File name:

2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader

Full analysis: https://app.any.run/tasks/21f744e2-1393-4572-8dbc-96e206920bd8
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 23:28:59
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
birele
neconyd
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections
MD5:

4F50A5B20FDFFEEB35FC1109235133F4

SHA1:

10020EF5C1D8E7328AE090B8E22257FED091C1DC

SHA256:

F8F0901533CB91AB49933D1B1CFEB4E92AF7278B7C3181BC527C3D87775A6DA4

SSDEEP:

3072:MR65qaR6CRp/5y03CwJ3/HxMqMdA33M5tC1isyPFCALzv4mlkVVXV9daj:MmqaRRRZ/MnA3cQYFCOzv3AVXVQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BIRELE has been detected (SURICATA)

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)

    • Connects to the CnC server

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)

    • Neconyd has been detected

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)

  • SUSPICIOUS

    • Application launched itself

      • 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 2088)
      • omsecor.exe (PID: 2904)
      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 6512)

    • Executable content was dropped or overwritten

      • 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 5892)

    • Reads security settings of Internet Explorer

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)

    • Executes application which crashes

      • 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 2088)
      • omsecor.exe (PID: 2904)
      • omsecor.exe (PID: 6512)

    • Contacting a server suspected of hosting an CnC

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)

  • INFO

    • Checks supported languages

      • 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 5892)
      • 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 2088)
      • omsecor.exe (PID: 2904)
      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 6512)
      • omsecor.exe (PID: 4068)

    • The sample compiled with english language support

      • 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 2088)

    • Creates files or folders in the user directory

      • 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 5892)
      • WerFault.exe (PID: 5244)
      • WerFault.exe (PID: 6656)
      • WerFault.exe (PID: 1568)

    • Reads the computer name

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)

    • Checks proxy server information

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)
      • slui.exe (PID: 4120)

    • Failed to create an executable file in Windows directory

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)

    • Reads the software policy settings

      • slui.exe (PID: 4120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:11:23 07:53:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit, No debug
PEType: PE32
LinkerVersion: 8
CodeSize: 28672
InitializedDataSize: 98304
UninitializedDataSize: -
EntryPoint: 0x18b6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Comments
FileVersion: 0, 1, 2, 0
InternalName: CompanyName
LegalCopyright: LegalTrademarks
OriginalFileName: Build private
ProductName: Movie name
ProductVersion: 0, 0, 0, 0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
11
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe omsecor.exe #BIRELE omsecor.exe werfault.exe no specs werfault.exe no specs slui.exe omsecor.exe #BIRELE omsecor.exe werfault.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1568C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6512 -s 340C:\Windows\SysWOW64\WerFault.exe—omsecor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2088"C:\Users\admin\Desktop\2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe" C:\Users\admin\Desktop\2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\desktop\2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2904C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4068C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
4120C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5244C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2904 -s 340C:\Windows\SysWOW64\WerFault.exe—omsecor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5544C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
0
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
5892C:\Users\admin\Desktop\2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exeC:\Users\admin\Desktop\2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe
2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
0
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\desktop\2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6512C:\Users\admin\AppData\Roaming\omsecor.exe /nomoveC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
9 217
Read events
9 211
Write events
6
Delete events
0

Modification events

(PID) Process:(5544) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5544) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5544) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4068) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4068) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4068) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
9
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
5244WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_4cb3671ac9785f4dfab4c56a1b5be62a59d442e_d5b94805_f866e74c-de76-475c-9827-20545d291449\Report.wer —
MD5:—
SHA256:—
6656WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2025-05-15_4f50a_4527e255a8256db7ae496cc309cb6759a7b055_b9259d34_59afb569-991d-4dd3-a6c4-e1f7b2f7bbdc\Report.wer —
MD5:—
SHA256:—
1568WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_4cb3671ac9785f4dfab4c56a1b5be62a59d442e_d5b94805_18cef03d-3bfb-42b8-be4d-c88136d2e8be\Report.wer —
MD5:—
SHA256:—
6656WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCA68.tmp.WERInternalMetadata.xmlbinary
MD5:F4DF8A6EFA38757E832223D1C61C5BE9
SHA256:10836D77A908639824C9A64EBB10C7273A1F1A84B5D7970DF11DBB73EBF9A2B1
6656WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC95D.tmp.dmpbinary
MD5:F148E9BE850AAFFCF74FE21E5E7625E1
SHA256:3DCAC06B545C17DFC8AAD5A4399AE4489F1F674F0E6FBE5BA03192FD746C8F6A
5244WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC9FA.tmp.WERInternalMetadata.xmlbinary
MD5:16D8933724823E889052CBD232580D9C
SHA256:1F8D946F1FC591A4970FA93B4E6A4C5760E057D16D2477FA0F14261567CF5753
6656WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCA88.tmp.xmlxml
MD5:15DF91ADEC62EFB075830262CC1EFFEA
SHA256:C9B89CC81B04B2748764FBEFFDC6E9BEA5312740EBA667437994F4D098BC6FBE
1568WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\omsecor.exe.6512.dmpbinary
MD5:B32943804E6EAC86E2EAEEE03CD75F0F
SHA256:1CDF60D82B1B090C27F2F8862C82BB340C6E956E00129162ACBAFFF031241F33
6656WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe.2088.dmpbinary
MD5:65CA755EDEF594D7D98FED4838D17608
SHA256:BB4B7D5CECFB992691601462CFFE7381FC6E294772DBC6AC1FF6737EDFF2D3F3
1568WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER213C.tmp.dmpbinary
MD5:E55FD8DD742A77FDCF1AFFBF3C56A670
SHA256:57031F26516BC6062DBDDF659CD74AA4E6F934E78378A2E72491C501FBA3C85B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
60
DNS requests
17
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5544
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/542/663.html
unknown
—
—
malicious
5544
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/3/731.html
unknown
—
—
malicious
2600
SIHClient.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5544
omsecor.exe
GET
403
75.2.18.233:80
http://mkkuei4kdsz.com/13/697.html
unknown
—
—
malicious
2600
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
2600
SIHClient.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
2600
SIHClient.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
2600
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2600
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
2600
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5544
omsecor.exe
193.166.255.171:80
lousta.net
Tieteen tietotekniikan keskus Oy
FI
malicious
2600
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2600
SIHClient.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5544
omsecor.exe
75.2.18.233:80
mkkuei4kdsz.com
AMAZON-02
US
malicious
2600
SIHClient.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
lousta.net
  • 193.166.255.171
malicious
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.28
  • 23.216.77.6
whitelisted
mkkuei4kdsz.com
  • 75.2.18.233
malicious
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
ow5dirasuek.com
  • 44.247.155.67
malicious

Threats

PID
Process
Class
Message
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
4068
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
4068
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader