www.trendmicro.com
Open in
urlscan Pro
72.246.168.71
Public Scan
URL:
https://www.trendmicro.com/en_us/research/24/a/kasseika-ransomware-deploys-byovd-attacks-abuses-psexec-and-expl.html
Submission: On January 25 via api from DE — Scanned from DE
Submission: On January 25 via api from DE — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="main-menu-search" aria-label="Search Trend Micro" data-equally-id="equally_ai___Bqg9T">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>Text Content
Business
search close
* Solutions
* By Challenge
* By Challenge
* By Challenge
Learn more
* Understand, Prioritize & Mitigate Risks
* Understand, Prioritize & Mitigate Risks
Improve your risk posture with attack surface management
Learn more
* Protect Cloud-Native Apps
* Protect Cloud-Native Apps
Security that enables business outcomes
Learn more
* Protect Your Hybrid World
* Protect Your Hybrid, Multi-Cloud World
Gain visibility and meet business needs with security
Learn more
* Securing Your Borderless Workforce
* Securing Your Borderless Workforce
Connect with confidence from anywhere, on any device
Learn more
* Eliminate Network Blind Spots
* Eliminate Network Blind Spots
Secure users and key operations throughout your environment
Learn more
* See More. Respond Faster.
* See More. Respond Faster.
Move faster than your adversaries with powerful purpose-built XDR,
attack surface risk management, and zero trust capabilities
Learn more
* Extend Your Team
* Extend Your Team. Respond to Threats Agilely
Maximize effectiveness with proactive risk reduction and managed
services
Learn more
* Operationalizing Zero Trust
* Operationalizing Zero Trust
Understand your attack surface, assess your risk in real time, and
adjust policies across network, workloads, and devices from a single
console
Learn more
* By Role
* By Role
* By Role
Learn more
* CISO
* CISO
Drive business value with measurable cybersecurity outcomes
Learn more
* SOC Manager
* SOC Manager
See more, act faster
Learn more
* Infrastructure Manager
* Infrastructure Manager
Evolve your security to mitigate threats quickly and effectively
Learn more
* Cloud Builder and Developer
* Cloud Builder and Developer
Ensure code runs only as intended
Learn more
* Cloud Security Ops
* Cloud Security Ops
Gain visibility and control with security designed for cloud
environments
Learn more
* By Industry
* By Industry
* By Industry
Learn more
* Healthcare
* Healthcare
Protect patient data, devices, and networks while meeting regulations
Learn more
* Manufacturing
* Manufacturing
Protecting your factory environments – from traditional devices to
state-of-the-art infrastructures
Learn more
* Oil & Gas
* Oil & Gas
ICS/OT Security for the oil and gas utility industry
Learn more
* Electric Utility
* Electric Utility
ICS/OT Security for the electric utility
Learn more
* Federal
* Federal
Learn more
* Automotive
* Automotive
Learn more
* 5G Networks
* 5G Networks
Learn more
* Small & Midsized Business Security
* Small & Midsized Business Security
Stop threats with comprehensive, set-it-and-forget-it protection
Learn more
* Platform
* Vision One Platform
* Vision One Platform
* Trend Vision One
Our Unified Platform
Bridge threat protection and cyber risk management
Learn more
* AI Companion
* Trend Vision One Companion
Your generative AI cybersecurity assistant
Learn more
* Attack Surface Management
* Attack Surface Management
Stop breaches before they happen
Learn more
* XDR (Extended Detection & Response)
* XDR (Extended Detection & Response)
Stop adversaries faster with a broader perspective and better context to
hunt, detect, investigate, and respond to threats from a single platform
Learn more
* Cloud Security
* Cloud Security
* Trend Vision One™
Cloud Security Overview
The most trusted cloud security platform for developers, security
teams, and businesses
Learn more
* Attack Surface Risk Management for Cloud
* Attack Surface Risk Management for Cloud
Cloud asset discovery, vulnerability prioritization, Cloud Security
Posture Management, and Attack Surface Management all in one
Learn more
* XDR for Cloud
* XDR for Cloud
Extend visibility to the cloud and streamline SOC investigations
Learn more
* Workload Security
* Workload Security
Secure your data center, cloud, and containers without compromising
performance by leveraging a cloud security platform with CNAPP
capabilities
Learn more
* Container Security
* Container Security
Simplify security for your cloud-native applications with advanced
container image scanning, policy-based admission control, and container
runtime protection
Learn more
* File Storage Security
* File Storage Security
Security for cloud file/object storage services leveraging cloud-native
application architectures
Learn more
* Endpoint Security
* Endpoint Security
* Endpoint Security Overview
Defend the endpoint through every stage of an attack
Learn more
* XDR for Endpoint
* XDR for Endpoint
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Workload Security
* Workload Security
Optimized prevention, detection, and response for endpoints, servers,
and cloud workloads
Learn more
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Mobile Security
* Mobile Security
On-premises and cloud protection against malware, malicious
applications, and other mobile threats
Learn more
* Network Security
* Network Security
* Network Security Overview
Expand the power of XDR with network detection and response
Learn more
* XDR for Network
* XDR for Network
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Network Intrusion Prevention (IPS)
* Network Intrusion Prevention (IPS)
Protect against known, unknown, and undisclosed vulnerabilities in your
network
Learn more
* Breach Detection System (BDS)
* Breach Detection System (BDS)
Detect and respond to targeted attacks moving inbound, outbound, and
laterally
Learn more
* Secure Service Edge (SSE)
* Secure Service Edge (SSE)
Redefine trust and secure digital transformation with continuous risk
assessments
Learn more
* Industrial Network Security
* Industrial Network Security
Learn more
* 5G Network Security
* 5G Network Security
Learn more
* Email Security
* Email Security
* Email Security
Stop phishing, malware, ransomware, fraud, and targeted attacks from
infiltrating your enterprise
Learn more
* Email and Collaboration Security
* Trend Vision One™
Email and Collaboration Security
Stop phishing, ransomware, and targeted attacks on any email service
including Microsoft 365 and Google Workspace
Learn more
* OT Security
* OT Security
* OT Security
Learn about solutions for ICS / OT security.
Learn more
* XDR for OT
* XDR for OT
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Industrial Network Security
* Industrial Network Security
Industrial Network Security
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Threat Intelligence
* Threat Intelligence
Keep ahead of the latest threats and protect your critical data with
ongoing threat prevention and analysis
Learn more
* All Products, Services and Trials
* All Products, Services and Trials
Learn more
* Research
* Research
* Research
* Research
Learn more
* Research, News, and Perspectives
* Research, News, and Perspectives
Learn more
* Research and Analysis
* Research and Analysis
Learn more
* Security News
* Security News
Learn more
* Zero Day Initiatives (ZDI)
* Zero Day Initiatives (ZDI)
Learn more
* Services
* Our Services
* Our Services
* Our Services
Learn more
* Service Packages
* Service Packages
Augment security teams with 24/7/365 managed detection, response, and
support
Learn more
* Managed XDR
* Managed XDR
Augment threat detection with expertly managed detection and response
(MDR) for email, endpoints, servers, cloud workloads, and networks
Learn more
* Incident Response
* Incident Response
* Incident Response
Our trusted experts are on call whether you're experiencing a breach
or looking to proactively improve your IR plans
Learn more
* Insurance Carriers and Law Firms
* Insurance Carriers and Law Firms
Stop breaches with the best response and detection technology on the
market and reduce clients’ downtime and claim costs
Learn more
* Support Services
* Support Services
Learn more
* Partners
* Partner Program
* Partner Program
* Partner Program Overview
Grow your business and protect your customers with the best-in-class
complete, multilayered security
Learn more
* Managed Security Service Provider
* Managed Security Service Provider
Deliver modern security operations services with our industry-leading
XDR
Learn more
* Managed Service Provider
* Managed Service Provider
Partner with a leading expert in cybersecurity, leverage proven
solutions designed for MSPs
Learn more
* Cloud Service Provider
* Cloud Service Provider
Add market-leading security to your cloud service offerings – no matter
which platform you use
Learn more
* Professional Services
* Professional Services
Increase revenue with industry-leading security
Learn more
* Resellers
* Resellers
Discover the possibilities
Learn more
* Marketplace
* Marketplace
Learn more
* System Integrators
* System Integrators
Learn more
* Alliance Partners
* Alliance Partners
* Alliance Overview
We work with the best to help you optimize performance and value
Learn more
* Technology Alliance Partners
* Technology Alliance Partners
Learn more
* Our Alliance Partners
* Our Alliance Partners
Learn more
* Partner Tools
* Partner Tools
* Partner Tools
Learn more
* Partner Login
* Partner Login
Login
* Education and Certification
* Education and Certification
Learn more
* Partner Successes
* Partner Successes
Learn more
* Distributors
* Distributors
Learn more
* Find a Partner
* Find a Partner
Learn more
* Company
* Why Trend Micro
* Why Trend Micro
* Why Trend Micro
Learn more
* Customer Success Stories
* Customer Success Stories
Learn more
* The Human Connection
* The Human Connection
Learn more
* Industry Accolades
* Industry Accolades
Learn more
* Strategic Alliances
* Strategic Alliances
Learn more
* Compare Trend Micro
* Compare Trend Micro
Learn more
* About Us
* About Us
* About Us
Learn more
* Trust Center
* Trust Center
Learn more
* History
* History
Learn more
* Diversity, Equity and Inclusion
* Diversity, Equity and Inclusion
Learn more
* Corporate Social Responsibility
* Corporate Social Responsibility
Learn more
* Leadership
* Leadership
Learn more
* Security Experts
* Security Experts
Learn more
* Internet Safety and Cybersecurity Education
* Internet Safety and Cybersecurity Education
Learn more
* Legal
* Legal
Learn more
* Investors
* Investors
Learn more
* Formula E Racing
* Formula E Racing
Learn more
* Connect with Us
* Connect with Us
* Connect with Us
Learn more
* Newsroom
* Newsroom
Learn more
* Events
* Events
Learn more
* Careers
* Careers
Learn more
* Webinars
* Webinars
Learn more
Back
Back
Back
Back
* Free Trials
* Contact Us
Looking for home solutions?
Under Attack?
5 Alerts
Back
Unread
All
* #1 Channel Security Vendor in Canalys Global Cybersecurity Leadership Matrix
close
More on channel program >
* Modernizing security to fend off cyberattacks with FedRAMP
close
See how >
* Explore the rich history of quantum computing
close
Learn more >
* How Trend Vision One™ reduces business email compromise
close
Read more >
* Preparing for the shift from centralized energy generation
close
Learn more >
Folio (0)
Support
* Business Support Portal
* Business Community
* Virus and Threat Help
* Education and Certification
* Contact Support
* Find a Support Partner
Resources
* Cyber Risk Index/Assessment
* CISO Resource Center
* DevOps Resource Center
* What Is?
* Threat Encyclopedia
* Cloud Health Assessment
* Cyber Insurance
* Glossary of Terms
* Webinars
Log In
* Support
* Partner Portal
* Cloud One
* Product Activation and Management
* Referral Affililate
Back
arrow_back
search
close
Content has been added to your Folio
Go to Folio (0) close
Ransomware
KASSEIKA RANSOMWARE DEPLOYS BYOVD ATTACKS, ABUSES PSEXEC AND EXPLOITS MARTINI
DRIVER
In this blog, we detail our investigation of the Kasseika ransomware and the
indicators we found suggesting that the actors behind it have acquired access to
the source code of the notorious BlackMatter ransomware.
By: Emmanuel Panopio, Christian Jason Geollegue, Julius Keith Estrellado,
Christian Alpuerto, Shawn Austin Santos, Emmanuel Roll, Rhio Manaog, Gerald
Fernandez, Don Ovid Ladores, Raighen Sanchez, Raymart Yambot, Francesca
Villasanta, Sophia Nilette Robles January 23, 2024 Read time: 6 min (1695 words)
Save to Folio
Subscribe
--------------------------------------------------------------------------------
Following an increase in bring-your-own-vulnerable-driver (BYOVD) attacks
launched by ransomware groups in 2023, the Kasseika ransomware is among the
latest groups to take part in the trend. Kasseika joins Akira, BlackByte, and
AvosLocker in using the tactic that allows threat actors to terminate antivirus
processes and services for the deployment of ransomware. In this case we
investigated, the Kasseika ransomware abused Martini driver to terminate the
victim machine’s antivirus-related processes.
In our analysis of the Kasseika ransomware attack chain, we observed indicators
that resemble the BlackMatter ransomware. These indicators include pseudo-ransom
extensions and the use of extension string.README.txt as the ransom note file
name and format.
A closer look revealed that majority of the source code used by BlackMatter was
used in this attack. Based on our research, the BlackMatter source code is not
widely available, so its use in this Kasseika ransomware attack is suggestive of
a mature actor in a limited group that acquired or bought access to it.
BlackMatter respawned from DarkSide, which is known to have been used as the
basis for ALPHV, more popularly known as BlackCat. Since its shutdown in 2021,
other ransomware groups have been observed using similar techniques and tools to
BlackMatter, while a more exclusive group of ransomware operators are able to
access its old code and apply it to new strains.
Figure 1. The Kasseika ransomware infection chain
download
Targeted phishing links via email for initial access
In the Kasseika ransomware case that we investigated, we observed that it used
targeted phishing techniques for initial access, as well as to gather
credentials from one of the employees of its target company. It then uses remote
administration tools (RATs) to gain privileged access and move laterally within
its target network.
Figure 2. PsExec Command to execute malicious .bat file (click to enlarge)
Abusing PsExec for execution
Kasseika abused the legitimate Windows RAT PsExec to execute its malicious
files. PsExec was originally designed for network management, but its misuse
allows threat actors to remotely deploy a malicious .bat file, as in this
case.
Figure 3. Kasseika terminates Martini runtime
The Kasseika ransomware initially uses a batch script to load its malicious
entities. The script begins by checking for the existence of the process named
Martini.exe. If found, it then proceeds to terminate it to ensure that there is
only one instance of the process running on the machine.
Kasseika’s KILLAV mechanism for defense evasion
Upon further analysis, Martini.exe first verifies whether the Martini.sys driver
was successfully downloaded to the affected system. The signed driver
Martini.sys, originally labeled as viragt64.sys, is part of VirIT Agent System
developed by TG Soft. By exploiting its vulnerabilities, Kasseika leverages this
driver to effectively disable various security tools. If Martini.sys does not
exist, the malware will terminate itself and not proceed with its intended
routine.
Figure 4. “Martini.sys” file properties and certificate information
download
After confirming the presence of the system file, Kasseika proceeds to create a
service and then initiates it.
Figure 5. The service created by PINCAV trojan, a 64-bit Windows PE file written
in C++
The driver Martini.sys is then loaded by Martini.exe using the CreateFileW
function.
Figure 6. The “Martini.sys” driver loaded by “Martini.exe”
After loading Martini.sys, Martini.exe continuously scans all active processes
in the system. Upon detecting a listed process, it conveys this information to
the driver through the DeviceIoControl function.
Figure 7. The “DeviceIoControl” function
The control code 0x82730030 is sent to the driver, instructing it to terminate
at least 991 processes within its list, including antivirus products, security
tools, analysis tools, and system utility tools. A complete list of the
terminated processes can be found here.
Figure 8. The “Martini.sys” case function
Figure 9. ZwTerminateProcess at “0x82730030” memory address is responsible for
process termination.
Kasseika also makes use of the FindWindowA API to compare strings.
Figure 10. Kasseika comparing application window names for defense evasion
(click to enlarge)
download
Figure 11. Kasseika comparing strings for defense evasion
The Kasseika ransomware discovers applications that are related to process
monitoring, system monitoring, and analysis tools.
OLLYDBG
18467-41 GBDYLLO FilemonClass pediy06 File Monitor –
Sysinternals: www.sysinternals.com RegmonClass PROCMON_WINDOW_CLASS Registry
Monitor – Sysinternals: www.sysinternals.com Process Monitor –
Sysinternals: www.sysinternals.com
Table 1. A list of process monitoring, system monitoring, and analysis tools
that Kasseika looks for
The Kasseika ransomware levels up its defense evasion techniques by discovering
running processes that are related to security and analysis tools. It will
terminate itself if these processes are present in the system.
ntice.sys CisUtMonitor iceext.sys FileMonitor.sys Syser.sys REGMON HanOlly.sys
Regsys extrem.sys Sysregm FRDTSC.SYS PROCMON fengyue.sys Revoflt Kernel
Detective Filem
Table 2. A list of process names related to security and analysis
Figure 12 shows that the script will remove any directories under the malicious
batch script to ensure a clean state. Kasseika will set up the variables to
store various paths and executable file names. These variables enable the script
to be more flexible, allowing easy modification of file paths and names for
future use.
Figure 12. Initialization of variables
Figure 13. Execution of payloads
Kasseika then transfers files from a network share to a local directory. The
utilization of the /E switch ensures the comprehensive copying of all
subdirectories, including empty ones. Following this, Martini.exe is executed to
terminate any processes associated with antivirus vendors. Subsequently, the
execution proceeds to launch smartscreen_protected.exe, which we identified as
the Kasseika ransomware binary. Finally, clear.bat is executed to erase any
traces of the operation on the machine.
Figure 14. The contents of “clear.bat” for final cleanup
Kasseika payload analysis
The Kasseika ransomware is a 32-bit Windows PE file packed by Themida.
Themida-packed binaries are known to have formidable code obfuscation and
anti-debugging techniques, making it hard to reverse-engineer them.
Figure 15. Kasseika ransomware packed with Themida
Before encryption, Kasseika terminates all processes and services that are
currently accessing Windows Restart Manager. Kasseika first starts a new
session, modifying the Owner value from the registry keys in the following list.
It then starts enumerating session hashes (SessionHash) of processes and
services from the registry keys in the same list. After termination, it
retrieves the paths of the terminated files that will be checked later for
encryption:
* HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session{numbers}
* Owner = {hex values}
*
* HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session{numbers}
* SessionHash = {hex values}
*
* HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session{numbers}
* Sequence = 0x01
*
* HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session{numbers}
* RegFiles{numbers} = {encrypted path and file}
*
* HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session{numbers}
* RegFilesHash = {hex values}
The Kasseika ransomware deletes the shadow copies of the affected system by
using Windows Management Instrumentation command-line (WMIC) queries to
enumerate them.
* SELECT * Win32_ShadowCopies
The Kasseika ransomware then decrypts its encrypted extension by first
retrieving a hard-coded string from CryptoPP::StringSinkTemplate. Next, it uses
Base64 to encode the first nine characters of the string. Finally, since the
characters “+”, “/”, and “=” in Base64 are not compatible in a file extension,
the ransomware replaces them with “a”, “l”, and “e”, respectively.
Figure 16. The Kasseika ransomware decrypting its file extension
Kasseika retrieves its encryption algorithm key, ChaCha20, together with the RSA
encryption algorithm from open-source C++ library CryptoPP. Kasseika then
generates a modified version of the ChaCha20 matrix that consists of randomly
generated bytes. The matrix is copied to a buffer that will be encrypted by the
RSA public key, after which the encrypted buffer is written into the modified
version of the ChaCha20 matrix. The Kasseika ransomware then uses the modified
ChaCha20 matrix to encrypt target files.
Figure 17. The function used by Kasseika to use ChaCha20 algorithm for file
encryption
After successful encryption, the Kasseika ransomware renames the encrypted files
by appending the following encrypted extension in the encrypted files:
* {original filename}.{original extension}. CBhwKBgQD
Figure 18. Sample encrypted files by the Kasseika ransomware
Afterward, Kasseika reuses the encrypted file extension as the name of its
ransom note, CBhwKBgQD.README.txt, which Kasseika will drop in every directory
that it will encrypt in the affected system.
Figure 19. A Kasseika ransom note
At the end of its encryption routine, the Kasseika ransomware changes the
wallpaper of the affected system, as shown in Figure 20.
Figure 20. Kasseika changes the wallpaper of the infected machine with its
ransom note
Clearing traces of the attack As Figure 21 shows, the Kasseika ransomware
also has the capability to wipe its traces by clearing the system’s event logs
through the execution of the commands.
Figure 21. The commands that Kasseika uses to clear the event logs
The command wevutil.exe efficiently clears the Application, Security, and System
event logs on the Windows system. This technique is used to operate discreetly,
making it more challenging for security tools to identify and respond to
malicious activities.
Security Recommendations
The following is a list of measures that organizations can employ as best
practices to minimize the chances of falling victim to ransomware attacks such
as those launched by the Kasseika ransomware:
* Only grant employees administrative rights and access when necessary.
*
* Ensure that security products are updated regularly and perform period
scans.
*
* Secure regular backups of critical data in case of any loss.
*
* Exercise good email and website safety practices — download attachments,
select URLs, and execute programs only from trusted sources.
*
* Encourage users to alert the security team of potentially suspicious emails
and files and use tools to block malicious emails.
*
* Conduct regular user education around the dangers and signals of social
engineering.
A multilayered approach can help organizations guard possible entry points into
their system (endpoint, email, web, and network). Security solutions can detect
malicious components and suspicious behavior, which can help protect
enterprises.
Trend Vision One™ provides multilayered protection and behavior detection, which
helps block questionable behavior and tools before ransomware can do any
damage.
Trend Cloud One™ – Workload Security protects systems against both known and
unknown threats that exploit vulnerabilities. This protection is made possible
through techniques such as virtual patching and machine learning.
Trend Micro™ Deep Discovery™ Email Inspector employs custom sandboxing and
advanced analysis techniques to effectively block malicious emails, including
phishing emails that can serve as entry points for ransomware.
Trend Micro Apex One™ offers next-level automated threat detection and response
against advanced concerns such as fileless threats and ransomware, ensuring the
protection of endpoints.
Indicators of compromise
The Kasseika ransomware indicators of compromise can be found here.
Tags
Articles, News, Reports | Ransomware | Research
AUTHORS
* Emmanuel Panopio
Threat Researcher
* Christian Jason Geollegue
Threat Response Engineer
* Julius Keith Estrellado
Cybersecurity Threat Engineer
* Christian Alpuerto
Threat Response Engineer
* Shawn Austin Santos
Threat Response Engineer
* Emmanuel Roll
Threat Response Engingeer
* Rhio Manaog
Threat Response Engineer
* Gerald Fernandez
Threat Response Engineer
* Don Ovid Ladores
Threats Analyst
* Raighen Sanchez
Threat Response Engineer
* Raymart Yambot
Threats Analyst
* Francesca Villasanta
Threats Analyst
* Sophia Nilette Robles
Threat Analyst
Contact Us
Subscribe
RELATED ARTICLES
* CVE-2023-36025 Exploited for Defense Evasion in Phemedrone Stealer Campaign
* 18X a Leader in Gartner Magic Quadrant for EPP
* Protecting Your Network Security from Ivanti Zero-Day Threat
See all articles
Try our services free for 30 days
* Start your free trial today
*
*
*
*
*
RESOURCES
* Blog
* Newsroom
* Threat Reports
* DevOps Resource Center
* CISO Resource Center
* Find a Partner
SUPPORT
* Business Support Portal
* Contact Us
* Downloads
* Free Trials
*
*
ABOUT TREND
* About Us
* Careers
* Locations
* Upcoming Events
* Trust Center
*
Select a country / region
United States expand_more
close
THE AMERICAS
* United States
* Brasil
* Canada
* México
MIDDLE EAST & AFRICA
* South Africa
* Middle East and North Africa
EUROPE
* België (Belgium)
* Česká Republika
* Danmark
* Deutschland, Österreich Schweiz
* España
* France
* Ireland
* Italia
* Nederland
* Norge (Norway)
* Polska (Poland)
* Suomi (Finland)
* Sverige (Sweden)
* Türkiye (Turkey)
* United Kingdom
ASIA & PACIFIC
* Australia
* Центральная Азия (Central Asia)
* Hong Kong (English)
* 香港 (中文) (Hong Kong)
* भारत गणराज्य (India)
* Indonesia
* 日本 (Japan)
* 대한민국 (South Korea)
* Malaysia
* Монголия (Mongolia) and рузия (Georgia)
* New Zealand
* Philippines
* Singapore
* 台灣 (Taiwan)
* ประเทศไทย (Thailand)
* Việt Nam
Privacy | Legal | Accessibility | Site map
Copyright ©2024 Trend Micro Incorporated. All rights reserved
sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk
This website uses cookies for website functionality, traffic analytics,
personalization, social media functionality and advertising. Our Cookie Notice
provides more information and explains how to amend your cookie settings.Learn
more
Cookies Settings Accept
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
Sumo