stormser | 478ffb4cd0fc31ada2cecb3ff4cd79bcc1afd286fbc91cfdfe8a00fab72759f5

General

Target
2026-09-24_1aa116a697e1550a9607ae225e5c8069_elex_wannacry.exe
Size 64KB
Sample260925-rexd2stwf1
SHA256 478ffb4cd0fc31ada2cecb3ff4cd79bcc1afd286fbc91cfdfe8a00fab72759f5
MD5 1aa116a697e1550a9607ae225e5c8069
SHA1 223c004f86ba772bf24d7a106f82df14c314a2d2
SHA512 9e37c0fd80eb1add04e66f11b2e314382587f6f736e637c9a7684bf64bc31d17a763866b2a6bbdc899cf98f1878083f897a7d2dd2eb4d6e1008c44f372e66f1e
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrof4/CFsrdn0A9lsy4:vvw9816vhKQLrof4/wQH9lsl
TLSH
T130535C834BEE9CF2F7920131046D8AB98277ADC4961EBEAF7F50CE55007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 6 IoCs

resource	yara_rule
behavioral1/files/0x000f000000024626-3.dat	family_stormser
behavioral1/files/0x0009000000024614-6.dat	family_stormser
behavioral1/files/0x000a0000000243aa-10.dat	family_stormser
behavioral1/files/0x000a0000000243ad-14.dat	family_stormser
behavioral1/files/0x000b0000000243aa-18.dat	family_stormser
behavioral1/files/0x000e0000000243de-22.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F919698D-3601-4f60-BDF7-F87296F779FA}\stubpath = "C:\\Windows\\{F919698D-3601-4f60-BDF7-F87296F779FA}.exe"	2026-09-24_1aa116a697e1550a9607ae225e5c8069_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0DDE4C54-E483-4093-B453-88BDD11381A5}	{F919698D-3601-4f60-BDF7-F87296F779FA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06917689-CA97-4056-8D87-646BB45C7F45}	{0DDE4C54-E483-4093-B453-88BDD11381A5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}	{06917689-CA97-4056-8D87-646BB45C7F45}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}\stubpath = "C:\\Windows\\{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}.exe"	{06917689-CA97-4056-8D87-646BB45C7F45}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{43205346-D04E-43f6-B4E0-9A3A1E4620A7}\stubpath = "C:\\Windows\\{43205346-D04E-43f6-B4E0-9A3A1E4620A7}.exe"	{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C56059D1-A6D7-4446-9474-C418D6CF51AB}	{43205346-D04E-43f6-B4E0-9A3A1E4620A7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0DDE4C54-E483-4093-B453-88BDD11381A5}\stubpath = "C:\\Windows\\{0DDE4C54-E483-4093-B453-88BDD11381A5}.exe"	{F919698D-3601-4f60-BDF7-F87296F779FA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06917689-CA97-4056-8D87-646BB45C7F45}\stubpath = "C:\\Windows\\{06917689-CA97-4056-8D87-646BB45C7F45}.exe"	{0DDE4C54-E483-4093-B453-88BDD11381A5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{43205346-D04E-43f6-B4E0-9A3A1E4620A7}	{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C56059D1-A6D7-4446-9474-C418D6CF51AB}\stubpath = "C:\\Windows\\{C56059D1-A6D7-4446-9474-C418D6CF51AB}.exe"	{43205346-D04E-43f6-B4E0-9A3A1E4620A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F919698D-3601-4f60-BDF7-F87296F779FA}	2026-09-24_1aa116a697e1550a9607ae225e5c8069_elex_wannacry.exe

Executes dropped EXE 6 IoCs

pid	Process
792	{F919698D-3601-4f60-BDF7-F87296F779FA}.exe
6064	{0DDE4C54-E483-4093-B453-88BDD11381A5}.exe
5032	{06917689-CA97-4056-8D87-646BB45C7F45}.exe
1552	{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}.exe
1116	{43205346-D04E-43f6-B4E0-9A3A1E4620A7}.exe
1876	{C56059D1-A6D7-4446-9474-C418D6CF51AB}.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\{F919698D-3601-4f60-BDF7-F87296F779FA}.exe	2026-09-24_1aa116a697e1550a9607ae225e5c8069_elex_wannacry.exe
File created	C:\Windows\{0DDE4C54-E483-4093-B453-88BDD11381A5}.exe	{F919698D-3601-4f60-BDF7-F87296F779FA}.exe
File created	C:\Windows\{06917689-CA97-4056-8D87-646BB45C7F45}.exe	{0DDE4C54-E483-4093-B453-88BDD11381A5}.exe
File created	C:\Windows\{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}.exe	{06917689-CA97-4056-8D87-646BB45C7F45}.exe
File created	C:\Windows\{43205346-D04E-43f6-B4E0-9A3A1E4620A7}.exe	{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}.exe
File created	C:\Windows\{C56059D1-A6D7-4446-9474-C418D6CF51AB}.exe	{43205346-D04E-43f6-B4E0-9A3A1E4620A7}.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2556	cmd.exe
5272	cmd.exe
3012	cmd.exe
1996	cmd.exe
5592	cmd.exe
3380	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{43205346-D04E-43f6-B4E0-9A3A1E4620A7}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0DDE4C54-E483-4093-B453-88BDD11381A5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{06917689-CA97-4056-8D87-646BB45C7F45}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C56059D1-A6D7-4446-9474-C418D6CF51AB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_1aa116a697e1550a9607ae225e5c8069_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F919698D-3601-4f60-BDF7-F87296F779FA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2352	2026-09-24_1aa116a697e1550a9607ae225e5c8069_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	792	{F919698D-3601-4f60-BDF7-F87296F779FA}.exe
Token: SeIncBasePriorityPrivilege	6064	{0DDE4C54-E483-4093-B453-88BDD11381A5}.exe
Token: SeIncBasePriorityPrivilege	5032	{06917689-CA97-4056-8D87-646BB45C7F45}.exe
Token: SeIncBasePriorityPrivilege	1552	{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}.exe
Token: SeIncBasePriorityPrivilege	1116	{43205346-D04E-43f6-B4E0-9A3A1E4620A7}.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 792	2352	2026-09-24_1aa116a697e1550a9607ae225e5c8069_elex_wannacry.exe	97
PID 2352 wrote to memory of 2556	2352	2026-09-24_1aa116a697e1550a9607ae225e5c8069_elex_wannacry.exe	98
PID 792 wrote to memory of 6064	792	{F919698D-3601-4f60-BDF7-F87296F779FA}.exe	99
PID 792 wrote to memory of 5272	792	{F919698D-3601-4f60-BDF7-F87296F779FA}.exe	100
PID 6064 wrote to memory of 5032	6064	{0DDE4C54-E483-4093-B453-88BDD11381A5}.exe	112
PID 6064 wrote to memory of 3012	6064	{0DDE4C54-E483-4093-B453-88BDD11381A5}.exe	113
PID 5032 wrote to memory of 1552	5032	{06917689-CA97-4056-8D87-646BB45C7F45}.exe	114
PID 5032 wrote to memory of 1996	5032	{06917689-CA97-4056-8D87-646BB45C7F45}.exe	115
PID 1552 wrote to memory of 1116	1552	{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}.exe	116
PID 1552 wrote to memory of 5592	1552	{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}.exe	117
PID 1116 wrote to memory of 1876	1116	{43205346-D04E-43f6-B4E0-9A3A1E4620A7}.exe	120
PID 1116 wrote to memory of 3380	1116	{43205346-D04E-43f6-B4E0-9A3A1E4620A7}.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-09-24_1aa116a697e1550a9607ae225e5c8069_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_1aa116a697e1550a9607ae225e5c8069_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\{F919698D-3601-4f60-BDF7-F87296F779FA}.exe
  C:\Windows\{F919698D-3601-4f60-BDF7-F87296F779FA}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\{0DDE4C54-E483-4093-B453-88BDD11381A5}.exe
    C:\Windows\{0DDE4C54-E483-4093-B453-88BDD11381A5}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6064
  - - C:\Windows\{06917689-CA97-4056-8D87-646BB45C7F45}.exe
      C:\Windows\{06917689-CA97-4056-8D87-646BB45C7F45}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\Windows\{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}.exe
        
        C:\Windows\{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1552
      - C:\Windows\{43205346-D04E-43f6-B4E0-9A3A1E4620A7}.exe
        
        C:\Windows\{43205346-D04E-43f6-B4E0-9A3A1E4620A7}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1116
        
        C:\Windows\{C56059D1-A6D7-4446-9474-C418D6CF51AB}.exe
        
        C:\Windows\{C56059D1-A6D7-4446-9474-C418D6CF51AB}.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{43205~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3380
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{36775~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5592
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{06917~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{0DDE4~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{F9196~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{06917689-CA97-4056-8D87-646BB45C7F45}.exe

Path C:\Windows\{06917689-CA97-4056-8D87-646BB45C7F45}.exe
Size 64KB
SHA256 d0db30357ecfada3d35fa82674d0eaef7f75406b8adacfee6f427cf34655ccfc
MD5 16e449e793cad5bd68bbb931a7893af7
SHA1 eb1329a7f061aa6c9b1a9e13df01893f6a07e0f8
SHA512 fb8805a69d3c90e2389716297ecf2a33115d0e5cf5e9588389d852a068506d3dd98eaf27937ab28b7e261b1573cce9929bfbf89f0974d810db199eb10c699ebd
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro+4/CFsrdn0A9lsy4:vvw9816vhKQLro+4/wQH9lsl
TLSH
T167535C834BEE98F2F7D21131046D8AB99277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{0DDE4C54-E483-4093-B453-88BDD11381A5}.exe

