FD98 AD D6 F7 14 DE A8 FB FA ­Ö÷Þ¨ûú
0018FDA0 32 46 34 AF 67 8C 98 F5 2F4¯gŒ˜õ
Copies 0x934e bytes over from 0x401000
uses previously built RC4 table
And scrambles the PRNG output by doing mod 0x934e-i against every dword value
unless the value is < 0x934e-i - redundant with modulus
then XORs the bytes with 0x4
This is the text section, the rest of the pieces of this layer are then rebuilt and it's called.
This section does a classic trick of setting a callback in a window creation, for some reason the blog you linked skips over the decoding portion.
Anyway you can go to the callback function setup in the windows class registration and then look at the top it's basically waiting for a particular value passed to the callback of 0x113 which according to the MSDN message formats this is a WM_TIMER hit
It's then incrementing the value and waiting for 0xc8 WM_TIMER iterations before performing the actual unpacked of the next layer
This is basically a sleep
The decoding loop is kind of a cool little stream XOR but it's ultimately just a 4 byte xor over.
After being XORd the data is LZNT decompressed and this gives you the unpacked chanitor/hancitor binary
However the main part of chanitor is still not copied over, the next part finds a marker in the unpacked binary and the copies over the encrypted configuration data for chanitor/hancitor.
At this point it's probably safe to assume this layer is actually related to chanitor/hancitor as a protective layer. Would have to go through other files to confirm.
So the original layer that rebuilt a PE file is probably the last crypter layer and the copied over and rebuilt PE file is the actual first level of chanitor/hancitor.
Chanitor decoded config:
{'build': '11pke12', 'urls': ['http://api.ipify.org', 'http://sandverrolve.com/4/forum.php', 'http://gotrefsehan.ru/4/forum.php', 'http://enheswithto.ru/4/forum.php']}
@sysopfb
Copy link
Author

sysopfb commented Apr 19, 2019

yara rule for part of the crypter layer 1

004087C4   33FF             XOR EDI,EDI
004087C6   33C0             XOR EAX,EAX
004087C8   AC               LODS BYTE PTR DS:[ESI]
004087C9   3C 61            CMP AL,61
004087CB   7C 02            JL SHORT e4ad65ad.004087CF
004087CD   2C 20            SUB AL,20
004087CF   C1CF 0D          ROR EDI,0D
004087D2   03F8             ADD EDI,EAX
004087D4  ^E2 F0            LOOPD SHORT e4ad65ad.004087C6
004087D6 81FF 5BBC4A6A CMP EDI,6A4ABC5B

``
rule xor_encoded
{
strings:

$1 = {32 fe 32 c1 ad 3d 60 7d 03 2d 21 c0 ce 0c 02 f9 e3 f1 80 fe 5a bd 4b 6b}
$2 = {31 fd 31 c2 ae 3e 63 7e 00 2e 22 c3 cd 0f 01 fa e0 f2 83 fd 59 be 48 68}
$3 = {30 fc 30 c3 af 3f 62 7f 01 2f 23 c2 cc 0e 00 fb e1 f3 82 fc 58 bf 49 69}
$4 = {37 fb 37 c4 a8 38 65 78 06 28 24 c5 cb 09 07 fc e6 f4 85 fb 5f b8 4e 6e}
$5 = {36 fa 36 c5 a9 39 64 79 07 29 25 c4 ca 08 06 fd e7 f5 84 fa 5e b9 4f 6f}
$6 = {35 f9 35 c6 aa 3a 67 7a 04 2a 26 c7 c9 0b 05 fe e4 f6 87 f9 5d ba 4c 6c}
$7 = {34 f8 34 c7 ab 3b 66 7b 05 2b 27 c6 c8 0a 04 ff e5 f7 86 f8 5c bb 4d 6d}
$8 = {3b f7 3b c8 a4 34 69 74 0a 24 28 c9 c7 05 0b f0 ea f8 89 f7 53 b4 42 62}
$9 = {3a f6 3a c9 a5 35 68 75 0b 25 29 c8 c6 04 0a f1 eb f9 88 f6 52 b5 43 63}
$10 = {39 f5 39 ca a6 36 6b 76 08 26 2a cb c5 07 09 f2 e8 fa 8b f5 51 b6 40 60}
$11 = {38 f4 38 cb a7 37 6a 77 09 27 2b ca c4 06 08 f3 e9 fb 8a f4 50 b7 41 61}
$12 = {3f f3 3f cc a0 30 6d 70 0e 20 2c cd c3 01 0f f4 ee fc 8d f3 57 b0 46 66}
$13 = {3e f2 3e cd a1 31 6c 71 0f 21 2d cc c2 00 0e f5 ef fd 8c f2 56 b1 47 67}
$14 = {3d f1 3d ce a2 32 6f 72 0c 22 2e cf c1 03 0d f6 ec fe 8f f1 55 b2 44 64}
$15 = {3c f0 3c cf a3 33 6e 73 0d 23 2f ce c0 02 0c f7 ed ff 8e f0 54 b3 45 65}
$16 = {23 ef 23 d0 bc 2c 71 6c 12 3c 30 d1 df 1d 13 e8 f2 e0 91 ef 4b ac 5a 7a}
$17 = {22 ee 22 d1 bd 2d 70 6d 13 3d 31 d0 de 1c 12 e9 f3 e1 90 ee 4a ad 5b 7b}
$18 = {21 ed 21 d2 be 2e 73 6e 10 3e 32 d3 dd 1f 11 ea f0 e2 93 ed 49 ae 58 78}
$19 = {20 ec 20 d3 bf 2f 72 6f 11 3f 33 d2 dc 1e 10 eb f1 e3 92 ec 48 af 59 79}
$20 = {27 eb 27 d4 b8 28 75 68 16 38 34 d5 db 19 17 ec f6 e4 95 eb 4f a8 5e 7e}
$21 = {26 ea 26 d5 b9 29 74 69 17 39 35 d4 da 18 16 ed f7 e5 94 ea 4e a9 5f 7f}
$22 = {25 e9 25 d6 ba 2a 77 6a 14 3a 36 d7 d9 1b 15 ee f4 e6 97 e9 4d aa 5c 7c}
$23 = {24 e8 24 d7 bb 2b 76 6b 15 3b 37 d6 d8 1a 14 ef f5 e7 96 e8 4c ab 5d 7d}
$24 = {2b e7 2b d8 b4 24 79 64 1a 34 38 d9 d7 15 1b e0 fa e8 99 e7 43 a4 52 72}
$25 = {2a e6 2a d9 b5 25 78 65 1b 35 39 d8 d6 14 1a e1 fb e9 98 e6 42 a5 53 73}
$26 = {29 e5 29 da b6 26 7b 66 18 36 3a db d5 17 19 e2 f8 ea 9b e5 41 a6 50 70}
$27 = {28 e4 28 db b7 27 7a 67 19 37 3b da d4 16 18 e3 f9 eb 9a e4 40 a7 51 71}
$28 = {2f e3 2f dc b0 20 7d 60 1e 30 3c dd d3 11 1f e4 fe ec 9d e3 47 a0 56 76}
$29 = {2e e2 2e dd b1 21 7c 61 1f 31 3d dc d2 10 1e e5 ff ed 9c e2 46 a1 57 77}
$30 = {2d e1 2d de b2 22 7f 62 1c 32 3e df d1 13 1d e6 fc ee 9f e1 45 a2 54 74}
$31 = {2c e0 2c df b3 23 7e 63 1d 33 3f de d0 12 1c e7 fd ef 9e e0 44 a3 55 75}
$32 = {13 df 13 e0 8c 1c 41 5c 22 0c 00 e1 ef 2d 23 d8 c2 d0 a1 df 7b 9c 6a 4a}
$33 = {12 de 12 e1 8d 1d 40 5d 23 0d 01 e0 ee 2c 22 d9 c3 d1 a0 de 7a 9d 6b 4b}
$34 = {11 dd 11 e2 8e 1e 43 5e 20 0e 02 e3 ed 2f 21 da c0 d2 a3 dd 79 9e 68 48}
$35 = {10 dc 10 e3 8f 1f 42 5f 21 0f 03 e2 ec 2e 20 db c1 d3 a2 dc 78 9f 69 49}
$36 = {17 db 17 e4 88 18 45 58 26 08 04 e5 eb 29 27 dc c6 d4 a5 db 7f 98 6e 4e}
$37 = {16 da 16 e5 89 19 44 59 27 09 05 e4 ea 28 26 dd c7 d5 a4 da 7e 99 6f 4f}
$38 = {15 d9 15 e6 8a 1a 47 5a 24 0a 06 e7 e9 2b 25 de c4 d6 a7 d9 7d 9a 6c 4c}
$39 = {14 d8 14 e7 8b 1b 46 5b 25 0b 07 e6 e8 2a 24 df c5 d7 a6 d8 7c 9b 6d 4d}
$40 = {1b d7 1b e8 84 14 49 54 2a 04 08 e9 e7 25 2b d0 ca d8 a9 d7 73 94 62 42}
$41 = {1a d6 1a e9 85 15 48 55 2b 05 09 e8 e6 24 2a d1 cb d9 a8 d6 72 95 63 43}
$42 = {19 d5 19 ea 86 16 4b 56 28 06 0a eb e5 27 29 d2 c8 da ab d5 71 96 60 40}
$43 = {18 d4 18 eb 87 17 4a 57 29 07 0b ea e4 26 28 d3 c9 db aa d4 70 97 61 41}
$44 = {1f d3 1f ec 80 10 4d 50 2e 00 0c ed e3 21 2f d4 ce dc ad d3 77 90 66 46}
$45 = {1e d2 1e ed 81 11 4c 51 2f 01 0d ec e2 20 2e d5 cf dd ac d2 76 91 67 47}
$46 = {1d d1 1d ee 82 12 4f 52 2c 02 0e ef e1 23 2d d6 cc de af d1 75 92 64 44}
$47 = {1c d0 1c ef 83 13 4e 53 2d 03 0f ee e0 22 2c d7 cd df ae d0 74 93 65 45}
$48 = {03 cf 03 f0 9c 0c 51 4c 32 1c 10 f1 ff 3d 33 c8 d2 c0 b1 cf 6b 8c 7a 5a}
$49 = {02 ce 02 f1 9d 0d 50 4d 33 1d 11 f0 fe 3c 32 c9 d3 c1 b0 ce 6a 8d 7b 5b}
$50 = {01 cd 01 f2 9e 0e 53 4e 30 1e 12 f3 fd 3f 31 ca d0 c2 b3 cd 69 8e 78 58}
$51 = {00 cc 00 f3 9f 0f 52 4f 31 1f 13 f2 fc 3e 30 cb d1 c3 b2 cc 68 8f 79 59}
$52 = {07 cb 07 f4 98 08 55 48 36 18 14 f5 fb 39 37 cc d6 c4 b5 cb 6f 88 7e 5e}
$53 = {06 ca 06 f5 99 09 54 49 37 19 15 f4 fa 38 36 cd d7 c5 b4 ca 6e 89 7f 5f}
$54 = {05 c9 05 f6 9a 0a 57 4a 34 1a 16 f7 f9 3b 35 ce d4 c6 b7 c9 6d 8a 7c 5c}
$55 = {04 c8 04 f7 9b 0b 56 4b 35 1b 17 f6 f8 3a 34 cf d5 c7 b6 c8 6c 8b 7d 5d}
$56 = {0b c7 0b f8 94 04 59 44 3a 14 18 f9 f7 35 3b c0 da c8 b9 c7 63 84 72 52}
$57 = {0a c6 0a f9 95 05 58 45 3b 15 19 f8 f6 34 3a c1 db c9 b8 c6 62 85 73 53}
$58 = {09 c5 09 fa 96 06 5b 46 38 16 1a fb f5 37 39 c2 d8 ca bb c5 61 86 70 50}
$59 = {08 c4 08 fb 97 07 5a 47 39 17 1b fa f4 36 38 c3 d9 cb ba c4 60 87 71 51}
$60 = {0f c3 0f fc 90 00 5d 40 3e 10 1c fd f3 31 3f c4 de cc bd c3 67 80 76 56}
$61 = {0e c2 0e fd 91 01 5c 41 3f 11 1d fc f2 30 3e c5 df cd bc c2 66 81 77 57}
$62 = {0d c1 0d fe 92 02 5f 42 3c 12 1e ff f1 33 3d c6 dc ce bf c1 65 82 74 54}
$63 = {0c c0 0c ff 93 03 5e 43 3d 13 1f fe f0 32 3c c7 dd cf be c0 64 83 75 55}
$64 = {73 bf 73 80 ec 7c 21 3c 42 6c 60 81 8f 4d 43 b8 a2 b0 c1 bf 1b fc 0a 2a}
$65 = {72 be 72 81 ed 7d 20 3d 43 6d 61 80 8e 4c 42 b9 a3 b1 c0 be 1a fd 0b 2b}
$66 = {71 bd 71 82 ee 7e 23 3e 40 6e 62 83 8d 4f 41 ba a0 b2 c3 bd 19 fe 08 28}
$67 = {70 bc 70 83 ef 7f 22 3f 41 6f 63 82 8c 4e 40 bb a1 b3 c2 bc 18 ff 09 29}
$68 = {77 bb 77 84 e8 78 25 38 46 68 64 85 8b 49 47 bc a6 b4 c5 bb 1f f8 0e 2e}
$69 = {76 ba 76 85 e9 79 24 39 47 69 65 84 8a 48 46 bd a7 b5 c4 ba 1e f9 0f 2f}
$70 = {75 b9 75 86 ea 7a 27 3a 44 6a 66 87 89 4b 45 be a4 b6 c7 b9 1d fa 0c 2c}
$71 = {74 b8 74 87 eb 7b 26 3b 45 6b 67 86 88 4a 44 bf a5 b7 c6 b8 1c fb 0d 2d}
$72 = {7b b7 7b 88 e4 74 29 34 4a 64 68 89 87 45 4b b0 aa b8 c9 b7 13 f4 02 22}
$73 = {7a b6 7a 89 e5 75 28 35 4b 65 69 88 86 44 4a b1 ab b9 c8 b6 12 f5 03 23}
$74 = {79 b5 79 8a e6 76 2b 36 48 66 6a 8b 85 47 49 b2 a8 ba cb b5 11 f6 00 20}
$75 = {78 b4 78 8b e7 77 2a 37 49 67 6b 8a 84 46 48 b3 a9 bb ca b4 10 f7 01 21}
$76 = {7f b3 7f 8c e0 70 2d 30 4e 60 6c 8d 83 41 4f b4 ae bc cd b3 17 f0 06 26}
$77 = {7e b2 7e 8d e1 71 2c 31 4f 61 6d 8c 82 40 4e b5 af bd cc b2 16 f1 07 27}
$78 = {7d b1 7d 8e e2 72 2f 32 4c 62 6e 8f 81 43 4d b6 ac be cf b1 15 f2 04 24}
$79 = {7c b0 7c 8f e3 73 2e 33 4d 63 6f 8e 80 42 4c b7 ad bf ce b0 14 f3 05 25}
$80 = {63 af 63 90 fc 6c 31 2c 52 7c 70 91 9f 5d 53 a8 b2 a0 d1 af 0b ec 1a 3a}
$81 = {62 ae 62 91 fd 6d 30 2d 53 7d 71 90 9e 5c 52 a9 b3 a1 d0 ae 0a ed 1b 3b}
$82 = {61 ad 61 92 fe 6e 33 2e 50 7e 72 93 9d 5f 51 aa b0 a2 d3 ad 09 ee 18 38}
$83 = {60 ac 60 93 ff 6f 32 2f 51 7f 73 92 9c 5e 50 ab b1 a3 d2 ac 08 ef 19 39}
$84 = {67 ab 67 94 f8 68 35 28 56 78 74 95 9b 59 57 ac b6 a4 d5 ab 0f e8 1e 3e}
$85 = {66 aa 66 95 f9 69 34 29 57 79 75 94 9a 58 56 ad b7 a5 d4 aa 0e e9 1f 3f}
$86 = {65 a9 65 96 fa 6a 37 2a 54 7a 76 97 99 5b 55 ae b4 a6 d7 a9 0d ea 1c 3c}
$87 = {64 a8 64 97 fb 6b 36 2b 55 7b 77 96 98 5a 54 af b5 a7 d6 a8 0c eb 1d 3d}
$88 = {6b a7 6b 98 f4 64 39 24 5a 74 78 99 97 55 5b a0 ba a8 d9 a7 03 e4 12 32}
$89 = {6a a6 6a 99 f5 65 38 25 5b 75 79 98 96 54 5a a1 bb a9 d8 a6 02 e5 13 33}
$90 = {69 a5 69 9a f6 66 3b 26 58 76 7a 9b 95 57 59 a2 b8 aa db a5 01 e6 10 30}
$91 = {68 a4 68 9b f7 67 3a 27 59 77 7b 9a 94 56 58 a3 b9 ab da a4 00 e7 11 31}
$92 = {6f a3 6f 9c f0 60 3d 20 5e 70 7c 9d 93 51 5f a4 be ac dd a3 07 e0 16 36}
$93 = {6e a2 6e 9d f1 61 3c 21 5f 71 7d 9c 92 50 5e a5 bf ad dc a2 06 e1 17 37}
$94 = {6d a1 6d 9e f2 62 3f 22 5c 72 7e 9f 91 53 5d a6 bc ae df a1 05 e2 14 34}
$95 = {6c a0 6c 9f f3 63 3e 23 5d 73 7f 9e 90 52 5c a7 bd af de a0 04 e3 15 35}
$96 = {53 9f 53 a0 cc 5c 01 1c 62 4c 40 a1 af 6d 63 98 82 90 e1 9f 3b dc 2a 0a}
$97 = {52 9e 52 a1 cd 5d 00 1d 63 4d 41 a0 ae 6c 62 99 83 91 e0 9e 3a dd 2b 0b}
$98 = {51 9d 51 a2 ce 5e 03 1e 60 4e 42 a3 ad 6f 61 9a 80 92 e3 9d 39 de 28 08}
$99 = {50 9c 50 a3 cf 5f 02 1f 61 4f 43 a2 ac 6e 60 9b 81 93 e2 9c 38 df 29 09}
$100 = {57 9b 57 a4 c8 58 05 18 66 48 44 a5 ab 69 67 9c 86 94 e5 9b 3f d8 2e 0e}
$101 = {56 9a 56 a5 c9 59 04 19 67 49 45 a4 aa 68 66 9d 87 95 e4 9a 3e d9 2f 0f}
$102 = {55 99 55 a6 ca 5a 07 1a 64 4a 46 a7 a9 6b 65 9e 84 96 e7 99 3d da 2c 0c}
$103 = {54 98 54 a7 cb 5b 06 1b 65 4b 47 a6 a8 6a 64 9f 85 97 e6 98 3c db 2d 0d}
$104 = {5b 97 5b a8 c4 54 09 14 6a 44 48 a9 a7 65 6b 90 8a 98 e9 97 33 d4 22 02}
$105 = {5a 96 5a a9 c5 55 08 15 6b 45 49 a8 a6 64 6a 91 8b 99 e8 96 32 d5 23 03}
$106 = {59 95 59 aa c6 56 0b 16 68 46 4a ab a5 67 69 92 88 9a eb 95 31 d6 20 00}
$107 = {58 94 58 ab c7 57 0a 17 69 47 4b aa a4 66 68 93 89 9b ea 94 30 d7 21 01}
$108 = {5f 93 5f ac c0 50 0d 10 6e 40 4c ad a3 61 6f 94 8e 9c ed 93 37 d0 26 06}
$109 = {5e 92 5e ad c1 51 0c 11 6f 41 4d ac a2 60 6e 95 8f 9d ec 92 36 d1 27 07}
$110 = {5d 91 5d ae c2 52 0f 12 6c 42 4e af a1 63 6d 96 8c 9e ef 91 35 d2 24 04}
$111 = {5c 90 5c af c3 53 0e 13 6d 43 4f ae a0 62 6c 97 8d 9f ee 90 34 d3 25 05}
$112 = {43 8f 43 b0 dc 4c 11 0c 72 5c 50 b1 bf 7d 73 88 92 80 f1 8f 2b cc 3a 1a}
$113 = {42 8e 42 b1 dd 4d 10 0d 73 5d 51 b0 be 7c 72 89 93 81 f0 8e 2a cd 3b 1b}
$114 = {41 8d 41 b2 de 4e 13 0e 70 5e 52 b3 bd 7f 71 8a 90 82 f3 8d 29 ce 38 18}
$115 = {40 8c 40 b3 df 4f 12 0f 71 5f 53 b2 bc 7e 70 8b 91 83 f2 8c 28 cf 39 19}
$116 = {47 8b 47 b4 d8 48 15 08 76 58 54 b5 bb 79 77 8c 96 84 f5 8b 2f c8 3e 1e}
$117 = {46 8a 46 b5 d9 49 14 09 77 59 55 b4 ba 78 76 8d 97 85 f4 8a 2e c9 3f 1f}
$118 = {45 89 45 b6 da 4a 17 0a 74 5a 56 b7 b9 7b 75 8e 94 86 f7 89 2d ca 3c 1c}
$119 = {44 88 44 b7 db 4b 16 0b 75 5b 57 b6 b8 7a 74 8f 95 87 f6 88 2c cb 3d 1d}
$120 = {4b 87 4b b8 d4 44 19 04 7a 54 58 b9 b7 75 7b 80 9a 88 f9 87 23 c4 32 12}
$121 = {4a 86 4a b9 d5 45 18 05 7b 55 59 b8 b6 74 7a 81 9b 89 f8 86 22 c5 33 13}
$122 = {49 85 49 ba d6 46 1b 06 78 56 5a bb b5 77 79 82 98 8a fb 85 21 c6 30 10}
$123 = {48 84 48 bb d7 47 1a 07 79 57 5b ba b4 76 78 83 99 8b fa 84 20 c7 31 11}
$124 = {4f 83 4f bc d0 40 1d 00 7e 50 5c bd b3 71 7f 84 9e 8c fd 83 27 c0 36 16}
$125 = {4e 82 4e bd d1 41 1c 01 7f 51 5d bc b2 70 7e 85 9f 8d fc 82 26 c1 37 17}
$126 = {4d 81 4d be d2 42 1f 02 7c 52 5e bf b1 73 7d 86 9c 8e ff 81 25 c2 34 14}
$127 = {4c 80 4c bf d3 43 1e 03 7d 53 5f be b0 72 7c 87 9d 8f fe 80 24 c3 35 15}
$128 = {b3 7f b3 40 2c bc e1 fc 82 ac a0 41 4f 8d 83 78 62 70 01 7f db 3c ca ea}
$129 = {b2 7e b2 41 2d bd e0 fd 83 ad a1 40 4e 8c 82 79 63 71 00 7e da 3d cb eb}
$130 = {b1 7d b1 42 2e be e3 fe 80 ae a2 43 4d 8f 81 7a 60 72 03 7d d9 3e c8 e8}
$131 = {b0 7c b0 43 2f bf e2 ff 81 af a3 42 4c 8e 80 7b 61 73 02 7c d8 3f c9 e9}
$132 = {b7 7b b7 44 28 b8 e5 f8 86 a8 a4 45 4b 89 87 7c 66 74 05 7b df 38 ce ee}
$133 = {b6 7a b6 45 29 b9 e4 f9 87 a9 a5 44 4a 88 86 7d 67 75 04 7a de 39 cf ef}
$134 = {b5 79 b5 46 2a ba e7 fa 84 aa a6 47 49 8b 85 7e 64 76 07 79 dd 3a cc ec}
$135 = {b4 78 b4 47 2b bb e6 fb 85 ab a7 46 48 8a 84 7f 65 77 06 78 dc 3b cd ed}
$136 = {bb 77 bb 48 24 b4 e9 f4 8a a4 a8 49 47 85 8b 70 6a 78 09 77 d3 34 c2 e2}
$137 = {ba 76 ba 49 25 b5 e8 f5 8b a5 a9 48 46 84 8a 71 6b 79 08 76 d2 35 c3 e3}
$138 = {b9 75 b9 4a 26 b6 eb f6 88 a6 aa 4b 45 87 89 72 68 7a 0b 75 d1 36 c0 e0}
$139 = {b8 74 b8 4b 27 b7 ea f7 89 a7 ab 4a 44 86 88 73 69 7b 0a 74 d0 37 c1 e1}
$140 = {bf 73 bf 4c 20 b0 ed f0 8e a0 ac 4d 43 81 8f 74 6e 7c 0d 73 d7 30 c6 e6}
$141 = {be 72 be 4d 21 b1 ec f1 8f a1 ad 4c 42 80 8e 75 6f 7d 0c 72 d6 31 c7 e7}
$142 = {bd 71 bd 4e 22 b2 ef f2 8c a2 ae 4f 41 83 8d 76 6c 7e 0f 71 d5 32 c4 e4}
$143 = {bc 70 bc 4f 23 b3 ee f3 8d a3 af 4e 40 82 8c 77 6d 7f 0e 70 d4 33 c5 e5}
$144 = {a3 6f a3 50 3c ac f1 ec 92 bc b0 51 5f 9d 93 68 72 60 11 6f cb 2c da fa}
$145 = {a2 6e a2 51 3d ad f0 ed 93 bd b1 50 5e 9c 92 69 73 61 10 6e ca 2d db fb}
$146 = {a1 6d a1 52 3e ae f3 ee 90 be b2 53 5d 9f 91 6a 70 62 13 6d c9 2e d8 f8}
$147 = {a0 6c a0 53 3f af f2 ef 91 bf b3 52 5c 9e 90 6b 71 63 12 6c c8 2f d9 f9}
$148 = {a7 6b a7 54 38 a8 f5 e8 96 b8 b4 55 5b 99 97 6c 76 64 15 6b cf 28 de fe}
$149 = {a6 6a a6 55 39 a9 f4 e9 97 b9 b5 54 5a 98 96 6d 77 65 14 6a ce 29 df ff}
$150 = {a5 69 a5 56 3a aa f7 ea 94 ba b6 57 59 9b 95 6e 74 66 17 69 cd 2a dc fc}
$151 = {a4 68 a4 57 3b ab f6 eb 95 bb b7 56 58 9a 94 6f 75 67 16 68 cc 2b dd fd}
$152 = {ab 67 ab 58 34 a4 f9 e4 9a b4 b8 59 57 95 9b 60 7a 68 19 67 c3 24 d2 f2}
$153 = {aa 66 aa 59 35 a5 f8 e5 9b b5 b9 58 56 94 9a 61 7b 69 18 66 c2 25 d3 f3}
$154 = {a9 65 a9 5a 36 a6 fb e6 98 b6 ba 5b 55 97 99 62 78 6a 1b 65 c1 26 d0 f0}
$155 = {a8 64 a8 5b 37 a7 fa e7 99 b7 bb 5a 54 96 98 63 79 6b 1a 64 c0 27 d1 f1}
$156 = {af 63 af 5c 30 a0 fd e0 9e b0 bc 5d 53 91 9f 64 7e 6c 1d 63 c7 20 d6 f6}
$157 = {ae 62 ae 5d 31 a1 fc e1 9f b1 bd 5c 52 90 9e 65 7f 6d 1c 62 c6 21 d7 f7}
$158 = {ad 61 ad 5e 32 a2 ff e2 9c b2 be 5f 51 93 9d 66 7c 6e 1f 61 c5 22 d4 f4}
$159 = {ac 60 ac 5f 33 a3 fe e3 9d b3 bf 5e 50 92 9c 67 7d 6f 1e 60 c4 23 d5 f5}
$160 = {93 5f 93 60 0c 9c c1 dc a2 8c 80 61 6f ad a3 58 42 50 21 5f fb 1c ea ca}
$161 = {92 5e 92 61 0d 9d c0 dd a3 8d 81 60 6e ac a2 59 43 51 20 5e fa 1d eb cb}
$162 = {91 5d 91 62 0e 9e c3 de a0 8e 82 63 6d af a1 5a 40 52 23 5d f9 1e e8 c8}
$163 = {90 5c 90 63 0f 9f c2 df a1 8f 83 62 6c ae a0 5b 41 53 22 5c f8 1f e9 c9}
$164 = {97 5b 97 64 08 98 c5 d8 a6 88 84 65 6b a9 a7 5c 46 54 25 5b ff 18 ee ce}
$165 = {96 5a 96 65 09 99 c4 d9 a7 89 85 64 6a a8 a6 5d 47 55 24 5a fe 19 ef cf}
$166 = {95 59 95 66 0a 9a c7 da a4 8a 86 67 69 ab a5 5e 44 56 27 59 fd 1a ec cc}
$167 = {94 58 94 67 0b 9b c6 db a5 8b 87 66 68 aa a4 5f 45 57 26 58 fc 1b ed cd}
$168 = {9b 57 9b 68 04 94 c9 d4 aa 84 88 69 67 a5 ab 50 4a 58 29 57 f3 14 e2 c2}
$169 = {9a 56 9a 69 05 95 c8 d5 ab 85 89 68 66 a4 aa 51 4b 59 28 56 f2 15 e3 c3}
$170 = {99 55 99 6a 06 96 cb d6 a8 86 8a 6b 65 a7 a9 52 48 5a 2b 55 f1 16 e0 c0}
$171 = {98 54 98 6b 07 97 ca d7 a9 87 8b 6a 64 a6 a8 53 49 5b 2a 54 f0 17 e1 c1}
$172 = {9f 53 9f 6c 00 90 cd d0 ae 80 8c 6d 63 a1 af 54 4e 5c 2d 53 f7 10 e6 c6}
$173 = {9e 52 9e 6d 01 91 cc d1 af 81 8d 6c 62 a0 ae 55 4f 5d 2c 52 f6 11 e7 c7}
$174 = {9d 51 9d 6e 02 92 cf d2 ac 82 8e 6f 61 a3 ad 56 4c 5e 2f 51 f5 12 e4 c4}
$175 = {9c 50 9c 6f 03 93 ce d3 ad 83 8f 6e 60 a2 ac 57 4d 5f 2e 50 f4 13 e5 c5}
$176 = {83 4f 83 70 1c 8c d1 cc b2 9c 90 71 7f bd b3 48 52 40 31 4f eb 0c fa da}
$177 = {82 4e 82 71 1d 8d d0 cd b3 9d 91 70 7e bc b2 49 53 41 30 4e ea 0d fb db}
$178 = {81 4d 81 72 1e 8e d3 ce b0 9e 92 73 7d bf b1 4a 50 42 33 4d e9 0e f8 d8}
$179 = {80 4c 80 73 1f 8f d2 cf b1 9f 93 72 7c be b0 4b 51 43 32 4c e8 0f f9 d9}
$180 = {87 4b 87 74 18 88 d5 c8 b6 98 94 75 7b b9 b7 4c 56 44 35 4b ef 08 fe de}
$181 = {86 4a 86 75 19 89 d4 c9 b7 99 95 74 7a b8 b6 4d 57 45 34 4a ee 09 ff df}
$182 = {85 49 85 76 1a 8a d7 ca b4 9a 96 77 79 bb b5 4e 54 46 37 49 ed 0a fc dc}
$183 = {84 48 84 77 1b 8b d6 cb b5 9b 97 76 78 ba b4 4f 55 47 36 48 ec 0b fd dd}
$184 = {8b 47 8b 78 14 84 d9 c4 ba 94 98 79 77 b5 bb 40 5a 48 39 47 e3 04 f2 d2}
$185 = {8a 46 8a 79 15 85 d8 c5 bb 95 99 78 76 b4 ba 41 5b 49 38 46 e2 05 f3 d3}
$186 = {89 45 89 7a 16 86 db c6 b8 96 9a 7b 75 b7 b9 42 58 4a 3b 45 e1 06 f0 d0}
$187 = {88 44 88 7b 17 87 da c7 b9 97 9b 7a 74 b6 b8 43 59 4b 3a 44 e0 07 f1 d1}
$188 = {8f 43 8f 7c 10 80 dd c0 be 90 9c 7d 73 b1 bf 44 5e 4c 3d 43 e7 00 f6 d6}
$189 = {8e 42 8e 7d 11 81 dc c1 bf 91 9d 7c 72 b0 be 45 5f 4d 3c 42 e6 01 f7 d7}
$190 = {8d 41 8d 7e 12 82 df c2 bc 92 9e 7f 71 b3 bd 46 5c 4e 3f 41 e5 02 f4 d4}
$191 = {8c 40 8c 7f 13 83 de c3 bd 93 9f 7e 70 b2 bc 47 5d 4f 3e 40 e4 03 f5 d5}
$192 = {f3 3f f3 00 6c fc a1 bc c2 ec e0 01 0f cd c3 38 22 30 41 3f 9b 7c 8a aa}
$193 = {f2 3e f2 01 6d fd a0 bd c3 ed e1 00 0e cc c2 39 23 31 40 3e 9a 7d 8b ab}
$194 = {f1 3d f1 02 6e fe a3 be c0 ee e2 03 0d cf c1 3a 20 32 43 3d 99 7e 88 a8}
$195 = {f0 3c f0 03 6f ff a2 bf c1 ef e3 02 0c ce c0 3b 21 33 42 3c 98 7f 89 a9}
$196 = {f7 3b f7 04 68 f8 a5 b8 c6 e8 e4 05 0b c9 c7 3c 26 34 45 3b 9f 78 8e ae}
$197 = {f6 3a f6 05 69 f9 a4 b9 c7 e9 e5 04 0a c8 c6 3d 27 35 44 3a 9e 79 8f af}
$198 = {f5 39 f5 06 6a fa a7 ba c4 ea e6 07 09 cb c5 3e 24 36 47 39 9d 7a 8c ac}
$199 = {f4 38 f4 07 6b fb a6 bb c5 eb e7 06 08 ca c4 3f 25 37 46 38 9c 7b 8d ad}
$200 = {fb 37 fb 08 64 f4 a9 b4 ca e4 e8 09 07 c5 cb 30 2a 38 49 37 93 74 82 a2}
$201 = {fa 36 fa 09 65 f5 a8 b5 cb e5 e9 08 06 c4 ca 31 2b 39 48 36 92 75 83 a3}
$202 = {f9 35 f9 0a 66 f6 ab b6 c8 e6 ea 0b 05 c7 c9 32 28 3a 4b 35 91 76 80 a0}
$203 = {f8 34 f8 0b 67 f7 aa b7 c9 e7 eb 0a 04 c6 c8 33 29 3b 4a 34 90 77 81 a1}
$204 = {ff 33 ff 0c 60 f0 ad b0 ce e0 ec 0d 03 c1 cf 34 2e 3c 4d 33 97 70 86 a6}
$205 = {fe 32 fe 0d 61 f1 ac b1 cf e1 ed 0c 02 c0 ce 35 2f 3d 4c 32 96 71 87 a7}
$206 = {fd 31 fd 0e 62 f2 af b2 cc e2 ee 0f 01 c3 cd 36 2c 3e 4f 31 95 72 84 a4}
$207 = {fc 30 fc 0f 63 f3 ae b3 cd e3 ef 0e 00 c2 cc 37 2d 3f 4e 30 94 73 85 a5}
$208 = {e3 2f e3 10 7c ec b1 ac d2 fc f0 11 1f dd d3 28 32 20 51 2f 8b 6c 9a ba}
$209 = {e2 2e e2 11 7d ed b0 ad d3 fd f1 10 1e dc d2 29 33 21 50 2e 8a 6d 9b bb}
$210 = {e1 2d e1 12 7e ee b3 ae d0 fe f2 13 1d df d1 2a 30 22 53 2d 89 6e 98 b8}
$211 = {e0 2c e0 13 7f ef b2 af d1 ff f3 12 1c de d0 2b 31 23 52 2c 88 6f 99 b9}
$212 = {e7 2b e7 14 78 e8 b5 a8 d6 f8 f4 15 1b d9 d7 2c 36 24 55 2b 8f 68 9e be}
$213 = {e6 2a e6 15 79 e9 b4 a9 d7 f9 f5 14 1a d8 d6 2d 37 25 54 2a 8e 69 9f bf}
$214 = {e5 29 e5 16 7a ea b7 aa d4 fa f6 17 19 db d5 2e 34 26 57 29 8d 6a 9c bc}
$215 = {e4 28 e4 17 7b eb b6 ab d5 fb f7 16 18 da d4 2f 35 27 56 28 8c 6b 9d bd}
$216 = {eb 27 eb 18 74 e4 b9 a4 da f4 f8 19 17 d5 db 20 3a 28 59 27 83 64 92 b2}
$217 = {ea 26 ea 19 75 e5 b8 a5 db f5 f9 18 16 d4 da 21 3b 29 58 26 82 65 93 b3}
$218 = {e9 25 e9 1a 76 e6 bb a6 d8 f6 fa 1b 15 d7 d9 22 38 2a 5b 25 81 66 90 b0}
$219 = {e8 24 e8 1b 77 e7 ba a7 d9 f7 fb 1a 14 d6 d8 23 39 2b 5a 24 80 67 91 b1}
$220 = {ef 23 ef 1c 70 e0 bd a0 de f0 fc 1d 13 d1 df 24 3e 2c 5d 23 87 60 96 b6}
$221 = {ee 22 ee 1d 71 e1 bc a1 df f1 fd 1c 12 d0 de 25 3f 2d 5c 22 86 61 97 b7}
$222 = {ed 21 ed 1e 72 e2 bf a2 dc f2 fe 1f 11 d3 dd 26 3c 2e 5f 21 85 62 94 b4}
$223 = {ec 20 ec 1f 73 e3 be a3 dd f3 ff 1e 10 d2 dc 27 3d 2f 5e 20 84 63 95 b5}
$224 = {d3 1f d3 20 4c dc 81 9c e2 cc c0 21 2f ed e3 18 02 10 61 1f bb 5c aa 8a}
$225 = {d2 1e d2 21 4d dd 80 9d e3 cd c1 20 2e ec e2 19 03 11 60 1e ba 5d ab 8b}
$226 = {d1 1d d1 22 4e de 83 9e e0 ce c2 23 2d ef e1 1a 00 12 63 1d b9 5e a8 88}
$227 = {d0 1c d0 23 4f df 82 9f e1 cf c3 22 2c ee e0 1b 01 13 62 1c b8 5f a9 89}
$228 = {d7 1b d7 24 48 d8 85 98 e6 c8 c4 25 2b e9 e7 1c 06 14 65 1b bf 58 ae 8e}
$229 = {d6 1a d6 25 49 d9 84 99 e7 c9 c5 24 2a e8 e6 1d 07 15 64 1a be 59 af 8f}
$230 = {d5 19 d5 26 4a da 87 9a e4 ca c6 27 29 eb e5 1e 04 16 67 19 bd 5a ac 8c}
$231 = {d4 18 d4 27 4b db 86 9b e5 cb c7 26 28 ea e4 1f 05 17 66 18 bc 5b ad 8d}
$232 = {db 17 db 28 44 d4 89 94 ea c4 c8 29 27 e5 eb 10 0a 18 69 17 b3 54 a2 82}
$233 = {da 16 da 29 45 d5 88 95 eb c5 c9 28 26 e4 ea 11 0b 19 68 16 b2 55 a3 83}
$234 = {d9 15 d9 2a 46 d6 8b 96 e8 c6 ca 2b 25 e7 e9 12 08 1a 6b 15 b1 56 a0 80}
$235 = {d8 14 d8 2b 47 d7 8a 97 e9 c7 cb 2a 24 e6 e8 13 09 1b 6a 14 b0 57 a1 81}
$236 = {df 13 df 2c 40 d0 8d 90 ee c0 cc 2d 23 e1 ef 14 0e 1c 6d 13 b7 50 a6 86}
$237 = {de 12 de 2d 41 d1 8c 91 ef c1 cd 2c 22 e0 ee 15 0f 1d 6c 12 b6 51 a7 87}
$238 = {dd 11 dd 2e 42 d2 8f 92 ec c2 ce 2f 21 e3 ed 16 0c 1e 6f 11 b5 52 a4 84}
$239 = {dc 10 dc 2f 43 d3 8e 93 ed c3 cf 2e 20 e2 ec 17 0d 1f 6e 10 b4 53 a5 85}
$240 = {c3 0f c3 30 5c cc 91 8c f2 dc d0 31 3f fd f3 08 12 00 71 0f ab 4c ba 9a}
$241 = {c2 0e c2 31 5d cd 90 8d f3 dd d1 30 3e fc f2 09 13 01 70 0e aa 4d bb 9b}
$242 = {c1 0d c1 32 5e ce 93 8e f0 de d2 33 3d ff f1 0a 10 02 73 0d a9 4e b8 98}
$243 = {c0 0c c0 33 5f cf 92 8f f1 df d3 32 3c fe f0 0b 11 03 72 0c a8 4f b9 99}
$244 = {c7 0b c7 34 58 c8 95 88 f6 d8 d4 35 3b f9 f7 0c 16 04 75 0b af 48 be 9e}
$245 = {c6 0a c6 35 59 c9 94 89 f7 d9 d5 34 3a f8 f6 0d 17 05 74 0a ae 49 bf 9f}
$246 = {c5 09 c5 36 5a ca 97 8a f4 da d6 37 39 fb f5 0e 14 06 77 09 ad 4a bc 9c}
$247 = {c4 08 c4 37 5b cb 96 8b f5 db d7 36 38 fa f4 0f 15 07 76 08 ac 4b bd 9d}
$248 = {cb 07 cb 38 54 c4 99 84 fa d4 d8 39 37 f5 fb 00 1a 08 79 07 a3 44 b2 92}
$249 = {ca 06 ca 39 55 c5 98 85 fb d5 d9 38 36 f4 fa 01 1b 09 78 06 a2 45 b3 93}
$250 = {c9 05 c9 3a 56 c6 9b 86 f8 d6 da 3b 35 f7 f9 02 18 0a 7b 05 a1 46 b0 90}
$251 = {c8 04 c8 3b 57 c7 9a 87 f9 d7 db 3a 34 f6 f8 03 19 0b 7a 04 a0 47 b1 91}
$252 = {cf 03 cf 3c 50 c0 9d 80 fe d0 dc 3d 33 f1 ff 04 1e 0c 7d 03 a7 40 b6 96}
$253 = {ce 02 ce 3d 51 c1 9c 81 ff d1 dd 3c 32 f0 fe 05 1f 0d 7c 02 a6 41 b7 97}
$254 = {cd 01 cd 3e 52 c2 9f 82 fc d2 de 3f 31 f3 fd 06 1c 0e 7f 01 a5 42 b4 94}
$255 = {cc 00 cc 3f 53 c3 9e 83 fd d3 df 3e 30 f2 fc 07 1d 0f 7e 00 a4 43 b5 95}

condition:
any of them
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment