www.trendmicro.com
Open in
urlscan Pro
2.19.216.164
Public Scan
URL:
https://www.trendmicro.com/en_us/research/22/i/atlassian-confluence-vulnerability-cve-2022-26134-abused-for-cryptocurrency-...
Submission: On June 11 via api from IN — Scanned from DE
Submission: On June 11 via api from IN — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="main-menu-search" aria-label="Search Trend Micro">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>Text Content
Business
search close
* Solutions
* By Challenge
* By Challenge
* By Challenge
Learn more
* Understand, Prioritize & Mitigate Risks
* Understand, Prioritize & Mitigate Risks
Improve your risk posture with attack surface management
Learn more
* Protect Cloud-Native Apps
* Protect Cloud-Native Apps
Security that enables business outcomes
Learn more
* Protect Your Hybrid World
* Protect Your Hybrid, Multi-Cloud World
Gain visibility and meet business needs with security
Learn more
* Securing Your Borderless Workforce
* Securing Your Borderless Workforce
Connect with confidence from anywhere, on any device
Learn more
* Eliminate Network Blind Spots
* Eliminate Network Blind Spots
Secure users and key operations throughout your environment
Learn more
* See More. Respond Faster.
* See More. Respond Faster.
Move faster than your adversaries with powerful purpose-built XDR,
attack surface risk management, and zero trust capabilities
Learn more
* Extend Your Team
* Extend Your Team. Respond to Threats Agilely
Maximize effectiveness with proactive risk reduction and managed
services
Learn more
* Operationalizing Zero Trust
* Operationalizing Zero Trust
Understand your attack surface, assess your risk in real time, and
adjust policies across network, workloads, and devices from a single
console
Learn more
* By Role
* By Role
* By Role
Learn more
* CISO
* CISO
Drive business value with measurable cybersecurity outcomes
Learn more
* SOC Manager
* SOC Manager
See more, act faster
Learn more
* Infrastructure Manager
* Infrastructure Manager
Evolve your security to mitigate threats quickly and effectively
Learn more
* Cloud Builder and Developer
* Cloud Builder and Developer
Ensure code runs only as intended
Learn more
* Cloud Security Ops
* Cloud Security Ops
Gain visibility and control with security designed for cloud
environments
Learn more
* By Industry
* By Industry
* By Industry
Learn more
* Healthcare
* Healthcare
Protect patient data, devices, and networks while meeting regulations
Learn more
* Manufacturing
* Manufacturing
Protecting your factory environments – from traditional devices to
state-of-the-art infrastructures
Learn more
* Oil & Gas
* Oil & Gas
ICS/OT Security for the oil and gas utility industry
Learn more
* Electric Utility
* Electric Utility
ICS/OT Security for the electric utility
Learn more
* Federal
* Federal
Learn more
* Automotive
* Automotive
Learn more
* 5G Networks
* 5G Networks
Learn more
* Small & Midsized Business Security
* Small & Midsized Business Security
Stop threats with comprehensive, set-it-and-forget-it protection
Learn more
* Platform
* Vision One Platform
* Vision One Platform
* Trend Vision One
Our Unified Platform
Bridge threat protection and cyber risk management
Learn more
* AI Companion
* Trend Vision One Companion
Your generative AI cybersecurity assistant
Learn more
* Attack Surface Management
* Attack Surface Management
Stop breaches before they happen
Learn more
* XDR (Extended Detection & Response)
* XDR (Extended Detection & Response)
Stop adversaries faster with a broader perspective and better context to
hunt, detect, investigate, and respond to threats from a single platform
Learn more
* Cloud Security
* Cloud Security
* Trend Vision One™
Cloud Security Overview
The most trusted cloud security platform for developers, security
teams, and businesses
Learn more
* Attack Surface Risk Management for Cloud
* Attack Surface Risk Management for Cloud
Cloud asset discovery, vulnerability prioritization, Cloud Security
Posture Management, and Attack Surface Management all in one
Learn more
* XDR for Cloud
* XDR for Cloud
Extend visibility to the cloud and streamline SOC investigations
Learn more
* Workload Security
* Workload Security
Secure your data center, cloud, and containers without compromising
performance by leveraging a cloud security platform with CNAPP
capabilities
Learn more
* Container Security
* Container Security
Simplify security for your cloud-native applications with advanced
container image scanning, policy-based admission control, and container
runtime protection
Learn more
* File Security
* File Security
Protect application workflow and cloud storage against advanced threats
Learn more
* Endpoint Security
* Endpoint Security
* Endpoint Security Overview
Defend the endpoint through every stage of an attack
Learn more
* XDR for Endpoint
* XDR for Endpoint
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Workload Security
* Workload Security
Optimized prevention, detection, and response for endpoints, servers,
and cloud workloads
Learn more
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Mobile Security
* Mobile Security
On-premises and cloud protection against malware, malicious
applications, and other mobile threats
Learn more
* Network Security
* Network Security
* Network Security Overview
Expand the power of XDR with network detection and response
Learn more
* XDR for Network
* XDR for Network
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Network Intrusion Prevention (IPS)
* Network Intrusion Prevention (IPS)
Protect against known, unknown, and undisclosed vulnerabilities in your
network
Learn more
* Breach Detection System (BDS)
* Breach Detection System (BDS)
Detect and respond to targeted attacks moving inbound, outbound, and
laterally
Learn more
* Secure Service Edge (SSE)
* Secure Service Edge (SSE)
Redefine trust and secure digital transformation with continuous risk
assessments
Learn more
* Industrial Network Security
* Industrial Network Security
Learn more
* 5G Network Security
* 5G Network Security
Learn more
* Email Security
* Email Security
* Email Security
Stop phishing, malware, ransomware, fraud, and targeted attacks from
infiltrating your enterprise
Learn more
* Email and Collaboration Security
* Trend Vision One™
Email and Collaboration Security
Stop phishing, ransomware, and targeted attacks on any email service
including Microsoft 365 and Google Workspace
Learn more
* OT Security
* OT Security
* OT Security
Learn about solutions for ICS / OT security.
Learn more
* XDR for OT
* XDR for OT
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Industrial Network Security
* Industrial Network Security
Industrial Network Security
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Threat Intelligence
* Threat Intelligence
Keep ahead of the latest threats and protect your critical data with
ongoing threat prevention and analysis
Learn more
* Identity Security
* Identity Security
End-to-end identity security from identity posture management to
detection and response
Learn more
* On-Premises Data Sovereignty
* On-Premises Data Sovereignty
Prevent, detect, respond and protect without compromising data
sovereignty
Learn more
* All Products, Services, and Trials
* All Products, Services, and Trials
Learn more
* Research
* Research
* Research
* Research
Learn more
* Research, News, and Perspectives
* Research, News, and Perspectives
Learn more
* Research and Analysis
* Research and Analysis
Learn more
* Security News
* Security News
Learn more
* Zero Day Initiatives (ZDI)
* Zero Day Initiatives (ZDI)
Learn more
* Services
* Our Services
* Our Services
* Our Services
Learn more
* Service Packages
* Service Packages
Augment security teams with 24/7/365 managed detection, response, and
support
Learn more
* Managed XDR
* Managed XDR
Augment threat detection with expertly managed detection and response
(MDR) for email, endpoints, servers, cloud workloads, and networks
Learn more
* Incident Response
* Incident Response
* Incident Response
Our trusted experts are on call whether you're experiencing a breach
or looking to proactively improve your IR plans
Learn more
* Insurance Carriers and Law Firms
* Insurance Carriers and Law Firms
Stop breaches with the best response and detection technology on the
market and reduce clients’ downtime and claim costs
Learn more
* Support Services
* Support Services
Learn more
* Partners
* Partner Program
* Partner Program
* Partner Program Overview
Grow your business and protect your customers with the best-in-class
complete, multilayered security
Learn more
* Managed Security Service Provider
* Managed Security Service Provider
Deliver modern security operations services with our industry-leading
XDR
Learn more
* Managed Service Provider
* Managed Service Provider
Partner with a leading expert in cybersecurity, leverage proven
solutions designed for MSPs
Learn more
* Cloud Service Provider
* Cloud Service Provider
Add market-leading security to your cloud service offerings – no matter
which platform you use
Learn more
* Professional Services
* Professional Services
Increase revenue with industry-leading security
Learn more
* Resellers
* Resellers
Discover the possibilities
Learn more
* Marketplace
* Marketplace
Learn more
* System Integrators
* System Integrators
Learn more
* Alliance Partners
* Alliance Partners
* Alliance Overview
We work with the best to help you optimize performance and value
Learn more
* Technology Alliance Partners
* Technology Alliance Partners
Learn more
* Our Alliance Partners
* Our Alliance Partners
Learn more
* Partner Tools
* Partner Tools
* Partner Tools
Learn more
* Partner Login
* Partner Login
Login
* Education and Certification
* Education and Certification
Learn more
* Partner Successes
* Partner Successes
Learn more
* Distributors
* Distributors
Learn more
* Find a Partner
* Find a Partner
Learn more
* Company
* Why Trend Micro
* Why Trend Micro
* Why Trend Micro
Learn more
* Customer Success Stories
* Customer Success Stories
Learn more
* The Human Connection
* The Human Connection
Learn more
* Industry Accolades
* Industry Accolades
Learn more
* Strategic Alliances
* Strategic Alliances
Learn more
* Compare Trend Micro
* Compare Trend Micro
* Compare Trend Micro
See how Trend outperforms the competition
Let's go
* vs. Crowdstrike
* Trend Micro vs. Crowdstrike
Crowdstrike provides effective cybersecurity through its cloud-native
platform, but its pricing may stretch budgets, especially for
organizations seeking cost-effective scalability through a true single
platform
Let's go
* vs. Microsoft
* Trend Micro vs. Microsoft
Microsoft offers a foundational layer of protection, yet it often
requires supplemental solutions to fully address customers' security
problems
Let's go
* vs. Palo Alto Networks
* Trend Micro vs. Palo Alto Networks
Palo Alto Networks delivers advanced cybersecurity solutions, but
navigating its comprehensive suite can be complex and unlocking all
capabilities requires significant investment
Let's go
* About Us
* About Us
* About Us
Learn more
* Trust Center
* Trust Center
Learn more
* History
* History
Learn more
* Diversity, Equity and Inclusion
* Diversity, Equity and Inclusion
Learn more
* Corporate Social Responsibility
* Corporate Social Responsibility
Learn more
* Leadership
* Leadership
Learn more
* Security Experts
* Security Experts
Learn more
* Internet Safety and Cybersecurity Education
* Internet Safety and Cybersecurity Education
Learn more
* Legal
* Legal
Learn more
* Investors
* Investors
Learn more
* Formula E Racing
* Formula E Racing
Learn more
* Connect With Us
* Connect With Us
* Connect With Us
Learn more
* Newsroom
* Newsroom
Learn more
* Events
* Events
Learn more
* Careers
* Careers
Learn more
* Webinars
* Webinars
Learn more
Back
Back
Back
Back
* Free Trials
* Contact Us
Looking for home solutions?
Under Attack?
3 Alerts
Back
Unread
All
* Ransomware in Q1 2024: Report on Phobos, LockBit, and other critical threats
close
Read report >
* Deepfakes and AI-driven disinformation threaten polls
close
Get the facts >
* Report on the email threat landscape
close
Learn the latest defense strategies >
Folio (0)
Support
* Business Support Portal
* Business Community
* Virus and Threat Help
* Education and Certification
* Contact Support
* Find a Support Partner
Resources
* Trend Micro vs. Competition
* Cyber Risk Index/Assessment
* CISO Resource Center
* DevOps Resource Center
* What Is?
* Threat Encyclopedia
* Cloud Health Assessment
* Cyber Insurance
* Glossary of Terms
* Webinars
Log In
* Vision One
* Support
* Partner Portal
* Cloud One
* Product Activation and Management
* Referral Affiliate
Back
arrow_back
search
close
Content has been added to your Folio
Go to Folio (0) close
Exploits & Vulnerabilities
ATLASSIAN CONFLUENCE VULNERABILITY CVE-2022-26134 ABUSED FOR CRYPTOCURRENCY
MINING, OTHER MALWARE
Users are advised to patch immediately: We found exploit samples abusing the
Atlassian Confluence vulnerability (CVE-2022-26134) in the wild for malicious
cryptocurrency mining.
By: Sunil Bharti September 21, 2022 Read time: 6 min (1646 words)
Save to Folio
Subscribe
--------------------------------------------------------------------------------
We observed the active exploitation of CVE-2022-26134, an unauthenticated remote
code execution (RCE) vulnerability with a critical rating of 9.8 in the
collaboration tool Atlassian Confluence. The gap is being abused for malicious
cryptocurrency mining. Confluence has already released a security advisory
detailing the fixes necessary for all affected products, namely all versions of
Confluence Server and Confluence Data Center. If left unremedied and
successfully exploited, this vulnerability could be used for multiple and more
malicious attacks, such as a complete domain takeover of the infrastructure and
the deployment information stealers, remote access trojans (RATs), and
ransomware. Users and organizations are advised to upgrade to the fixed
versions, apply the available patches, or to apply temporary fixes as soon as
possible to mitigate the risks of abuse.
Abusing the gap
Figure 1. Infection chain
The vulnerability can be exploited by sending a specially crafted HTTP request
containing an Object-Graph Navigation Language (OGNL) expression in the HTTP
request Uniform Resource Identifier (URI) to the victim server, resulting in an
RCE.
To identify whether the installed Confluence Server is vulnerable, the attacker
can send an HTTP request to run an id command. Upon successful exploitation, the
attacker can read its response in a controlled HTTP response header. From the
sample we analyzed, executing the id command yielded an output of
“X-Cmd-Response" header — the vulnerable server will execute the command and set
its response in the attacker-defined header.
Figure 2. Attacker sends a malicious request to check for user information
Figure 3. The response to the attacker’s malicious request
Looking at the malware routine
Using Trend Micro Cloud One™ Workload Security modules to track the components
and activities of the cryptocurrency malware used, we observed the following
events and components:
* Intrusion Prevention System (IPS): Aside from blocking the exploitation of
CVE-2022-26134 and other application vulnerabilities, IPS also tracked the
incoming event’s traffic and the payload’s data and trigger. In this sample,
the attacker injected an OGNL expression to download and run the ro.sh script
in the victim’s machine. This script file downloaded another script, ap.sh.
Figure 4. IPS event on attack traffic
Figure 5. Payload data captured
* Web reputation module: Aside from blocking the malicious URL, we also
observed the command-and-control (C&C) URL server that the malware was
communicating with for the payload download routine.
Figure 6. Blocking the malicious URL
* Antimalware module: Aside from protecting the targeted system against the
exploitation of the vulnerability in real time using behavior monitoring, the
antimalware module can also detect and block the download of other components
to execute the malware. In this sample, the scripts were downloading the
cryptocurrency miner malware hezb.
Figure 7. Detecting the malicious cryptocurrency miner
* Activity monitoring module: This module detects process, file, and network
activities on endpoints running Workload Security. From our analysis, the
hezb malware initiated a process to communicate with the C&C server.
Figure 8. Telemetry event of a process initiated by the hezb malware
Tracking the shell scripts
Once the exploit payload is executed in the victim machine, the malware
downloads the ro.sh/ap.sh shell script file. This shell script performs multiple
actions and we break it down as follows:
1. The script updates the path variable to include the /tmp and /dev/shm
paths.
Figure 9. Updating the path variable
2. If the curl utility is not present in the system, the script downloads
and installs its own curl binary file from the C&C server.
Figure 10. Function to download the scripts and binaries
3. Like many other cryptocurrency-mining malware, it disables the iptables
or changes the firewall policy action to ACCEPT and flushes all the firewall
rules.
Figure 11. Disabling the firewall
4. The script downloads a binary file ko, which takes the advantage of the
PwnKit vulnerability to escalate the privilege to the root user, while the
binary file downloads the ap.sh shell script for the next actions.
Figure 12. Script downloading other resources
5. The ap.sh script downloads the hezb malware and kills multiple processes
that belong to other competing coin miners, disables cloud service provider
agents, and proceeds with lateral movement.
Figure 13. Disabling cloud service provider agents
a. The ap.sh script checks for the presence of hezb in the running process.
If it is not found, the script downloads the binary file according to the system
architecture (such as sys.x86_64), renames it to “hezb", and communicates with
its C&C server hosted at 106[.]252[.]252[.]226 using port 4545.
Figure 14. Downloading the malicious cryptocurrency miner
Figure 15. Detection of hezb connecting to its C&C server using Trend Micro
Vision One™
b. Under the /root and /home directories, the script scans for secure shell
protocol (SSH) users, keys, and hosts in the .ssh directory and .bash_history
file.
Figure 16. Collecting information for lateral movement via SSH
While doing lateral movement via SSH, the malware also downloads the ldr.sh
script on the remote hosts. ldr.sh contains the hard-coded information of the
miner wallet address that it needs to communicate with. Upon closer examination,
we can see that the ldr.sh script has the same content as ro.sh and ap.sh,
except for the process where the script simultaneously connects with the miner
server and uses different IP addresses and arguments.
Figure 17. Miner connecting to C&C server
Figure 18. Detection of vulnerability exploitation by observed attack techniques
(OATs)
Figure 19. Trend Micro Vision One Workbench app detection of correlated events
We analyzed the script capable of changing the attribute of </etc/ld.so.preload>
to make it mutable. </etc/ld.so.preload> does not commonly exist in the usual
installation of Linux. The presence of this file and other paths to arbitrary
executables could indicate malicious libraries, which also imply the presence of
other malware. Making the file mutable clears the contents of the file by
changing the file permissions to free the system’s resource because other
malicious processes will be unable to work.
We also observed that it can scan the status of all mounted file systems in the
</proc/mount> directory.
Figure 20. Tracking the telemetry activity of changing attributes with the
Workbench app’s Execution Profile feature
Conclusion
Although we have observed the abuse of this vulnerability for illicit
cryptocurrency-mining activities by cybercriminals, we also urge users to
prioritize patching this gap as soon as possible since it is fairly simple to
exploit it for other subsequent compromises. Attackers could take advantage of
injecting their own code for interpretation and gain access to the Confluence
domain being targeted, as well as conduct attacks ranging from controlling the
server for subsequent malicious activities to damaging the infrastructure
itself. Aside from the hezb malware, we observed Kinsing and the Dark.IoT
malware from our honeypot abusing this vulnerability. Reports of cybercriminals
exploiting this gap in attempts to deploy malware such as Mirai and web shells
such as China Chopper have also emerged, with analyses detailing the abuse of
vulnerable servers to spread and expand attacks.
We’ve observed a number of companies who have been hit with the active
exploitation of CVE-2022-26134. According to Confluence’s website, over 75,000
customers use the collaboration tool for their business and work operations,
which implies that a number of industries could be vulnerable and overwhelmed
with attacks if their respective platforms remain unpatched. Organizations who
have yet to patch or upgrade their respective subscriptions to a fixed version
are advised to apply the recommended mitigation steps from the official
documentation released.
Trend Micro solutions
Trend Micro Vision One™ customers are protected from the abuse of this
vulnerability and its accompanying malicious payloads via Workload Security with
the following rules:
* 1011456: Atlassian Confluence and Data Center Remote Code Execution
Vulnerability (CVE-2022-26134)
* 1008610: Block Object-Graph Navigation Language (OGNL) Expressions Initiation
in Apache Struts HTTP Request
Workload Security’s correlation of telemetry and detections provide initial
security context, allowing security teams and analysts to track and monitor the
threats activities. In the next section, Trend Micro Vision One provides more
details into the paths and events in real time.
Using Trend Micro Vision One, the observed attack techniques (OATs) is generated
from individual events that provide security teams and analysts with security
value. To investigate the possible attempts of exploitation using this
vulnerability, analysts can look for these OAT IDs from the other helper OAT
triggers indicative of suspicious activities on the affected host, such as:
1. F2588 - Atlassian Vulnerability Exploitation
2. F2358 - Recursive File Deletion via RM Command
3. F2360 - Process Discovery via PS command
4. F4584 - Identified Transfer of Suspicious Files Over Network
5. F3737 - Curl Execution
6. F4868 - Wget Execution
7. F2918 - View File via Cat Command
8. F4986 - Malware Detection
9. F2140 - Malicious Software
10. F2681 - Display Users and Groups List
11. F2763 - Malicious URL
The Trend Micro Vision One Workbench app helps analysts see the significant
correlated events intelligently based on occurrences throughout the entire fleet
of workloads. Analysts can view the different fields of interest that are
considered important and provide security value, allowing security teams to see
the compromised assets and isolate those that can be potentially affected while
patching procedures are in progress. Using the Execution Profile feature in
Vision One, analysts can through the extensive list of actions performed by an
adversary from the search app or the threat hunting app to look for different
activities observed in a given time frame.
Indicators of Compromise (IOCs)
You can find the full list of IOCs here.
MITRE ATT&CK Techniques
Technique ID Exploit Public-Facing Application T1190 Hijack Execution Flow: Path
Interception by PATH Environment Variable T1574.007 File and Directory
Permissions Modification: Linux and Mac File and Directory Permissions
Modification T1222.002 Hide Artifacts: Hidden Files and Directories T1564.001
Software Discovery T1518 Impair Defenses: Disable or Modify System Firewall
T1562.004 Indicator Removal on Host: File Deletion T1070.004 Scheduled
Task/Job: Cron T1053.003 Resource Hijacking T1496 System Information Discovery
T1082 Remote System Discovery T1018 Remote Services: SSH T1021.004
Tags
Malware | Cyber Crime | Exploits & Vulnerabilities | Cyber Threats | Endpoints |
Mobile | Articles, News, Reports
AUTHORS
* Sunil Bharti
Senior Threat Researcher
Contact Us
Subscribe
RELATED ARTICLES
* Cybersecurity Decluttered: A Journey to Consolidation
* Noodle RAT: Reviewing the New Backdoor Used by Chinese-Speaking Groups
* Manage Open Source Code Security Risks
See all articles
Try our services free for 30 days
* Start your free trial today
*
*
*
*
*
RESOURCES
* Blog
* Newsroom
* Threat Reports
* DevOps Resource Center
* CISO Resource Center
* Find a Partner
SUPPORT
* Business Support Portal
* Contact Us
* Downloads
* Free Trials
*
*
ABOUT TREND
* About Us
* Careers
* Locations
* Upcoming Events
* Trust Center
*
Country Headquarters
Trend Micro - United States (US)
225 East John Carpenter Freeway
Suite 1500
Irving, Texas 75062
Phone: +1 (817) 569-8900
Select a country / region
United States expand_more
close
THE AMERICAS
* United States
* Brasil
* Canada
* México
MIDDLE EAST & AFRICA
* South Africa
* Middle East and North Africa
EUROPE
* België (Belgium)
* Česká Republika
* Danmark
* Deutschland, Österreich Schweiz
* España
* France
* Ireland
* Italia
* Nederland
* Norge (Norway)
* Polska (Poland)
* Suomi (Finland)
* Sverige (Sweden)
* Türkiye (Turkey)
* United Kingdom
ASIA & PACIFIC
* Australia
* Центральная Азия (Central Asia)
* Hong Kong (English)
* 香港 (中文) (Hong Kong)
* भारत गणराज्य (India)
* Indonesia
* 日本 (Japan)
* 대한민국 (South Korea)
* Malaysia
* Монголия (Mongolia) and рузия (Georgia)
* New Zealand
* Philippines
* Singapore
* 台灣 (Taiwan)
* ประเทศไทย (Thailand)
* Việt Nam
Privacy | Legal | Accessibility | Site map
Copyright ©2024 Trend Micro Incorporated. All rights reserved
sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk
This website uses cookies for website functionality, traffic analytics,
personalization, social media functionality and advertising. Our Cookie Notice
provides more information and explains how to amend your cookie settings.Learn
more
Cookies Settings Accept
✓
Danke für das Teilen!
AddToAny
Mehr…
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1Sumo