File name:

2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader

Full analysis: https://app.any.run/tasks/e12b04d2-dd03-443b-a5ac-a11146420259
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 20:59:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
birele
neconyd
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections
MD5:

C7DB005FDF11953E20196FFF2EA7159E

SHA1:

224894DA94768A57B47295304583C9C087751EB6

SHA256:

0DED16BC2675B35641FFCF519E40C277FF71650F3081BBAEB1B3B13E665AB06B

SSDEEP:

3072:QR65qaR6CRp/5y03CwJ3/HxMqMdA33M5tC1isyPFCALzv4mlkVVXV9da4:QmqaRRRZ/MnA3cQYFCOzv3AVXVF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Neconyd has been detected

      • omsecor.exe (PID: 2108)
      • omsecor.exe (PID: 5392)

    • BIRELE has been detected (SURICATA)

      • omsecor.exe (PID: 2108)
      • omsecor.exe (PID: 5392)

    • Connects to the CnC server

      • omsecor.exe (PID: 2108)
      • omsecor.exe (PID: 5392)

  • SUSPICIOUS

    • Application launched itself

      • 2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 6040)
      • omsecor.exe (PID: 2616)
      • omsecor.exe (PID: 2108)
      • omsecor.exe (PID: 5304)

    • Executable content was dropped or overwritten

      • 2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 6988)

    • Reads security settings of Internet Explorer

      • omsecor.exe (PID: 2108)
      • omsecor.exe (PID: 5392)

    • Executes application which crashes

      • 2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 6040)
      • omsecor.exe (PID: 2616)
      • omsecor.exe (PID: 5304)

    • Contacting a server suspected of hosting an CnC

      • omsecor.exe (PID: 2108)
      • omsecor.exe (PID: 5392)

  • INFO

    • The sample compiled with english language support

      • 2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 6040)

    • Creates files or folders in the user directory

      • 2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 6988)
      • WerFault.exe (PID: 6272)
      • WerFault.exe (PID: 5512)
      • WerFault.exe (PID: 1512)

    • Checks supported languages

      • omsecor.exe (PID: 2616)
      • 2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 6040)
      • omsecor.exe (PID: 2108)
      • 2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 6988)
      • omsecor.exe (PID: 5304)
      • omsecor.exe (PID: 5392)

    • Reads the computer name

      • omsecor.exe (PID: 2108)
      • omsecor.exe (PID: 5392)

    • Checks proxy server information

      • omsecor.exe (PID: 2108)
      • omsecor.exe (PID: 5392)
      • slui.exe (PID: 4464)

    • Reads the software policy settings

      • slui.exe (PID: 4464)

    • Failed to create an executable file in Windows directory

      • omsecor.exe (PID: 2108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:11:23 08:01:29+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit, No debug
PEType: PE32
LinkerVersion: 8
CodeSize: 28672
InitializedDataSize: 98304
UninitializedDataSize: -
EntryPoint: 0x18b6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Comments
FileVersion: 0, 1, 2, 0
InternalName: CompanyName
LegalCopyright: LegalTrademarks
OriginalFileName: Build private
ProductName: Movie name
ProductVersion: 0, 0, 0, 0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
11
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exe 2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exe omsecor.exe #BIRELE omsecor.exe werfault.exe no specs werfault.exe no specs slui.exe omsecor.exe #BIRELE omsecor.exe werfault.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1512C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5304 -s 340C:\Windows\SysWOW64\WerFault.exe—omsecor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2108C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
0
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2616C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4464C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5304C:\Users\admin\AppData\Roaming\omsecor.exe /nomoveC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5392C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
5512C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2616 -s 340C:\Windows\SysWOW64\WerFault.exe—omsecor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6040"C:\Users\admin\Desktop\2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exe" C:\Users\admin\Desktop\2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\desktop\2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6272C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6040 -s 344C:\Windows\SysWOW64\WerFault.exe—2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
9 255
Read events
9 249
Write events
6
Delete events
0

Modification events

(PID) Process:(2108) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2108) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2108) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5392) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5392) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5392) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
9
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
5512WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_71b2232fcba6457e0eab53ac752208b84492_f18249c7_b59a40bf-fd1f-488d-b5a0-53a06c6d99b1\Report.wer —
MD5:—
SHA256:—
6272WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2025-05-17_c7db0_37f494d1274c26cc494daa8c6b7db82f78132a_78f36599_eeae68b9-b45c-4d48-8642-8a280bcbabbf\Report.wer —
MD5:—
SHA256:—
1512WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_71b2232fcba6457e0eab53ac752208b84492_f18249c7_2c798a55-0208-41a7-9711-c4decb173254\Report.wer —
MD5:—
SHA256:—
6272WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC4C9.tmp.dmpbinary
MD5:D496EBB68F882E0D40760FA0FE2C5DC4
SHA256:4BD1FF7762739AF37B919A292B360E10DA2A345994A122AA79B162F5F86A7C03
69882025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exeC:\Users\admin\AppData\Roaming\omsecor.exeexecutable
MD5:C6D0B698781E4306CFD2F914B983CCFF
SHA256:2D2CF118B97FBF2E8ED5809598BF6A41C0E79F320CE28862DF9A221760BB9B29
6272WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC566.tmp.WERInternalMetadata.xmlbinary
MD5:2D033BB2E40DA1B096AFBDA2BF0A7AFA
SHA256:B5570A3803ABBD1394A9E1DF09990E40F67F5C81091389C98A009603F7A90FB7
5512WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC556.tmp.WERInternalMetadata.xmlbinary
MD5:AE7142F1320E4E0585F7168DB8D6946F
SHA256:0F660E42DA87A0E43448D479E3154149139387CE5285B1C97EECCFCACDB7EB48
6272WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC5A5.tmp.xmlxml
MD5:8CD48838FB7ECAE3001B44D43B0DC219
SHA256:34AD8F26AB69A6A7E76C80C3B13495C42478EE766C0B3565D3343C3F49CBA5A0
6272WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader.exe.6040.dmpbinary
MD5:846C791408E56824BDECA747ACAC771F
SHA256:AB63515C12A50096F0BD864220E7D062697E073DEC0AE0399894FFCE7114A438
1512WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER8C7A.tmp.WERInternalMetadata.xmlbinary
MD5:2E30FDD48C44A523AEF020046D51E058
SHA256:1FB067BFD87E9EC37BDA572E1346B10219365E82C3432C72DC1FB0C7739C9393
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
60
DNS requests
21
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2108
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/715/442.html
unknown
—
—
malicious
2104
svchost.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2108
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/827/654.html
unknown
—
—
malicious
6640
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
2108
omsecor.exe
GET
403
75.2.18.233:80
http://mkkuei4kdsz.com/973/109.html
unknown
—
—
malicious
6640
SIHClient.exe
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
6640
SIHClient.exe
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
6640
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6640
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2108
omsecor.exe
193.166.255.171:80
lousta.net
Tieteen tietotekniikan keskus Oy
FI
malicious
2104
svchost.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
2104
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2108
omsecor.exe
75.2.18.233:80
mkkuei4kdsz.com
AMAZON-02
US
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
lousta.net
  • 193.166.255.171
malicious
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
  • 23.216.77.36
  • 23.216.77.21
  • 23.216.77.20
  • 23.216.77.22
  • 23.216.77.28
  • 23.216.77.27
  • 23.216.77.25
  • 23.216.77.23
  • 23.216.77.34
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.129
  • 40.126.31.3
  • 20.190.159.2
  • 20.190.159.73
  • 40.126.31.130
  • 40.126.31.71
  • 20.190.159.130
  • 20.190.159.128
whitelisted
mkkuei4kdsz.com
  • 75.2.18.233
malicious
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
2108
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
2108
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
2108
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
2108
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
2108
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
2108
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
2108
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
2108
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5392
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5392
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-17_c7db005fdf11953e20196fff2ea7159e_amadey_elex_rhadamanthys_smoke-loader