www.trendmicro.com
Open in
urlscan Pro
23.60.199.21
Public Scan
URL:
https://www.trendmicro.com/en_us/research/22/l/conti-team-one-splinter-group-resurfaces-as-royal-ransomware-wit.html
Submission: On October 16 via api from MX — Scanned from DE
Submission: On October 16 via api from MX — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="main-menu-search" aria-label="Search Trend Micro" data-equally-id="equally_ai___st3iQ">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>Text Content
Business
search close
* Solutions
* By Challenge
* By Challenge
* By Challenge
Learn more
* Understand, Prioritize & Mitigate Risks
* Understand, Prioritize & Mitigate Risks
Improve your risk posture with attack surface management
Learn more
* Protect Cloud-Native Apps
* Protect Cloud-Native Apps
Security that enables business outcomes
Learn more
* Protect Your Hybrid World
* Protect Your Hybrid, Multi-Cloud World
Gain visibility and meet business needs with security
Learn more
* Securing Your Borderless Workforce
* Securing Your Borderless Workforce
Connect with confidence from anywhere, on any device
Learn more
* Eliminate Network Blind Spots
* Eliminate Network Blind Spots
Secure users and key operations throughout your environment
Learn more
* See More. Respond Faster.
* See More. Respond Faster.
Move faster than your adversaries with powerful purpose-built XDR,
attack surface risk management, and zero trust capabilities
Learn more
* Extend Your Team
* Extend Your Team. Respond to Threats Agilely
Maximize effectiveness with proactive risk reduction and managed
services
Learn more
* Operationalizing Zero Trust
* Operationalizing Zero Trust
Understand your attack surface, assess your risk in real time, and
adjust policies across network, workloads, and devices from a single
console
Learn more
* By Role
* By Role
* By Role
Learn more
* CISO
* CISO
Drive business value with measurable cybersecurity outcomes
Learn more
* SOC Manager
* SOC Manager
See more, act faster
Learn more
* Infrastructure Manager
* Infrastructure Manager
Evolve your security to mitigate threats quickly and effectively
Learn more
* Cloud Builder and Developer
* Cloud Builder and Developer
Ensure code runs only as intended
Learn more
* Cloud Security Ops
* Cloud Security Ops
Gain visibility and control with security designed for cloud
environments
Learn more
* By Industry
* By Industry
* By Industry
Learn more
* Healthcare
* Healthcare
Protect patient data, devices, and networks while meeting regulations
Learn more
* Manufacturing
* Manufacturing
Protecting your factory environments – from traditional devices to
state-of-the-art infrastructures
Learn more
* Oil & Gas
* Oil & Gas
ICS/OT Security for the oil and gas utility industry
Learn more
* Electric Utility
* Electric Utility
ICS/OT Security for the electric utility
Learn more
* Federal
* Federal
Learn more
* Automotive
* Automotive
Learn more
* 5G Networks
* 5G Networks
Learn more
* Platform
* Vision One Platform
* Trend Vision One
Our Unified Platform
Bridge threat protection and cyber risk management
Learn more
* Attack Surface Management
* Attack Surface Management
Operationalize a zero trust strategy
Learn more
* XDR (Extended Detection & Response)
* XDR (Extended Detection & Response)
Stop adversaries faster with a broader perspective and better context to
hunt, detect, investigate, and respond to threats from a single platform
Learn more
* Endpoint Security
* Endpoint Security
* Endpoint Security Overview
Defend the endpoint through every stage of an attack
Learn more
* Workload Security
* Workload Security
Optimized prevention, detection, and response for endpoints, servers,
and cloud workloads
Learn more
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Cloud Security
* Cloud Security
* Trend Vision One™
Cloud Security Overview
The most trusted cloud security platform for developers, security
teams, and businesses
Learn more
* Cloud Security Posture Management
* Cloud Security Posture Management
Leverage complete visibility and rapid remediation
Learn more
* Container Security
* Container Security
Simplify security for your cloud-native applications with advanced
container image scanning, policy-based admission control, and container
runtime protection
Learn more
* File Storage Security
* File Storage Security
Security for cloud file/object storage services leveraging cloud-native
application architectures
Learn more
* Network Security
* Network Security
Advanced cloud-native network security detection, protection, and cyber
threat disruption for your single and multi-cloud environments.
Learn more
* Open Source Security
* Open Source Security
Visibility and monitoring of open source vulnerabilities for SecOps
Learn more
* Cloud Visibility
* Cloud Visibility
As your organization continues to move data and apps to the cloud and
transform your IT infrastructure, mitigating risk without slowing down
the business is critical.
Learn more
* Network Security
* Network Security
* Network Security Overview
Expand the power of XDR with network detection and response
Learn more
* Network Intrusion Prevention (IPS)
* Network Intrusion Prevention (IPS)
Protect against known, unknown, and undisclosed vulnerabilities in your
network
Learn more
* Breach Detection System (BDS)
* Breach Detection System (BDS)
Detect and respond to targeted attacks moving inbound, outbound, and
laterally
Learn more
* Secure Service Edge (SSE)
* Secure Service Edge (SSE)
Redefine trust and secure digital transformation with continuous risk
assessments
Learn more
* Industrial Network Security
* Industrial Network Security
Learn more
* Email Security
* Email Security
Stop phishing, malware, ransomware, fraud, and targeted attacks from
infiltrating your enterprise
Learn more
* Mobile Security
* Mobile Security
On-premises and cloud protection against malware, malicious applications,
and other mobile threats
Learn more
* Threat Intelligence
* Threat Intelligence
Keep ahead of the latest threats and protect your critical data with
ongoing threat prevention and analysis
Learn more
* Small & Midsized Business Security
* Small & Midsized Business Security
Stop threats with comprehensive, set-it-and-forget-it protection
Learn more
* All Products, Services and Trials
* All Products, Services and Trials
Learn more
* Research
* Research
* Research
* Research
Learn more
* About Our Research
* About Our Research
Learn more
* Research, News, and Perspectives
* Research, News, and Perspectives
Learn more
* Research and Analysis
* Research and Analysis
Learn more
* Blog
* Blog
Learn more
* Security News
* Security News
Learn more
* Zero Day Initiatives (ZDI)
* Zero Day Initiatives (ZDI)
Learn more
* Services
* Our Services
* Our Services
* Our Services
Learn more
* Service Packages
* Service Packages
Augment security teams with 24/7/365 managed detection, response, and
support
Learn more
* Managed XDR
* Managed XDR
Augment threat detection with expertly managed detection and response
(MDR) for email, endpoints, servers, cloud workloads, and networks
Learn more
* Incident Response
* Incident Response
* Incident Response
Our trusted experts are on call whether you're experiencing a breach
or looking to proactively improve your IR plans
Learn more
* Insurance Carriers and Law Firms
* Insurance Carriers and Law Firms
Stop breaches with the best response and detection technology on the
market and reduce clients’ downtime and claim costs
Learn more
* Support Services
* Support Services
Learn more
* Partners
* Partner Program
* Partner Program
* Partner Program Overview
Grow your business and protect your customers with the best-in-class
complete, multilayered security
Learn more
* Managed Security Service Provider
* Managed Security Service Provider
Deliver modern security operations services with our industry-leading
XDR
Learn more
* Managed Service Provider
* Managed Service Provider
Partner with a leading expert in cybersecurity, leverage proven
solutions designed for MSPs
Learn more
* Cloud Service Provider
* Cloud Service Provider
Add market-leading security to your cloud service offerings – no matter
which platform you use
Learn more
* Professional Services
* Professional Services
Increase revenue with industry-leading security
Learn more
* Resellers
* Resellers
Discover the possibilities
Learn more
* Marketplace
* Marketplace
Learn more
* System Integrators
* System Integrators
Learn more
* Alliance Partners
* Alliance Partners
* Alliance Overview
We work with the best to help you optimize performance and value
Learn more
* Technology Alliance Partners
* Technology Alliance Partners
Learn more
* Our Alliance Partners
* Our Alliance Partners
Learn more
* Partner Tools
* Partner Tools
* Partner Tools
Learn more
* Partner Login
* Partner Login
Login
* Education and Certification
* Education and Certification
Learn more
* Partner Successes
* Partner Successes
Learn more
* Distributors
* Distributors
Learn more
* Find a Partner
* Find a Partner
Learn more
* Company
* Why Trend Micro
* Why Trend Micro
* Why Trend Micro
Learn more
* The Trend Micro Difference
* The Trend Micro Difference
Learn more
* Customer Success Stories
* Customer Success Stories
Learn more
* The Human Connection
* The Human Connection
Learn more
* Industry Accolades
* Industry Accolades
Learn more
* Strategic Alliances
* Strategic Alliances
Learn more
* About Us
* About Us
* About Us
Learn more
* Trust Center
* Trust Center
Learn more
* History
* History
Learn more
* Diversity, Equity and Inclusion
* Diversity, Equity and Inclusion
Learn more
* Corporate Social Responsibility
* Corporate Social Responsibility
Learn more
* Leadership
* Leadership
Learn more
* Security Experts
* Security Experts
Learn more
* Internet Safety and Cybersecurity Education
* Internet Safety and Cybersecurity Education
Learn more
* Legal
* Legal
Learn more
* Investors
* Investors
Learn more
* Connect with Us
* Connect with Us
* Connect with Us
Learn more
* Newsroom
* Newsroom
Learn more
* Events
* Events
Learn more
* Careers
* Careers
Learn more
* Webinars
* Webinars
Learn more
Back
Back
Back
Back
* Free Trials
* Contact Us
Looking for home solutions?
Under Attack?
0
Back
Folio (0)
Support
* Business Support Portal
* Virus and Threat Help
* Renewals and Registration
* Education and Certification
* Contact Support
* Find a Support Partner
Resources
* Cyber Risk Index/Assessment
* CISO Resource Center
* DevOps Resource Center
* What Is?
* Threat Encyclopedia
* Cloud Health Assessment
* Cyber Insurance
* Glossary of Terms
* Webinars
Log In
* Support
* Partner Portal
* Cloud One
* Product Activation and Management
* Referral Affililate
Back
arrow_back
search
close
Content has been added to your Folio
Go to Folio (0) close
Ransomware
CONTI TEAM ONE SPLINTER GROUP RESURFACES AS ROYAL RANSOMWARE WITH CALLBACK
PHISHING ATTACKS
From September to December, we detected multiple attacks from the Royal
ransomware group. In this blog entry, we discuss findings from our investigation
of this ransomware and the tools that Royal ransomware actors used to carry out
their attacks.
By: Ivan Nicole Chavez, Byron Gelera, Monte de Jesus, Don Ovid Ladores,
Khristian Joseph Morales December 21, 2022 Read time: 6 min (1695 words)
Save to Folio
Subscribe
--------------------------------------------------------------------------------
Royal ransomware may have been first observed by researchers around September
2022, but it has seasoned cybercriminals behind it: The threat actors running
this ransomware — who used to be a part of Conti Team One, according to a mind
map shared by Vitali Kremez — initially dubbed it Zeon ransomware, until they
rebranded it to Royal ransomware. From September to December this year, we have
detected multiple attacks from Royal ransomware, with the US and Brazil being
the most targeted countries (Figure 1). This blog entry discusses in depth the
findings from our investigation of samples of this new piece of ransomware, as
well as the tools that Royal ransomware actors used to carry out their attacks.
Figure 1. Percentage of Royal ransomware attacks by country
INFECTION ROUTINE
External reports mention that the Royal ransomware group uses callback phishing
as a means of delivering their ransomware to victims (Figure 2). These phishing
attacks contain a number that leads to a service hired by the threat actors.
When contacted, they will use social engineering tactics to lure victims into
installing remote access software.
Figure 2. Royal ransomware’s attack flow
INSTALLATION
Our investigation found that the ransomware actors used a compiled remote
desktop malware, which was used to drop the tools they needed to infiltrate the
victim’s system: they used QakBot and Cobalt Strike for lateral movement, while
NetScan was used to look for any remote systems connected to the network. Once
they infiltrated the system, the ransomware actors used tools such as PCHunter,
PowerTool, GMER, and Process Hacker to disable any security-related services
running in the system. They then exfiltrate the victim’s data via the RClone
tool. We also observed an instance in which they used AdFind to look for active
directories, then executed RDPEnable on the infected machine.
PAYLOAD
Once everything has been set up, the ransomware actors used PsEXEC to execute
the malware. The PsEXEC commands contain the ID of the victim, along with any
argument that the actors applied to the ransomware. There were also instances of
the malware actors using PsEXEC to enable the remote desktop protocol (RDP) of a
target system before executing the ransomware.
ANALYSIS
In part of our analysis, we used a ransomware sample with the detection name
Ransom.Win64.YORAL.SMYXCJCT. As shown in Table 1, Figure 3, and Figure 4, Royal
ransomware requires an argument of “-id {32-byte characters}” to execute on a
victim’s machine. It also accepts “-path” to specify a target file for
encryption and “-ep {value}” to calculate the partial file encryption of large
files.
In some earlier samples of the ransomware, the binary wouldn’t parse all the
arguments due to a bug in the code. For example, “-path” won't be processed if
provided after the "-id" argument; if provided before, there will be no "-id"
argument, so it will not proceed.
Argument Description -path {target path} If provided, will only encrypt the
contents of the target path -id {32-byte characters} Will be used as the
victim’s ID, which will be appended on the TOR link found in the dropped ransom
note. The process exists if not provided or if provided characters is not 32
bytes long -ep This argument is for the full or partial encryption of file
routine
Table 1. Arguments accepted by the Royal ransomware binary
Figure 3. Arguments accepted by the ransomware binary
Figure 4. Checking if length of provided “-id” is 32 bytes
It enumerates files and directories for encryption using FindFirstFileW,
FindNextFileW, and FindClose APIs (Figure 5).
Figure 5. File enumeration
The ransomware looks for available network shares for network encryption by
listing accessible local IPs, then uses NetShareEnum and attempts to connect on
ADMIN$ and IPC$ shares (Figure 6).
Figure 6. Looking for accessible local IPs then trying to connect to ADMIN$ and
IPC$
It checks for the number of processors in the infected system and uses it as a
base for the concurrent running threads for file encryption, as shown in Figure
7. By doing so, Royal ransomware significantly increases the speed of its file
encryption process.
Figure 7. Checking the number of processors
Royal ransomware inhibits system recovery by deleting shadow copies (Figure 8)
through the following command:
C:\\Windows\\System32\\vssadmin.exe delete shadows /all /quiet
Figure 8. Using vssadmin.exe to delete shadow copies
The ransomware encrypts files using OpenSSL’s Advanced Encryption Standard
(AES). It will encrypt the AES key and IV with RSA encryption using the embedded
RSA public key (Figure 9). The RSA-encrypted AES key and IV will be appended on
each encrypted file (Figure 10).
Figure 9. An RSA public key
Figure 10. Generation of AES Key and IV
The malicious actors behind Royal ransomware use a form of intermittent
encryption tactic to speed their encryption process: the ransomware first checks
if the file size is divisible by 16, which is a requirement for AES (Figure 11).
If not, it rounds up the total size until it is divisible by 16. For example, if
the size is 18, it will append zero bytes to the file until it has a size of 32,
which is now divisible by 16. Aside from appending the needed zero bytes, it
also appends an extra 0x210 Zero bytes as a placeholder for the appended RSA
encrypted key.
Figure 11. Royal ransomware checking if file size is divisible by 16
For a file size that has been rounded-up, Royal ransomware will check if the
size is less than or equal to 5,245,000 bytes or if the value is set to 100
(0x64), as shown in Figure 12. If the file size is within these limits, it will
encrypt the entire file. For files greater than 5,245,000 bytes, file encryption
will take place per certain calculated blocks: for example, it will encrypt
first N bytes, then skip the next N bytes, then encrypt the next N bytes, and so
on.
Figure 12. Encryption process and calculation
Its calculation of N bytes is as follows:
X / 10* (Original file size) & 0xFFFFFFF0
* where X is the value set before encryption
* X is either 0x32 (50) or 0x64 (100)
* This value will also be used as indicator if full encryption or partial
encryption will be performed on the file
For example, with a file with a file size equal to 5,245,000:
N = 50/10 * (5245000 / 100) & 0xFFFFFFF0 = 0x40060 (262240)
If the calculated N is greater than 1,024,000, it will simply encrypt per
1,024,000 block instead (Figure 13).
Figure 13. Condition if N is greater than 1,024,000
The encrypted file’s structure would then be as follows (Table 2):
Description Size Encrypted File Contents Rounded-up file size divisible by 16
RSA Encrypted Key 0x200 bytes Size of encrypted file / offset address of RSA
Encrypted Key 8 bytes X value, 0x64 or provided value (usually 0x32), indicator
if full or partial encryption 8 bytes
Table 2. An encrypted file’s structure
The ransomware then renames the encrypted files by appending them with the
“.royal” extension, as demonstrated in Figures 14 and 15.
Figure 14. Royal ransomware appending “.royal” to encrypted files
Figure 15. Encrypted files appended with the “.royal” extension
For each directory it traverses, Royal ransomware drops a text file named
“README.TXT” that contains the ransom note (Figure 16), as well as an
advertisement for its “pentesting services” that the ransomware actors will
allegedly provide once the ransom has been paid (Figure 17).
Figure 16. Creation of the “README.TXT” file
Figure 17. Contents of "README.TXT" with the sample ID we used appended on the
TOR link.
SECURITY RECOMMENDATIONS
Our investigation into Royal ransomware attacks shows how the group employs a
mixture of both old and new techniques, which indicates that it is no newcomer
to the ransomware scene. Their use of callback phishing to lure victims into
installing remote desktop malware allows them to infiltrate the victim’s machine
with relative ease. Their intermittent encryption tactics also hasten their
encryption of a victim’s files, with the added benefit of evading detection
measures that focus on looking for heavy file IO operations. Despite their
“late” entry to the scene in September, the group already has ransomed multiple
companies, and we expect them to be more active in the upcoming months. More
details on Royal ransomware’s other capabilities can be found in Trend Micro’s
Threat Encyclopedia.
We highly advise users and organizations to update their systems with the latest
patches and apply multi-layered defense mechanisms. The emergence and success of
the Royal ransomware gang underscore how ransomware actors are finding more
innovative ways to repurposing existing tools and tactics as a means of
augmenting their attacks. End users and enterprises alike can mitigate the risk
of infection from new threats like Royal ransomware by following these security
best practices:
* Enable multifactor authentication (MFA) to prevent attackers from performing
lateral movement inside a network.
* Adhere to the 3-2-1 rule when backing up important files. This involves
creating three backup copies on two different file formats, with one of the
copies stored in a separate location.
* Patch and update systems regularly. It’s important to keep operating systems
and applications up to date and maintain patch management protocols that can
deter malicious actors from exploiting any software vulnerabilities.
Companies can also benefit from the use of multilayered detection and response
solutions such as Trend Micro Vision One™, which provides powerful XDR
capabilities that collect and automatically correlate data across multiple
security layers — email, endpoints, servers, cloud workloads, and networks — to
prevent attacks via automated protection, while also ensuring that no
significant incidents go unnoticed. Trend Micro Apex One™ also provides
next-level automated threat detection and response to protect endpoints against
advanced issues, like human-operated ransomware.
INDICATORS OF COMPROMISE (IOCS)
SHA-256 Detection Description
c0063d24f3de4e7b89abf9b690a3d264efc6ab7a626f73ad9f42d6bffe52bce7
Trojan.Win64.COBALT.BE CobaltStrike
fef79160f0ce9aa9dec15c914f2c2b40b2ae1ec2b0e65e414545dbc994afd73d
Trojan.Win64.COBALT.BE CobaltStrike
3434271f2038afaddad4caad8000e390b3573b2b53e02841653a4ee0dfd73674
