File name:

2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop

Full analysis: https://app.any.run/tasks/4facfa6d-8a6a-43f8-981a-27f7f11de91f
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 25, 2025, 18:37:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
neconyd
ransomware
birele
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections
MD5:

1301C6236BB903FAE12AD86C1BB6E1DA

SHA1:

8D50BF46B936BF358F153261005DC1BA8F431438

SHA256:

4C0176B7F47A761B1EAC1EFF5E2C2CA100B2C58B31E351FBC17BA819552EFDB0

SSDEEP:

3072:sR65qaR6CRp/5y03CwJ3/HxMqMdA33M5tC1isyPFCALzv4mlkVVXV9daF:smqaRRRZ/MnA3cQYFCOzv3AVXV+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • omsecor.exe (PID: 7440)
      • omsecor.exe (PID: 7980)

    • BIRELE has been detected (SURICATA)

      • omsecor.exe (PID: 7440)
      • omsecor.exe (PID: 7980)

    • Neconyd has been detected

      • omsecor.exe (PID: 7440)
      • omsecor.exe (PID: 7980)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 7336)

    • Application launched itself

      • 2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 7316)
      • omsecor.exe (PID: 7356)
      • omsecor.exe (PID: 7440)
      • omsecor.exe (PID: 7956)

    • Reads security settings of Internet Explorer

      • omsecor.exe (PID: 7440)
      • omsecor.exe (PID: 7980)

    • Executes application which crashes

      • 2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 7316)
      • omsecor.exe (PID: 7356)
      • omsecor.exe (PID: 7956)

    • Contacting a server suspected of hosting an CnC

      • omsecor.exe (PID: 7440)
      • omsecor.exe (PID: 7980)

  • INFO

    • Checks supported languages

      • 2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 7336)
      • 2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 7316)
      • omsecor.exe (PID: 7356)
      • omsecor.exe (PID: 7440)
      • omsecor.exe (PID: 7956)
      • omsecor.exe (PID: 7980)

    • The sample compiled with english language support

      • 2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 7316)
      • 2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 7336)

    • Creates files or folders in the user directory

      • 2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 7336)
      • WerFault.exe (PID: 7552)
      • WerFault.exe (PID: 7572)
      • WerFault.exe (PID: 8064)

    • Reads the computer name

      • omsecor.exe (PID: 7440)
      • omsecor.exe (PID: 7980)

    • Checks proxy server information

      • omsecor.exe (PID: 7440)
      • omsecor.exe (PID: 7980)
      • slui.exe (PID: 7900)

    • Failed to create an executable file in Windows directory

      • omsecor.exe (PID: 7440)

    • Reads the software policy settings

      • slui.exe (PID: 7900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:11:25 18:31:15+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit, No debug
PEType: PE32
LinkerVersion: 8
CodeSize: 28672
InitializedDataSize: 98304
UninitializedDataSize: -
EntryPoint: 0x18b6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Comments
FileVersion: 0, 1, 2, 0
InternalName: CompanyName
LegalCopyright: LegalTrademarks
OriginalFileName: Build private
ProductName: Movie name
ProductVersion: 0, 0, 0, 0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
11
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe 2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe omsecor.exe #BIRELE omsecor.exe werfault.exe no specs werfault.exe no specs slui.exe omsecor.exe #NECONYD omsecor.exe werfault.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
7316"C:\Users\admin\Desktop\2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe" C:\Users\admin\Desktop\2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\desktop\2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7336C:\Users\admin\Desktop\2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exeC:\Users\admin\Desktop\2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe
2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
0
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\desktop\2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
7356C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7440C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
0
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
7552C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7356 -s 340C:\Windows\SysWOW64\WerFault.exe—omsecor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7572C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7316 -s 340C:\Windows\SysWOW64\WerFault.exe—2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7900C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7956C:\Users\admin\AppData\Roaming\omsecor.exe /nomoveC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7980C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
Total events
9 217
Read events
9 211
Write events
6
Delete events
0

Modification events

(PID) Process:(7440) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7440) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7440) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7980) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7980) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7980) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
6
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
7572WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2025-05-25_1301c_11a058f78d10231899fb23daf3cc5de4b516c34c_4a55290e_b83b2740-50c2-4145-a344-817878b48226\Report.wer —
MD5:—
SHA256:—
7552WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_43e1763344face6bac75ab57fed118612f4a62_a39f442f_19060bd1-1987-4515-8f2e-78cf1ca08b70\Report.wer —
MD5:—
SHA256:—
8064WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_43e1763344face6bac75ab57fed118612f4a62_a39f442f_53bf28fe-34f9-4302-807f-a4fff3c73856\Report.wer —
MD5:—
SHA256:—
7572WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCBED.tmp.dmpbinary
MD5:D7F1BF918D6D00F6807CA0B616331FBD
SHA256:E82B6E47D3927DACFC2EBA5A940B126AF0B7C0C71A99D34FA56698404FE73DC5
7572WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCC9A.tmp.WERInternalMetadata.xmlxml
MD5:7DA608B7EF7C012E54CCA82B4CBBA2D5
SHA256:1EBAED9C69B73A42303046AB29DD7A9DCF94D1007AE902F14D6ABB6EF15046C1
7552WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCC5B.tmp.dmpbinary
MD5:DA2635703FC17491F1693E1CD060FB95
SHA256:D1F10284EDECC36B1A5F72D0431F9F09B8D15B3C2283092D96A6F008D1883101
73362025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exeC:\Users\admin\AppData\Roaming\omsecor.exeexecutable
MD5:C6BD88265C9C6E60DBCBCF4AECFC3ED0
SHA256:8B7B89F8721259A5D1C6D675788DAC3FD0CB0FFB5DB70911671F351B070D5A05
8064WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\omsecor.exe.7956.dmpbinary
MD5:58E3F7D7AAC11D85A5620B47FA2F607B
SHA256:60D813ACD626751231927C74AC0A67083C8400767CCAA863C801079FB592AA96
7572WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop.exe.7316.dmpbinary
MD5:E42220C43C530C29A5CDEC49CC7D91BA
SHA256:92DE55E3225131ED7411CF5E071756E7BEDD665C960F0B755D6E45CF8F9CABB3
7552WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCCCA.tmp.WERInternalMetadata.xmlxml
MD5:5414CCEF949376AA28B4569030F8F69F
SHA256:D46D9EEBDC1DEAB9EAB14814633F353FE15175D4FAAB2D48A08D37FD652BC7ED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
28
DNS requests
8
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7440
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/105/68.html
unknown
—
—
malicious
7440
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/329/801.html
unknown
—
—
malicious
7440
omsecor.exe
GET
200
44.247.155.67:80
http://ow5dirasuek.com/807/431.html
unknown
—
—
malicious
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
7440
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/401/988.html
unknown
—
—
malicious
7440
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/973/452.html
unknown
—
—
malicious
7440
omsecor.exe
GET
200
44.247.155.67:80
http://ow5dirasuek.com/421/311.html
unknown
—
—
malicious
7980
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/860/232.html
unknown
—
—
malicious
7980
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/22/153.html
unknown
—
—
malicious
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7440
omsecor.exe
193.166.255.171:80
lousta.net
Tieteen tietotekniikan keskus Oy
FI
malicious
7440
omsecor.exe
44.247.155.67:80
ow5dirasuek.com
AMAZON-02
US
malicious
4812
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7980
omsecor.exe
193.166.255.171:80
lousta.net
Tieteen tietotekniikan keskus Oy
FI
malicious
7900
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7980
omsecor.exe
44.247.155.67:80
ow5dirasuek.com
AMAZON-02
US
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.142
whitelisted
lousta.net
  • 193.166.255.171
malicious
mkkuei4kdsz.com
  • —
malicious
ow5dirasuek.com
  • 44.247.155.67
malicious
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
7440
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7440
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7440
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7440
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7440
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7440
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7980
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7980
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7980
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-25_1301c6236bb903fae12ad86c1bb6e1da_amadey_elex_rhadamanthys_smoke-loader_stop