Path C:\Windows\{0DDE4C54-E483-4093-B453-88BDD11381A5}.exe
Size 64KB
SHA256 612b63aca69b938e687c7acf65cd4b6adb3d7194fbdb3b1dddc447d6163c334c
MD5 7c118c2074a7d86a073cb219ee42dd69
SHA1 2b76c9c8b2cbfb14f2776bc04b403e5a56a8c0da
SHA512 0b2205fd4e477ae3c1c574451b24cb8ce8f5769a3ce22e9307a65c89544facd87354afbc4c81e084f6d4f2aa97dc268f7b58e9307e441bc3eb3dbd6cbe528881
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroJ4/CFsrdn0A9lsy4:vvw9816vhKQLroJ4/wQH9lsl
TLSH
T16C536C834BEE98F2F7D20131046D8AB98277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}.exe

Path C:\Windows\{36775759-4C26-4cda-B3CA-F6B2BB8C92A9}.exe
Size 64KB
SHA256 9fc264bcd4489babcc53a13a7bb77de1be3c1eb62275c722179a9fce5e286d75
MD5 408b35a2d715485eeefe3f83635ed1d6
SHA1 af78209be7be24c011f15485c3e6ede1365bd21b
SHA512 993a2b3b45972cc6ab81cd455271c08aaa4b9168f317d213ce1599f2823af751fce714aacbaa141edc63020b245bb3e1fd166aa732f16bf5dbf892f223a135be
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroxL4/CFsrdn0A9lsy4:vvw9816vhKQLroxL4/wQH9lsl
TLSH
T1F4535C834BEE98F2F7D20131056D8AB98277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{43205346-D04E-43f6-B4E0-9A3A1E4620A7}.exe

Path C:\Windows\{43205346-D04E-43f6-B4E0-9A3A1E4620A7}.exe
Size 64KB
SHA256 baa4975376221ff1cbc33030243643c65d2eff97e0b00ff7b6a79279165e3d05
MD5 56c7807b94a9fc49dde4719671b5a3ea
SHA1 bfb1ae7f960ea9a91af9dae616771552716df147
SHA512 935157e861f477a42ab7d3c31ab7f327096767f4e27d3938171c037a5bd5a49c4cb00055e72a61dbeda41d5069c6b1fdb323f3801c17c4b98ab1b259d0dae3ea
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroy4/CFsrdn0A9lsy4:vvw9816vhKQLroy4/wQH9lsl
TLSH
T177535C834BEE98F2F7D20131046D8AB98277ADC4961EBEAF7F50CE54017B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{C56059D1-A6D7-4446-9474-C418D6CF51AB}.exe

Path C:\Windows\{C56059D1-A6D7-4446-9474-C418D6CF51AB}.exe
Size 64KB
SHA256 2b58b6625535ab2dbaea5bfa2760e6f77e5540276aebbbfe846cc242509c9222
MD5 70202c955a3c4c4f1b77d91c4b4eba62
SHA1 ebf402237c0ea6862ba4b9343e7fc54fb0555d66
SHA512 89a0ace2e429b76839e8da17a243cc85ba33b6dbba96f033d243a8d9500b089c7c2860e2a7d0b5ded0a1d70746baba3287c151f5414bc55c1d8d49c13f392919
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroN4/CFsrdn0A9lsy4:vvw9816vhKQLroN4/wQH9lsl
TLSH
T1A1535C834BEE9CF2F7921131046D8AB98277ADC4961EBEAF7F50CE54017B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F919698D-3601-4f60-BDF7-F87296F779FA}.exe

Path C:\Windows\{F919698D-3601-4f60-BDF7-F87296F779FA}.exe
Size 64KB
SHA256 8af46ca99d18214b827114084de2067cd50bec739c23762c6fc1b9687a5a10d7
MD5 8ea377629fc3e849c609a0a5f90573dc
SHA1 4a60376419b1e2e45e703a9b85817ee05a0c1a3b
SHA512 e86d570d79452d443a66eb081a5d6eeb4b91d24e1417ec38706c396f290aeb9a7e4d4a58c9f4a7600414105173e4cc239b5ea324429307afe3282c8d8ef6cfcd
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrod4/CFsrdn0A9lsy4:vvw9816vhKQLrod4/wQH9lsl
TLSH
T125535C834BEE98F2F7D21131046D8AB99277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads