In partnership with vx-underground, SentinelOne recently ran its first Malware Research Challenge, in which we asked researchers across the cybersecurity community to submit their research to showcase their talents and bring their insights to a wider audience.

In today’s guest post, researcher Natacha Bakir (Senthorus/Cefcys) digs into the destructive world of wipers: a special class of malware that has neither espionage nor financial gain in mind, but exists solely to destroy data and disrupt the services provided by an organization to its consumers. From MeteorExpress to AcidRain and HermeticWiper, the current increase in the use of wipers since the start of Russia’s invasion of Ukraine has been unprecedented and is a subject worthy of greater attention.

In February 2022, Ukraine was targeted by a new malware named ‘HermeticWiper’. Amid reports of ransomware incidents increasing by 62% in 2021, and the number of ransomware attacks estimated at 236.1 million in the first half of 2022, this new malware, as sophisticated as it was, had a simple goal: to erase the target’s disks.

While wipers have been known for over 10 years, a significant rise in this destructive kind of malware has been noted since 2022. In this post, I will briefly discuss the history of wiper malware before focusing on the the techniques used in some of the most recent attacks.

History of Wipers

2012 was an important year for wipers. On August 15th, Shamoon wiped 30000 systems within a day. The New York Times estimated that 75% of the victim’s computers had been wiped. At the time, it was one of  the most destructive attacks ever seen. A group calling itself “Cutting Sword of Justice” claimed responsibility for the attack, blaming the al-Saud regime for crimes against humanity.

In 2015, an attack on the Ukraine Power grid caused a power outage for nearly a quarter of a million people. It was coordinated with a Denial-of-service attack on a call center to deny consumers up-to-date information on the blackout.

In 2022, WhisperGate wiper targeted multiple organizations in Ukraine. The wiper was later seen throughout the world.

The WhisperGate wiper had a decoy ransom note to mislead Incident Response teams. The wiper analyzes the victim’s environment enumerating OS attributes and disks to improve their access and gain the desired privileges to disarm the victim and attack.

In February 2022, HermeticWiper was dropped on victims via a compressed package, creating the EaseUS driver file, and enumerating the physical drives. The driver then loads and runs as a service. The driver is used through execution codes [dwIoControlCode] to overwrite the master boot record (MBR) and the master file table (MFT) before restarting the system.

In January 2023, ESET researchers uncovered a new wiper attack targeting Ukraine called SwiftSlicer. The wiper uses Active Directory Group Policy and is written in Go. ESET attributed this attack to Sandworm.

#BREAKING On January 25th #ESETResearch discovered a new cyberattack in Ukraine. Attackers deployed a new wiper we named #SwiftSlicer using Active Directory Group Policy. The #SwiftSlicer wiper is written in Go programing language. We attribute this attack to #Sandworm. 1/3 pic.twitter.com/pMij9lpU5J

— ESET Research (@ESETresearch) January 27, 2023

Wiper Techniques

Wipers primary goal is to destroy data. This can cause disruption and service outage affecting not just the organization targeted but entire populations. Wipers can also be deployed after an initial attack, in order to erase evidence. Although wipers can be disguised as ransomware and ask for a ransom, they don’t offer the capability to recover data and the goal is not financial gain, but rather a diversionary tactic while data is erased.

Depending on the hacker’s goal (discretion, speediness), several techniques of wiping are used, including:

• enumerating the filesystem
• overwriting the disks with other data like zero (0x00) bytes
• corrupting MBR and MFT
• fragmenting disks
• using driver to gain kernel access
• pass order through IOCTL DeviceIoControl() function.

Given the simplicity of the goal, Wipers can be written in many different programming languages. Although SwiftSlicer is written in Go, similarities in the malware’s functionality can clearly be seen.

The Ukrainian CERT-UA reports that SwiftSlicer was distributed to network computers through GPO (Group Policy Object), the same method used to deploy most of the malware mentioned in this article.

They also noted that the malware targets the %CSIDL_SYSTEM_DRIVE%WindowsNTDS folder, showing that SwiftSlicer tries to destroy files and bring down the entire Windows domain.

Why Write a Wiper in Go?

Go is increasingly used in malware programming. With Go, malware developers can write code once and compile binaries from the same codebase for multiple platforms. As a result, they can target different operating systems like Unix, Linux, Windows and those that work on mobile.

In addition, Go programs can be difficult to analyze. The arguments are not passed through registers but are directly copied onto the stack at the correct position. Further, Go functions can have multiple return values, so static analysis is limited. Typically, when reversing go malware, analysts will need to use dynamic analysis, such as isolating interesting functions by name and using a debugger to break on interesting calls to inspect the program’s state.

Conclusion

Wiper malwares are not new, and even Russia’s use of them against Ukraine can be dated back to interference in the Ukraine Presidential Election of 2014. However, the extent of the use of wipers by Russian APT groups, especially Sandworm, against Ukrainian targets is something not seen previous to this conflict.

Whether used for sabotage or cyberwarfare, wipers cross the boundary of the virtual to the real, with the potential to wreak devastating effects on those far beyond the organization targeted.

Business email compromise (BEC) exploits the main common denominator found across every technology, tool, and process – the humans that interact with it. Taking advantage of human decision making habits and emotions, BEC has remained one of the most lucrative attack methods seen in today’s cyber threat landscape.

This May, the FBI issued a public warning against BEC schemes, which they described as being one of the most financially damaging online crimes, capitalizing on the fact that email communication remains a steadfast tool for modern businesses. In fact, recent reports show that the market for BEC is expected to grow from a value of $1.1 billion in 2022 to an estimated $2.8 billion by 2027.

Like with all methods of cyberattack, threat actors continue to develop the tools of their trade and iterate on their processes to become more cost effective, efficient, and profitable. BEC attacks have also evolved in the last few years to exploit new vulnerabilities and bypass traditional security measures. In this post, learn how these email-based attacks have evolved over the past two decades to adapt to changing security solutions, the latest tactics and techniques threat actors are using in current BEC scams, and ways to protect against them in the long run.

Emails From Nigerian Princes to High-Profile Attacks | How Business Email Compromise Has Evolved

In the early 2000s, the world saw some of the earliest phases of BEC scams take form. While the term “BEC” might not have been coined then, the fundamental elements in these attacks were already in motion. Early examples of social engineering tactics used in emails include:

• The Nigerian Prince Scam – One of the earliest and most notorious forms of BEC attacks is the “Nigerian Prince” or “419 scam”. It began as early as the 1980s through postal mail but transitioned to email in the early 2000s. Scammers claimed to be Nigerian princes or government officials seeking assistance to transfer a large sum of money out of their country. They promised to share the fortune with the recipient in return for a small fee to cover legal or administrative costs. This classic scam capitalized on people’s greed and willingness to believe in unlikely windfalls.
• Lottery and Inheritance Scams – Similar to the Nigerian Prince scam, these earlier forms of BEC attacks involved emails informing recipients that they had won a lottery or inherited a large sum of money from a distant relative. To claim the prize or inheritance, victims were asked to provide personal information or pay a fee upfront, leading to identity theft and financial loss.
• Overpayment Scams – In these attacks, scammers posed as potential customers or clients and contacted businesses regarding purchasing their products or services. They would then send a check or make a payment for an amount higher than the agreed-upon price and request the excess to be refunded. The initial payment would later bounce or be canceled, leaving the business out of pocket.
• Executive Impersonation – Early instances of executive impersonation involved scammers pretending to be high-ranking executives or business partners within an organization. They would instruct employees to perform certain tasks, such as transferring funds or sharing sensitive information, under the guise of confidentiality or urgency.

Early BEC scams were relatively simple and didn’t require sophisticated techniques from cyber criminals to launch successful attacks. Seeing how profitable these scams were and how easily they could be tailored to targeted higher profile targets, BEC attacks soon expanded to affect every industry vertical. According to the IC3, BEC fraud now costs global businesses just over $50 billion dollars with reports of scams reported in all 50 states and in 177 countries. The IC3 has also classified the threat of BEC as one of the leading categories of cybercrime by financial losses.

Macro socio-economic trends have also fostered an environment where modern BEC scams thrive. Since the COVID-19 pandemic, more workplaces and individuals conduct their business virtually, creating additional avenues of attack for BEC scammers. Rising use of cryptocurrency now also plays a role in the BEC, specifically in investment scams.

Right now, experts say that the number of emails sent per day is projected to increase to over 370 billion by 2025. Whether used for personal and business communication or to support massive e-commerce and e-marketing industries, emails are clear targets in modern malware campaigns, advanced persistent threats (APTs), phishing attacks, identity theft, and more.

Current Top Trends In Business Email Compromise Attacks

Today’s world is saturated by connection with billions of internet-connected devices linking everyone and everything together at all hours of the day. Considering global collaboration, smart mobile devices, and the accessibility provided by cloud technologies, emails are still the one, simple way to reach many at once making BEC attacks as relevant as ever.

As technology has advanced, BEC scammers have also furthered their craft. Many BEC scams are now much more sophisticated, involving multi-stage attacks and misuse of artificial intelligence (AI) and machine learning (ML) along with targeting more attractive groups such as vendors, big banks, and government entities. This section explores some of the top trends found in recent BEC attacks that enterprises need to stay alert for.

Multi-Stage AiTM & BEC Attacks

Security professionals are seeing multi-stage, adversary-in-the-middle (AiTM) phishing and business email compromise (BEC) attacks against financial institutions and large banks. In these types of campaigns, threat actors seek to exploit trusted relationships between partnered organizations to bypass multi-factor authentication (MFA) measures.

Attacks like these feature a complex combination of both AiTM and BEC tactics to abuse the relationship between vendors, suppliers, and enterprise partners in order to commit financial fraud. After using AiTM phishing to bypass MFA mechanisms, threat actors connect to and take over their victim’s account, resetting authentication methods to devices under their control and creating new email rules to send out malicious emails to the next layer of victims in the attack chain.

The Use of Black Hat AI Tools In BEC Attacks

After a dramatic entrance in late 2022, ChatGPT and other generative AI tools are now being misused by cyber criminals to create improved spoof content for malicious emails and sites. Most recently, a black hat generative AI tool called WormGPT has caught the attention of cyber attackers who are using it to make their fake emails sound more convincing, personalized to the intended victim, and error-free; all to reduce the likelihood of being flagged as suspicious.

Though companies like OpenAI have strict disclaimers against the use of their software for illegal actions, researchers and hackers are now jailbreaking the language models to get around safety rules. In the case of WormGPT, this tool is designed specifically for malicious activities and first seen circulating in darknet forums. Such spin off AI tools are making BEC attacks more accessible by lowering the entry threshold to a wider spectrum of cybercriminals.

“Second Hop” Crypto-Based BEC Attacks

There are two variations of BEC scams involving cryptocurrency: direct transfers to a crypto exchange (CE) that is similar to traditional BEC models, and ‘second hop’ transfers. In the latter, victims are hit with social engineering tactics to give up personal identifiable information (PII). Threat actors then use the stolen information to open new cryptocurrency wallets in the victim’s name and then proceed to reroute the money and cash out. In both variations, victims are unaware that the funds being sent are converted to cryptocurrency.

Avoiding “Impossible Travel” Flags With Local IP Addresses

To increase the chances of a successful email-based intrusion, threat actors are attempting to bypass “impossible travel” flags by purchasing IP addresses that correspond to the locations of their victims. Impossible travel flags are security mechanisms that detect and alert when a user’s account is accessed from two different geographical locations within a short period, which is seen as a key indicator of unauthorized access. Using this tactic, threat actors are able to avoid detection and more easily create backdoors in the compromised system.

Timing BEC Campaigns With Summer Vacations

New research has shed light on the quick rise of BEC attacks across Europe, illustrating that European organizations were seeing a greater volume and frequency of such attacks compared to their U.S. counterparts. Between June 2022 and May 2023, researchers found that European organizations were attacked an average of 10 times per 1000 mailboxes, and especially in the month of August, when most Europeans tend to schedule their annual holiday.

Exploiting this cultural difference in vacation preferences, threat actors were found to be focusing their efforts on European businesses that would be operating with less-than-usual staff. Given the high concentration of employees being away on vacation, attackers could increase their chances of success by taking advantage of people being away from their computers as well as those who were likely more distracted during the ‘slower’ month.

BEC Is Extending Past Traditional Platforms

The FBI have warned about BEC scammers expanding their tactics beyond conventional platforms by taking advantage of the shift to remote work during and post-pandemic. Traditionally, social engineering relied on phone and email exchanges, but now, virtual meeting platforms have become the new grounds for attack.

First, the attacker gains access to a senior leader’s email account, typically a C-suite or member of the Board, and uses it to arrange virtual meetings with employees. During the meeting, the scammer displays a static image of the senior leader or uses deep fake audio to claim technical difficulties. Finally, the scammer instructs employees to transfer funds to fraudulent bank accounts.

How XDR Tackles The Challenge of Email Security Risks

Businesses often deploy individualized security solutions for their email defenses, causing visibility gaps and incomplete risk understanding. In such cases, manual intervention to address suspicious emails becomes not just time-consuming but also advantageous for cybercriminals.

That’s where Extended Detection and Response (XDR) comes in. Unlike isolated solutions, XDR, when coupled with email security, offers comprehensive threat detection and response. It doesn’t merely focus on endpoint activity but delves into the context of malware delivery.

XDR solutions, like vigilant cyber detectives, spot suspicious activities across attack surfaces and provide detailed incident reports. Integration with email security enables better understanding of attack vectors and potential threat actors, and allows for faster, automated responses to compromised user accounts.

SentinelOne has invested to fulfil the potential of XDR solutions, investing in comprehensive platforms like Singularity. The fusion of XDR into our cybersecurity strategies is indeed becoming the new norm for tackling evolving digital threats.

Conclusion

The steady rise of BEC attacks in recent years highlights the evolving sophistication of cybercriminals and the need for businesses to stay vigilant in safeguarding their assets and sensitive information. As these attacks continue to surge, it’s essential for organizations to understand the evolving tactics used by threat actors as well as the potential vulnerabilities within their email platforms.

Given the ever-changing threat landscape, businesses are looking farther ahead than just implementing defensive measures like multi-factor authentication, email authentication protocols, secure email gateways, and strong password policies. This is where XDR capabilities emerge as a critical part of a stronger cyber strategy.

As businesses navigate evolving threat tactics and techniques, adopting a multi-dimensional security strategy that combines robust preventive measures with XDR capabilities becomes a vital one. To learn more about how Singularity XDR is able to provide businesses with an effective strategy against increasingly sophisticated BEC risks, book a demo or contact us today.

Earlier this month, security researcher iamdeadlyz reported on multiple fake blockchain games being used to infect both Windows and macOS targets with infostealers, capable of emptying crypto wallets and stealing stored password and browser data.

In the case of macOS, the infostealer turned out to be a new malware written in Rust, dubbed “realst”. Building on this previous analysis, we identified and analyzed 59 malicious Mach-O samples of realst malware. Among those, we discovered some samples are already targeting Apple’s forthcoming OS release, macOS 14 Sonoma.

In this post, we describe the malware in detail to help threat hunters and security teams identify and detect compromises by Realst Infostealer.

Realst Distribution

Realst Infostealer is distributed via malicious websites advertising fake blockchain games with names such as Brawl Earth, WildWorld, Dawnland, Destruction, Evolion, Pearl, Olymp of Reptiles, and SaintLegend. The campaign appears to have links to the earlier PearlLand infostealer. Each version of the fake blockchain game is hosted on its own website complete with associated Twitter and Discord accounts.

As reported by iamdeadlyz, threat actors have been observed approaching potential victims through direct messages on social media.

Individuals who fell for the lures soon found that they had become victims of theft.

Realst Malicious Installers

Some versions of the malware are distributed by a .pkg installer containing a malicious Mach-O and three related scripts.

The Python script game.py is a cross-platform Firefox infostealer. No actual game is contained here or elsewhere.

The installer.py script is in fact a copy of chainbreaker, an open-source project for extracting passwords, keys and certificates from a macOS keychain database. Given the user’s password scraped earlier in the execution chain, chainbreaker will retrieve clear text versions of the user’s internet account and other stored passwords.

Surprisingly, the uninstall.sh script is simply a barebones uninstall script with no malicious behavior.

Other versions of realst stealer are distributed as applications via .dmg disk images. In some cases the developer has packaged the malware in Electron apps; in others, native macOS application bundles are used. The previous research provides an in-depth description of these.

Some samples were codesigned with Apple Developer ID (Team Identifier: C46287MB25), which has since been revoked.

Other samples are ad-hoc codesigned and will continue to launch, as such signatures cannot be revoked remotely.

Dynamic Analysis of Realst Variants

Behaviorally, realst samples look fairly similar across variants and are readily detectable in much the same way as other macOS infostealers. Although they at times use different API calls and have some variant dependencies, from a telemetry point of view the key to all these infostealers is the access and exfiltration of browser data, crypto wallets, and keychain databases.

Targeted browsers include Firefox, Chrome, Opera, Brave and Vivaldi. Safari was not targeted in any of the samples we analyzed. We also note that the malware targets the Telegram application.

The samples we analyzed reach out to one of two hardcoded URLs to exfiltrate stolen data:

http://167[.]172[.]103[.]83:8080/opened
http://77[.]91[.]84[.]110:5000/send_analytics

Most variants (see below for further details) attempt to grab the user’s password via osascript and AppleScript spoofing and perform rudimentary checking that the host device is not a virtual machine via sysctl -n hw.model. We explore these differences in detail in the static analysis section below.

Collected data is dropped in a folder simply named “data”. This may appear in one of several locations depending on the version of the malware: in the user’s home folder, in the working directory of the malware , or in a folder named after the parent game, e.g.,

~/data/
~/data.zip
~/Downloads/brawl/data/
~/Downloads/brawl/data.zip

If the malware was able to access screen capture permission, a screenshot of the Desktop is also taken and deposited in the same location.

~/screenshot.jpeg
~/Downloads/brawl/screenshot.jpeg

Static Analyses of Realst Variants

Our analysis identified 16 variants across 59 samples, which we divide into four major families: A, B, C and D. The division is somewhat arbitrary: There are a number of overlaps that would allow us to draw the lines differently (for example, the use or lack of pycryptodome, or the targeting of macOS Sonoma). We chose the following taxonomy based on string artifacts that should aid threat hunters in better identification and detection.

Realst Variant Family A

Of the 59 Mach-O samples we analyzed, 26 fall into Variant A. This variant has a number of sub variants (we noted ten), but they all share one defining characteristic which isn’t found in Variants B, C and D: The inclusion of whole strings related to AppleScript spoofing.

Example SHA1: 144665cb2e5d65c88579aa4391cebbc116842536
0x752f16:: osascript
0x752f21: display dialog
0x752fb7: with hidden answer
0x7511dc: keychain-db
0x751238: dump-generic-passwords
0x1c75e13: FireFoxDecryptor
0x19444a1: hw.model

Family A variants use AppleScript spoofing in much the same way that we have seen earlier macOS stealers use to grab the user’s admin password in clear text. This technique involves popping a password request dialog box with the “hidden answer” option. This prevents the user seeing the characters they type by replacing them with bullet points, similar to a real password dialog. The important difference being, however, that in this case the password is only obscured from the user themselves. The password is captured and logged in clear text by the AppleScript dialog box.

Like other variants, A samples also include full strings related to anti-analysis through VM detection in the form of hw.model. This is used as an argument to the sysctl command to determine the model of the host device. When run on a Virtual Machine, a macOS instance will typically return the name of the VM software as opposed to the model of Mac.

Realst Variant Family B

Family B variants also have static artifacts related to password spoofing, but these samples are distinctive as they break up the strings into smaller units as a means to evade simple static detection. We found 10/59 samples fell into this category.

Otherwise, B variants have similar artifacts to Variant A samples.

Example SHA1: 2d89ffbadddd62483bc2be33e296ce4e6036c45b
0x6940a0: display dialog
0x6b08f3: keychain-db
0x6b094f: dump-generic-passwords
0x6b52cb: hw.model
0x9b8b69: FireFoxDecryptor

Realst Variant Family C

Family C also attempts to hide the strings for AppleScript spoofing by breaking up the strings in the same way as Variant B. However, Variant C is distinctive in that it introduces a reference to chainbreaker within the Mach-O binary itself. 7/59 samples fell into this category.

SHA1: 112b5637c8cbb7d2e216d89f969515809e1dc66d
0x3fbc10: keychain-db
0x3fbc3c: chainbreaker
0x3fbc51: dump-generic-passwords
0x628e4f: FireFoxDecryptor
0x402552: hw.model

Realst Variant Family D

In Family D, which accounted for 16/59 samples, there are no static artifacts for osascript spoofing. Password scraping is handled by a prompt in the Terminal window via the get_keys_with_access function. Once the password is acquired it is immediately passed to sym.realst::utils::get_kc_keys, which then attempts to dump passwords from the Keychain.

In some versions, the malware also uses the scraped password to elevate privileges with the sudo command and install the Python pycryptodome package.

The use of pycryptodome is itself inconsistent across samples and families, appearing in around half of the entire collection.

SHA1: d436de35164a045e3c0f7b51cf41fcefedf7e77d
0x3fbc10: keychain-db
0x3fbc47: dump-generic-passwords
0x402542: hw.model
0x628de2: FireFoxDecryptor

Realst Infostealer Prepares for macOS 14 Sonoma

About a third of the samples we identified contain strings targeting macOS 14 Sonoma. These string artifacts appear in around half of Variant A samples, and all of Variant B samples. None of Variants C or D were found to contain Sonoma strings.

It is not clear at this point how differences between Sonoma and Ventura would affect execution of the malware – a question it seems the malware authors are themselves seeking to determine.

SentinelOne Protects Against Realst Infostealer

All known variants of Realst macOS infostealer are detected and, where the ‘Prevent’ site policy is enabled, prevented from execution by the SentinelOne agent. Apple’s malware blocking service “XProtect” does not appear to prevent execution of this malware at the time of writing.

Organizations not protected by SentinelOne may use the comprehensive indicators provided in this post to aid threat hunting and detection.

Conclusion

The number of Realst samples and their variation shows that the threat actor has invested serious effort in order to target macOS users for data and crypto wallet theft. Multiple fake game sites complete with Discord servers and associated Twitter accounts have been created to present the illusion of genuine products and convince users to try them out. As soon as the victim launches these fake games and provides the “installer” with a password, their data, passwords and crypto wallets are stolen.

Given the current popular interest in blockchain games, which promise users the reward of making money while gaming, users and security teams are urged to treat solicitations to download and run such games with extreme caution.

Indicators of Compromise

Communications
77.91.84[.]110
167.172.103[.]83

Team Identifier 
C46287MB25

Bundle Identifier
com.launcher.dev

Observed MITRE TTPs
T1033 System Owner/User Discovery (whoami)
T1059 Command and Scripting Interpreter (osascript)
T1070.004 File Deletion (rmdir)
T1082 System Information Discovery (sw_vers)
T1083 File and Directory Discovery (dirname, basename)
T1553 Bypass or Subvert Trust Controls (xattr)
T1620 Reflective Code Loading (execv, fork)
T1562 Disable or Modify Tools (sleep, waitpid)
T1639.001 Exfiltration Over Unencrypted Non-C2 Protocol (tcp, http)

Mach-O Files SHA1 
Family Variant A1
44aa30ca902a22520b52789b81add44e15e74a50
713cdae1bc6c68c06d3b9cc18171b5de43957f98
859e5b3d534c8282d168ebe40c127576dc0b9c70
8d60062ad8a29b4e88c7b9ec3b649aa30476001f

A2
963f55a93523c001fdec52ff33ff232e020135e5

A3
89e1cfc0fa65e4369279b78a26837e6259d4800c

A4
144665cb2e5d65c88579aa4391cebbc116842536
56a0b37302829d5fb116d8aa5700dcc3af00dc34
5da136f267dc70447d420b28dee729d32fdf437f
6cb07664ef882f7cb98f017b0fbdffe4946e9161
b10b37f3b1ce7aa6dacd4402fcfdb97ba92e1508
b898723602c96ecd04176bd13e6c21dbea82e6de
faf6b11a137bf7ae0ffcab411b02e0c0905260b6

A5
091f960fe4317696fb30abc3b36d2c8a7eef4b65
0eeb66a08ca067f168779be8b22da25f90fe4f51
88880772b0f8723020e0feb2bb179dc71e482072

A6
6ee0d99e3a56a72c60f3da790268286cd1e7a3ab

A7
60a747b3e8a25b885ccd16945ba1a238a66e4439
8054b51a51c8c8f21fe4c51322ef36a9fa02b570
b8ac89eed011c0a4e5f4973acbee888323ec80f0
efccafe8cf2a7d63f82c69882195a565fbd60720

A8
39060bb82061c5d426d4a7bad66e07888b05b354
b1aac3888403f4597d9cf14b505f572b2fe7d485
d890822af137df48a91f4ba47a27272dcacc9920

A9
630b23a57d2d8e6d8e25c346173191af6273c3ab

A10
087b3bf372928279d547fb6bb0ab656717fa8c4b

Family Variant B1
0a2a853251fe28333761cc6f9c4518807354dd27
13bdb3823b8555d846f17bdf381f9568b9a81d26
29a7eefff22156a72577ed920eaf9b903e9f164a
2d89ffbadddd62483bc2be33e296ce4e6036c45b
4e5a59a515981fb97bdb272e3e4acb7118e4e6b2
9719fd9415d438722f94877c55c9495708c64fee
c205d4ba044f2d69500f10a46c31aaf068e32c44
c716a02e3bc8603fcf0bb8d63fc4f7e3afab471d
dadfbd13b7bd0e9b6d87ebae30bc48c2eeae0eb3

B2
09e8672af5e18ce99ad8ae608cdc0fa229f121f0

Family Variant C1
112b5637c8cbb7d2e216d89f969515809e1dc66d

C2
154909cdd261130b0ed6d603d4727cb9f15ddc36
247c50d19e7ad18f466558f9c1785ef29962ab7c
32f06e3e9d8899f5224f3d5538724d132bda0921
68dc1f80064f6c261e587cdbb2f01677c8f2e14a
8b4cdd02330cf25f4e1d338b91ffd1c1dd87021a
ce42d202446cc6b316f668a072c17df87dcd495c

Family Variant D1
2f61ddd391d23a6665fa326629e004cb380c4f85
38ae4fa8f4fec9ab98c0003c455016464b62acce
65c175f5fad31ea1c938a96a9cdc9987413fd1f2
80483c5c95ed92da6f086e9497cd08cf7d3b7658
c4296e1a67545e50f44c3776adb674ea1d4d4c0e
d436de35164a045e3c0f7b51cf41fcefedf7e77d
f097123a1999a656a368114abbd848b68d523ee0

D2
158cf7a0c89544ce1c3294453be2a8c8ced9c9b0
294392bcf166953c552443fe95ba1e8f15487f74
294bfc9b97092904bb5e216531b184e38fb2c11f
3685fdd3d14b500fd73f0a3d16dafcc028035204
4053e0ecf5f59b6f7afc06750551d77e131ebd2d
410e4e24f6f6c4f29c8a75723f84bf60ff96c2d5
ada7a47b7fecb142ff532c6e0f01a89bcb47afc9
bfac1b17ad79719c4602a2142435f02c529ec4ab
db9fe7ba9ff8771d28a2fa504d84059faab6be5b