www.trendmicro.com
Open in
urlscan Pro
104.90.24.75
Public Scan
URL:
https://www.trendmicro.com/en_us/research/24/f/targetcompany-s-linux-variant-targets-esxi-environments.html
Submission: On June 06 via api from TR — Scanned from DE
Submission: On June 06 via api from TR — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="main-menu-search" aria-label="Search Trend Micro" data-equally-id="equally_ai___yIgV6">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>Text Content
Business
search close
* Solutions
* By Challenge
* By Challenge
* By Challenge
Learn more
* Understand, Prioritize & Mitigate Risks
* Understand, Prioritize & Mitigate Risks
Improve your risk posture with attack surface management
Learn more
* Protect Cloud-Native Apps
* Protect Cloud-Native Apps
Security that enables business outcomes
Learn more
* Protect Your Hybrid World
* Protect Your Hybrid, Multi-Cloud World
Gain visibility and meet business needs with security
Learn more
* Securing Your Borderless Workforce
* Securing Your Borderless Workforce
Connect with confidence from anywhere, on any device
Learn more
* Eliminate Network Blind Spots
* Eliminate Network Blind Spots
Secure users and key operations throughout your environment
Learn more
* See More. Respond Faster.
* See More. Respond Faster.
Move faster than your adversaries with powerful purpose-built XDR,
attack surface risk management, and zero trust capabilities
Learn more
* Extend Your Team
* Extend Your Team. Respond to Threats Agilely
Maximize effectiveness with proactive risk reduction and managed
services
Learn more
* Operationalizing Zero Trust
* Operationalizing Zero Trust
Understand your attack surface, assess your risk in real time, and
adjust policies across network, workloads, and devices from a single
console
Learn more
* By Role
* By Role
* By Role
Learn more
* CISO
* CISO
Drive business value with measurable cybersecurity outcomes
Learn more
* SOC Manager
* SOC Manager
See more, act faster
Learn more
* Infrastructure Manager
* Infrastructure Manager
Evolve your security to mitigate threats quickly and effectively
Learn more
* Cloud Builder and Developer
* Cloud Builder and Developer
Ensure code runs only as intended
Learn more
* Cloud Security Ops
* Cloud Security Ops
Gain visibility and control with security designed for cloud
environments
Learn more
* By Industry
* By Industry
* By Industry
Learn more
* Healthcare
* Healthcare
Protect patient data, devices, and networks while meeting regulations
Learn more
* Manufacturing
* Manufacturing
Protecting your factory environments – from traditional devices to
state-of-the-art infrastructures
Learn more
* Oil & Gas
* Oil & Gas
ICS/OT Security for the oil and gas utility industry
Learn more
* Electric Utility
* Electric Utility
ICS/OT Security for the electric utility
Learn more
* Federal
* Federal
Learn more
* Automotive
* Automotive
Learn more
* 5G Networks
* 5G Networks
Learn more
* Small & Midsized Business Security
* Small & Midsized Business Security
Stop threats with comprehensive, set-it-and-forget-it protection
Learn more
* Platform
* Vision One Platform
* Vision One Platform
* Trend Vision One
Our Unified Platform
Bridge threat protection and cyber risk management
Learn more
* AI Companion
* Trend Vision One Companion
Your generative AI cybersecurity assistant
Learn more
* Attack Surface Management
* Attack Surface Management
Stop breaches before they happen
Learn more
* XDR (Extended Detection & Response)
* XDR (Extended Detection & Response)
Stop adversaries faster with a broader perspective and better context to
hunt, detect, investigate, and respond to threats from a single platform
Learn more
* Cloud Security
* Cloud Security
* Trend Vision One™
Cloud Security Overview
The most trusted cloud security platform for developers, security
teams, and businesses
Learn more
* Attack Surface Risk Management for Cloud
* Attack Surface Risk Management for Cloud
Cloud asset discovery, vulnerability prioritization, Cloud Security
Posture Management, and Attack Surface Management all in one
Learn more
* XDR for Cloud
* XDR for Cloud
Extend visibility to the cloud and streamline SOC investigations
Learn more
* Workload Security
* Workload Security
Secure your data center, cloud, and containers without compromising
performance by leveraging a cloud security platform with CNAPP
capabilities
Learn more
* Container Security
* Container Security
Simplify security for your cloud-native applications with advanced
container image scanning, policy-based admission control, and container
runtime protection
Learn more
* File Security
* File Security
Protect application workflow and cloud storage against advanced threats
Learn more
* Endpoint Security
* Endpoint Security
* Endpoint Security Overview
Defend the endpoint through every stage of an attack
Learn more
* XDR for Endpoint
* XDR for Endpoint
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Workload Security
* Workload Security
Optimized prevention, detection, and response for endpoints, servers,
and cloud workloads
Learn more
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Mobile Security
* Mobile Security
On-premises and cloud protection against malware, malicious
applications, and other mobile threats
Learn more
* Network Security
* Network Security
* Network Security Overview
Expand the power of XDR with network detection and response
Learn more
* XDR for Network
* XDR for Network
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Network Intrusion Prevention (IPS)
* Network Intrusion Prevention (IPS)
Protect against known, unknown, and undisclosed vulnerabilities in your
network
Learn more
* Breach Detection System (BDS)
* Breach Detection System (BDS)
Detect and respond to targeted attacks moving inbound, outbound, and
laterally
Learn more
* Secure Service Edge (SSE)
* Secure Service Edge (SSE)
Redefine trust and secure digital transformation with continuous risk
assessments
Learn more
* Industrial Network Security
* Industrial Network Security
Learn more
* 5G Network Security
* 5G Network Security
Learn more
* Email Security
* Email Security
* Email Security
Stop phishing, malware, ransomware, fraud, and targeted attacks from
infiltrating your enterprise
Learn more
* Email and Collaboration Security
* Trend Vision One™
Email and Collaboration Security
Stop phishing, ransomware, and targeted attacks on any email service
including Microsoft 365 and Google Workspace
Learn more
* OT Security
* OT Security
* OT Security
Learn about solutions for ICS / OT security.
Learn more
* XDR for OT
* XDR for OT
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Industrial Network Security
* Industrial Network Security
Industrial Network Security
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Threat Intelligence
* Threat Intelligence
Keep ahead of the latest threats and protect your critical data with
ongoing threat prevention and analysis
Learn more
* Identity Security
* Identity Security
End-to-end identity security from identity posture management to
detection and response
Learn more
* All Products, Services, and Trials
* All Products, Services, and Trials
Learn more
* Research
* Research
* Research
* Research
Learn more
* Research, News, and Perspectives
* Research, News, and Perspectives
Learn more
* Research and Analysis
* Research and Analysis
Learn more
* Security News
* Security News
Learn more
* Zero Day Initiatives (ZDI)
* Zero Day Initiatives (ZDI)
Learn more
* Services
* Our Services
* Our Services
* Our Services
Learn more
* Service Packages
* Service Packages
Augment security teams with 24/7/365 managed detection, response, and
support
Learn more
* Managed XDR
* Managed XDR
Augment threat detection with expertly managed detection and response
(MDR) for email, endpoints, servers, cloud workloads, and networks
Learn more
* Incident Response
* Incident Response
* Incident Response
Our trusted experts are on call whether you're experiencing a breach
or looking to proactively improve your IR plans
Learn more
* Insurance Carriers and Law Firms
* Insurance Carriers and Law Firms
Stop breaches with the best response and detection technology on the
market and reduce clients’ downtime and claim costs
Learn more
* Support Services
* Support Services
Learn more
* Partners
* Partner Program
* Partner Program
* Partner Program Overview
Grow your business and protect your customers with the best-in-class
complete, multilayered security
Learn more
* Managed Security Service Provider
* Managed Security Service Provider
Deliver modern security operations services with our industry-leading
XDR
Learn more
* Managed Service Provider
* Managed Service Provider
Partner with a leading expert in cybersecurity, leverage proven
solutions designed for MSPs
Learn more
* Cloud Service Provider
* Cloud Service Provider
Add market-leading security to your cloud service offerings – no matter
which platform you use
Learn more
* Professional Services
* Professional Services
Increase revenue with industry-leading security
Learn more
* Resellers
* Resellers
Discover the possibilities
Learn more
* Marketplace
* Marketplace
Learn more
* System Integrators
* System Integrators
Learn more
* Alliance Partners
* Alliance Partners
* Alliance Overview
We work with the best to help you optimize performance and value
Learn more
* Technology Alliance Partners
* Technology Alliance Partners
Learn more
* Our Alliance Partners
* Our Alliance Partners
Learn more
* Partner Tools
* Partner Tools
* Partner Tools
Learn more
* Partner Login
* Partner Login
Login
* Education and Certification
* Education and Certification
Learn more
* Partner Successes
* Partner Successes
Learn more
* Distributors
* Distributors
Learn more
* Find a Partner
* Find a Partner
Learn more
* Company
* Why Trend Micro
* Why Trend Micro
* Why Trend Micro
Learn more
* Customer Success Stories
* Customer Success Stories
Learn more
* The Human Connection
* The Human Connection
Learn more
* Industry Accolades
* Industry Accolades
Learn more
* Strategic Alliances
* Strategic Alliances
Learn more
* Compare Trend Micro
* Compare Trend Micro
* Compare Trend Micro
See how Trend outperforms the competition
Let's go
* vs. Crowdstrike
* Trend Micro vs. Crowdstrike
Crowdstrike provides effective cybersecurity through its cloud-native
platform, but its pricing may stretch budgets, especially for
organizations seeking cost-effective scalability through a true single
platform
Let's go
* vs. Microsoft
* Trend Micro vs. Microsoft
Microsoft offers a foundational layer of protection, yet it often
requires supplemental solutions to fully address customers' security
problems
Let's go
* vs. Palo Alto Networks
* Trend Micro vs. Palo Alto Networks
Palo Alto Networks delivers advanced cybersecurity solutions, but
navigating its comprehensive suite can be complex and unlocking all
capabilities requires significant investment
Let's go
* About Us
* About Us
* About Us
Learn more
* Trust Center
* Trust Center
Learn more
* History
* History
Learn more
* Diversity, Equity and Inclusion
* Diversity, Equity and Inclusion
Learn more
* Corporate Social Responsibility
* Corporate Social Responsibility
Learn more
* Leadership
* Leadership
Learn more
* Security Experts
* Security Experts
Learn more
* Internet Safety and Cybersecurity Education
* Internet Safety and Cybersecurity Education
Learn more
* Legal
* Legal
Learn more
* Investors
* Investors
Learn more
* Formula E Racing
* Formula E Racing
Learn more
* Connect With Us
* Connect With Us
* Connect With Us
Learn more
* Newsroom
* Newsroom
Learn more
* Events
* Events
Learn more
* Careers
* Careers
Learn more
* Webinars
* Webinars
Learn more
Back
Back
Back
Back
* Free Trials
* Contact Us
Looking for home solutions?
Under Attack?
3 Alerts
Back
Unread
All
* Ransomware in Q1 2024: Report on Phobos, LockBit, and other critical threats
close
Read report >
* Deepfakes and AI-driven disinformation threaten polls
close
Get the facts >
* Report on the email threat landscape
close
Learn the latest defense strategies >
Folio (0)
Support
* Business Support Portal
* Business Community
* Virus and Threat Help
* Education and Certification
* Contact Support
* Find a Support Partner
Resources
* Trend Micro vs. Competition
* Cyber Risk Index/Assessment
* CISO Resource Center
* DevOps Resource Center
* What Is?
* Threat Encyclopedia
* Cloud Health Assessment
* Cyber Insurance
* Glossary of Terms
* Webinars
Log In
* Vision One
* Support
* Partner Portal
* Cloud One
* Product Activation and Management
* Referral Affiliate
Back
arrow_back
search
close
Content has been added to your Folio
Go to Folio (0) close
Ransomware
TARGETCOMPANY’S LINUX VARIANT TARGETS ESXI ENVIRONMENTS
In this blog entry, our researchers provide an analysis of TargetCompany
ransomware’s Linux variant and how it targets VMware ESXi environments using new
methods for payload delivery and execution.
By: Darrel Tristan Virtusio, Nathaniel Morales, Cj Arsley Mateo June 05, 2024
Read time: 5 min (1374 words)
Save to Folio
Subscribe
--------------------------------------------------------------------------------
Summary
* The TargetCompany ransomware group is now employing a new Linux variant that
uses a custom shell script as a means of payload delivery and execution, a
technique not seen in previous variants.
* The shell script also exfiltrates the victim's information to two different
servers so the ransomware actors have a backup of the information.
* The Linux-based variant can determine whether the victim's machine is running
in a VMWare ESXi environment.
* By targeting ESXi servers, the ransomware actors behind TargetCompany aim to
disrupt operations more effectively and increase their chances of a ransom
payout.
* The TargetCompany affiliate linked to the ransomware sample points to a
broader campaign that targets expansive IT systems.
Discovered in June 2021, The TargetCompany ransomware is tracked by Trend Micro
as “Water Gatpanapun” and has a leak site under the name “Mallox.” We have
observed that the group’s activity is highest in Taiwan, India, Thailand, and
South Korea this year.
Since its discovery, TargetCompany has been evolving its techniques to
circumvent security defenses employed by organizations; one such technique its
use of a PowerShell script to bypass Antimalware Scan Interface (AMSI) and abuse
of fully undetectable (FUD) obfuscator packers.
Recently, our threat hunting team discovered a new variant of the TargetCompany
ransomware specifically targeting Linux environments. This variant uses a shell
script for payload delivery and execution (Figure 1).
Figure 1. The infection chain of TargetCompany’s Linux variant
This technique has not yet been observed in previous TargetCompany variants,
indicating that the ransomware group has been continuously evolving to employ
more sophisticated methods in its future attacks. This recently found Linux
variant aligns with the recent trend of ransomware groups extending their
attacks to critical Linux environments, thereby potentially increasing the range
of target victims.
TARGETCOMPANY’S LINUX VARIANT
This latest variant checks whether the executable is running with administrative
rights (Figure 2). Otherwise, it will not continue its malicious routine. This
signifies that a compromised or vulnerable device was successfully exploited to
gain administrative rights to execute the ransomware payload.
Figure 2. Checking if the program is executed as superuser or root
EXFILTRATION OF SENSITIVE VICTIM INFORMATION
After its execution, it drops a text file named TargetInfo.txt that contains
victim information, as shown in Figure 3. The contents of TargetInfo.txt will be
sent to a command-and-control (C&C) server, hxxp://91[BLOCKED], with the file
name ap.php (Figure 4). This behavior is similar to that of the ransomware’s
Windows variant.
Figure 3. Dropped “TargetInfo.txt” file
Figure 4. Disassembly of data exfiltration to a C&C server
TARGETING ESXI ENVIRONMENTS
The threat actors behind TargetCompany have widened their targets to include
virtualization servers, aiming to cause more damage and operational disruption.
They also added a capability to detect if the machine is running in a VMWare
ESXi environment, a platform commonly used for hosting critical virtualized
infrastructure in organizations (Figure 5). Encrypting critical ESXi servers
could also increase the likelihood of successful ransom payments.
The binary performs a check by executing the command “uname” to determine
whether the machine is running in a VMWare ESXi environment.
Figure 5. Checking if running on ESXi environment
If the system name matches “vmkernel”, this indicates that the machine is
running in VMware’s ESXi hypervisor, and the binary enters “VM mode...” to
encrypt files with the extensions in Figure 6.
Figure 6. VM-related extensions
FILE ENCRYPTION AND RANSOM NOTE DEPLOYMENT
After its encryption routine, this variant appends the extension “.locked” on
encrypted files and drops a ransom note named HOW TO DECRYPT.txt (Figure 7).
This is a departure from the usual extension and ransom note file name of its
Windows variant (Figure 8).
Figure 7. Appended “.locked” extension on encrypted files
Figure 8. Ransom note
EXECUTION OF TARGETCOMPANY USING A SHELL SCRIPT
Upon further investigations, we found out that a shell script was used to
download and execute the ransomware payload hosted in a designated URL. Figure 9
shows the custom-made shell script by the threat actors specifically to execute
this TargetCompany variant. It first checks for the existence of the
TargetInfo.txt file and terminates if found.
Figure 9. Custom shell script for delivery and execution of payload
The script attempts to download the TargetCompany payload from the download URL
using “wget” or “curl,” whichever works between the two commands. The payload is
then made executable using the command “chmod +x x” and executed in the
background using “nohup ./x” (Figure 10).
Figure 10. Code snippet for downloading and executing TargetCompany
The custom shell script is also capable of exfiltrating data to a different
server. Once the ransomware payload performs its malicious routine, the script
will read the contents of the dropped text file TargetInfo.txt and upload it to
another URL using “wget” or “curl”.
Figure 11. Code snippet of data exfiltration to a C&C server
This variant exfiltrates victim information to two different servers. It is
possible that the implantation of this technique is part of TargetCompany threat
actors’ strategy to improve redundancy and have a backup in case a server goes
offline or is compromised.
After the ransomware performs its routine, the script deletes the TargetCompany
payload using the command “rm -f x”.
This technique is very common, but it still poses significant challenge for
defenders. Security practitioners will have limited artifacts to work with
during investigation and incident response, thus making it difficult to
understand the overall impact of the attack.
INFRASTRUCTURE
The IP address used to deliver the payload and exfiltrate a victim’s system
information has not yet been observed in previous TargetCompany campaigns. Based
on research, this IP address is hosted by China Mobile Communications, an
internet service provider (ISP) in China.
Since the IP address is hosted by a service provider, there is a possibility
that the IP address used by TargetCompany’s threat actors was rented to host
their malicious payload (Figure 12).
Figure 12. HTTPS certificate
The certificate also was recently registered and is valid for only three months,
indicating that it might be intended for short-term use. Upon visiting the IP
address, we found the following homepage that is similar to the Tongda Xinke OA
login interface (Figure 13).
Figure 13. Homepage of the URL used to host the ransomware payload
AFFILIATE “VAMPIRE”
The specific sample shown in Figure 14 is associated with an affiliate called
“vampire,” based on the contents it sends to its C&C server. This indicates
broader campaigns involving high ransom demands and expansive IT system
targeting. This affiliate is possibly connected to the affiliate included in a
blog entry posted by Sekoia.
Figure 14. “Vampire”-related strings
CONCLUSION
Malicious actors are consistently refining their attacks, as evidenced by the
emergence of TargetCompany’s new Linux variant, which allows the ransomware to
expand its pool of potential victims by targeting VMWare ESXi environments. In
light of this, staying vigilant against emerging ransomware variants should
remain paramount among defenders. Implementing tried-and-tested cybersecurity
measures can mitigate the risk of falling victim to ransomware attempts and
protect the data integrity of an organization's assets. Organizations can
implement best practices by:
* Enabling multifactor authentication (MFA) to prevent attackers from
performing lateral movement inside a network.
* Adhering to the 3-2-1 rule when backing up important files — creating three
backup copies on two different file formats, with one of the copies stored in
a separate location
* Patching and updating systems regularly; it’s important to keep operating
systems and applications up to date and maintain patch management protocols
that can deter malicious actors from exploiting any software vulnerabilities.
TREND VISION ONE™ HUNTING QUERY
* malName:*Linux.TARGETCOMP* AND eventName:MALWARE_DETECTION
INDICATORS OF COMPROMISE (IOCS)
Hashes
Hash Detection Description dffa99b9fe6e7d3e19afba38c9f7ec739581f656
Ransom.Linux.TARGETCOMP.YXEEQT TargetCompany Linux Variant
2b82b463dab61cd3d7765492d7b4a529b4618e57 Trojan.SH.TARGETCOMP.THEAGBD Shell
Script 9779aa8eb4c6f9eb809ebf4646867b0ed38c97e1 Ransom.Win64.TARGETCOMP.YXECMT
TargetCompany samples related to affiliate vampire
3642996044cd85381b19f28a9ab6763e2bab653c Ransom.Win64.TARGETCOMP.YXECFT
TargetCompany samples related to affiliate vampire
4cdee339e038f5fc32dde8432dc3630afd4df8a2 Ransom.Win32.TARGETCOMP.SMYXCLAZ
TargetCompany samples related to affiliate vampire
0f6bea3ff11bb56c2daf4c5f5c5b2f1afd3d5098 Ransom.Win32.TARGETCOMP.SMYXCLAZ
TargetCompany samples related to affiliate vampire
URLs
URL Detection Description
hxxp://111.10.231[.]151:8168/general/vmeet/upload/temp/x.sh 90 - Untested
Download URL of script hxxp://111.10.231[.]151:8168/general/vmeet/upload/temp/x
79 – Disease Vector Download URL of ransomware payload
hxxp://111.10.231[.]151:8168/general/vmeet/upload/temp/post.php 79 – Disease
Vector Upload URL
MITRE ATT&CK TACTICS AND TECHNIQUES
Tactic Technique ID Defense Evasion File Deletion T1070.004 Discovery System
Information Discovery T1082 Execution Command and Scripting Interpreter: Unix
Shell T1059.004 Command and Control Ingress Tool Transfer T1105 Exfiltration
Exfiltration over Alternative Protocol T1408 Exfiltration over C2 Channel T1041
Impact Data Encrypted for Impact T1486
Tags
Ransomware
AUTHORS
* Darrel Tristan Virtusio
Threat Analyst
* Nathaniel Morales
Threat Analyst
* Cj Arsley Mateo
Threat Analyst
Contact Us
Subscribe
RELATED ARTICLES
* Unveiling the Fallout: Operation Cronos' Impact on LockBit Following Landmark
Disruption
* Agenda Ransomware Propagates to vCenters and ESXi via Custom PowerShell
Script
* Multistage RA World Ransomware Uses Anti-AV Tactics, Exploits GPO
See all articles
Try our services free for 30 days
* Start your free trial today
*
*
*
*
*
RESOURCES
* Blog
* Newsroom
* Threat Reports
* DevOps Resource Center
* CISO Resource Center
* Find a Partner
SUPPORT
* Business Support Portal
* Contact Us
* Downloads
* Free Trials
*
*
ABOUT TREND
* About Us
* Careers
* Locations
* Upcoming Events
* Trust Center
*
Country Headquarters
Trend Micro - United States (US)
225 East John Carpenter Freeway
Suite 1500
Irving, Texas 75062
Phone: +1 (817) 569-8900
Select a country / region
United States expand_more
close
THE AMERICAS
* United States
* Brasil
* Canada
* México
MIDDLE EAST & AFRICA
* South Africa
* Middle East and North Africa
EUROPE
* België (Belgium)
* Česká Republika
* Danmark
* Deutschland, Österreich Schweiz
* España
* France
* Ireland
* Italia
* Nederland
* Norge (Norway)
* Polska (Poland)
* Suomi (Finland)
* Sverige (Sweden)
* Türkiye (Turkey)
* United Kingdom
ASIA & PACIFIC
* Australia
* Центральная Азия (Central Asia)
* Hong Kong (English)
* 香港 (中文) (Hong Kong)
* भारत गणराज्य (India)
* Indonesia
* 日本 (Japan)
* 대한민국 (South Korea)
* Malaysia
* Монголия (Mongolia) and рузия (Georgia)
* New Zealand
* Philippines
* Singapore
* 台灣 (Taiwan)
* ประเทศไทย (Thailand)
* Việt Nam
Privacy | Legal | Accessibility | Site map
Copyright ©2024 Trend Micro Incorporated. All rights reserved
sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk
This website uses cookies for website functionality, traffic analytics,
personalization, social media functionality and advertising. Our Cookie Notice
provides more information and explains how to amend your cookie settings.Learn
more
Cookies Settings Accept
✓
Danke für das Teilen!
AddToAny
Mehr…
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1Sumo