Trojan.Win64.COBALT.BE CobaltStrike
0ac0b3758359855e96367b6c83b0aabdc6cfb59b4caa1cec48632defd21cdf3c
Trojan.Win64.COBALT.BE CobaltStrike
451cef0085dc5b474cc5c68af079d0367d7d2ec73ae2210788beb5297e1fbd6d
Trojan.Win64.COBALT.BE CobaltStrike
e710e902507ad63e1d2ce1220212b1a751b70504259457234103bb22845a9424
Trojan.Win32.QAKBOT.DRSV QakBot
2718dcbb503b6334078daf4af61e17a547fb80c9b811c26cfc9d32f5ce63a826
Trojan.Win32.QAKBOT.DRTE QakBot
abf937fb2f162d1dbbe76c7386c9892db5191e17de586f0a5c49819cd68b5e0f
Trojan.Win32.DEYMA.AM Compiled Remote Desktop Malware
bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
PUA.Win64.ProcHack.AC Process Hacker
572d88c419c6ae75aeb784ceab327d040cb589903d6285bbffa77338111af14b
HackTool.Win32.NetScan.AG NetScan
094d1476331d6f693f1d546b53f1c1a42863e6cde014e2ed655f3cbe63e5ecde
HackTool.Win32.ToolPow.SM PowerTool
e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173
PUA.Win32.GMER.YABBI GMER
d1aa0ceb01cca76a88f9ee0c5817d24e7a15ad40768430373ae3009a619e2691
PUA.Win64.PCHunter.B PCHunter
bb48f5c915ab7bbbbbf092a20169aaf3ced46b492ed69550854a55254ce10572
Backdoor.Win32.SWRORT.YXCJ5Z Malware Component
e263b9d5467bf724000966da2acfe06520a464c566e4b3d9833213f850f3f1f2
HackTool.Win32.Adfind.THLOFBB AdFind
ac49c114ef137cc198786ad8daefa9cfcc01f0c0a827b0e2b927a7edd0fca8b0
HackTool.BAT.RDPEnable.A RDPEnable
2598e8adb87976abe48f0eba4bbb9a7cb69439e0c133b21aee3845dfccf3fb8f
Ransom.Win64.YORAL.SMYXCJCT Royal Ransomware Binary
cdd7814074872fc35d18740cdd4e8a5fefcfd6b457fde2920383fd5b11903fc5
Ransom_Royal.R06CC0DK222 Royal Ransomware Binary
a61b71ee73ea8c0f332591e361adeda04705c65b5f4d549066677ec4e71212f7
Ransom.Win32.YORAL.YXCKB Royal Ransomware Binary
56e8bd8b0c5bfb87956f7915bc47a9ecf5d338b804cee1dccacf53400d602be3
Ransom.Win32.YORAL.YECJYT Royal Ransomware Binary
Tags
Latest News | Ransomware | Web | Articles, News, Reports
AUTHORS
* Ivan Nicole Chavez
Threat Analyst
* Byron Gelera
Threats Analyst
* Monte de Jesus
Threats Analyst
* Don Ovid Ladores
Threats Analyst
* Khristian Joseph Morales
Threats Analyst
Contact Us
Subscribe
RELATED ARTICLES
* Beware: Lumma Stealer Distributed via Discord CDN
* The Trail of BlackTech’s Cyber Espionage Campaigns
* Examining the Activities of the Turla APT Group
See all articles
Try our services free for 30 days
* Start your free trial today
*
*
*
*
*
RESOURCES
* Blog
* Newsroom
* Threat Reports
* DevOps Resource Center
* CISO Resource Center
* Find a Partner
SUPPORT
* Business Support Portal
* Contact Us
* Downloads
* Free Trials
*
*
ABOUT TREND
* About Us
* Careers
* Locations
* Upcoming Events
* Trust Center
*
Select a country / region
United States expand_more
close
THE AMERICAS
* United States
* Brasil
* Canada
* México
MIDDLE EAST & AFRICA
* South Africa
* Middle East and North Africa
EUROPE
* België (Belgium)
* Česká Republika
* Danmark
* Deutschland, Österreich Schweiz
* España
* France
* Ireland
* Italia
* Nederland
* Norge (Norway)
* Polska (Poland)
* Suomi (Finland)
* Sverige (Sweden)
* Türkiye (Turkey)
* United Kingdom
ASIA & PACIFIC
* Australia
* Центральная Азия (Central Asia)
* Hong Kong (English)
* 香港 (中文) (Hong Kong)
* भारत गणराज्य (India)
* Indonesia
* 日本 (Japan)
* 대한민국 (South Korea)
* Malaysia
* Монголия (Mongolia) and рузия (Georgia)
* New Zealand
* Philippines
* Singapore
* 台灣 (Taiwan)
* ประเทศไทย (Thailand)
* Việt Nam
Privacy | Legal | Accessibility | Site map
Copyright ©2023 Trend Micro Incorporated. All rights reserved
sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk
This website uses cookies for website functionality, traffic analytics,
personalization, social media functionality and advertising. Our Cookie Notice
provides more information and explains how to amend your cookie settings.Learn
more
Cookies Settings Accept
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
Sumo