File name:

2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader

Full analysis: https://app.any.run/tasks/21f744e2-1393-4572-8dbc-96e206920bd8
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 23:28:59
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
birele
neconyd
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections
MD5:

4F50A5B20FDFFEEB35FC1109235133F4

SHA1:

10020EF5C1D8E7328AE090B8E22257FED091C1DC

SHA256:

F8F0901533CB91AB49933D1B1CFEB4E92AF7278B7C3181BC527C3D87775A6DA4

SSDEEP:

3072:MR65qaR6CRp/5y03CwJ3/HxMqMdA33M5tC1isyPFCALzv4mlkVVXV9daj:MmqaRRRZ/MnA3cQYFCOzv3AVXVQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)

    • BIRELE has been detected (SURICATA)

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)

    • Neconyd has been detected

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)

    • Executes application which crashes

      • 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 2088)
      • omsecor.exe (PID: 2904)
      • omsecor.exe (PID: 6512)

    • Contacting a server suspected of hosting an CnC

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)

    • Application launched itself

      • 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 2088)
      • omsecor.exe (PID: 2904)
      • omsecor.exe (PID: 6512)
      • omsecor.exe (PID: 5544)

    • Executable content was dropped or overwritten

      • 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 5892)

  • INFO

    • Checks supported languages

      • 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 2088)
      • 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 5892)
      • omsecor.exe (PID: 2904)
      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)
      • omsecor.exe (PID: 6512)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 5244)
      • WerFault.exe (PID: 6656)
      • 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 5892)
      • WerFault.exe (PID: 1568)

    • Failed to create an executable file in Windows directory

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)

    • The sample compiled with english language support

      • 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 2088)

    • Checks proxy server information

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)
      • slui.exe (PID: 4120)

    • Reads the computer name

      • omsecor.exe (PID: 5544)
      • omsecor.exe (PID: 4068)

    • Reads the software policy settings

      • slui.exe (PID: 4120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:11:23 07:53:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit, No debug
PEType: PE32
LinkerVersion: 8
CodeSize: 28672
InitializedDataSize: 98304
UninitializedDataSize: -
EntryPoint: 0x18b6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Comments
FileVersion: 0, 1, 2, 0
InternalName: CompanyName
LegalCopyright: LegalTrademarks
OriginalFileName: Build private
ProductName: Movie name
ProductVersion: 0, 0, 0, 0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
11
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe 2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe omsecor.exe #BIRELE omsecor.exe werfault.exe no specs werfault.exe no specs slui.exe omsecor.exe #BIRELE omsecor.exe werfault.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1568C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6512 -s 340C:\Windows\SysWOW64\WerFault.exe—omsecor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2088"C:\Users\admin\Desktop\2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe" C:\Users\admin\Desktop\2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\desktop\2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2904C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4068C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
4120C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5244C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2904 -s 340C:\Windows\SysWOW64\WerFault.exe—omsecor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5544C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
0
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
5892C:\Users\admin\Desktop\2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exeC:\Users\admin\Desktop\2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe
2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
0
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\desktop\2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6512C:\Users\admin\AppData\Roaming\omsecor.exe /nomoveC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
9 217
Read events
9 211
Write events
6
Delete events
0

Modification events

(PID) Process:(5544) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5544) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5544) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4068) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4068) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4068) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
9
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
5244WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_4cb3671ac9785f4dfab4c56a1b5be62a59d442e_d5b94805_f866e74c-de76-475c-9827-20545d291449\Report.wer —
MD5:—
SHA256:—
6656WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2025-05-15_4f50a_4527e255a8256db7ae496cc309cb6759a7b055_b9259d34_59afb569-991d-4dd3-a6c4-e1f7b2f7bbdc\Report.wer —
MD5:—
SHA256:—
1568WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_4cb3671ac9785f4dfab4c56a1b5be62a59d442e_d5b94805_18cef03d-3bfb-42b8-be4d-c88136d2e8be\Report.wer —
MD5:—
SHA256:—
58922025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exeC:\Users\admin\AppData\Roaming\omsecor.exeexecutable
MD5:9550E2DB4D39699FF8C8ECEE22BEDA9A
SHA256:A6E11A12E40C3B87928F02316065AC4BEBBDEF7DB8004750EB242DAFEA92841E
6656WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC95D.tmp.dmpbinary
MD5:F148E9BE850AAFFCF74FE21E5E7625E1
SHA256:3DCAC06B545C17DFC8AAD5A4399AE4489F1F674F0E6FBE5BA03192FD746C8F6A
5244WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC93D.tmp.dmpbinary
MD5:91A967E446BDDFD2DDC6F059736E42BE
SHA256:64D4A1784891FEDBDBC9DA2ACCE700A652782D5A7FABE32565CFBB2072E2F29D
5244WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCA2A.tmp.xmlxml
MD5:04DA0DD80C97346CD7884E087C6B0327
SHA256:26852A5EA0A84FA1E34EB30A68FC900D48EDDE74988CCF82175DE0707580FA60
6656WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCA88.tmp.xmlxml
MD5:15DF91ADEC62EFB075830262CC1EFFEA
SHA256:C9B89CC81B04B2748764FBEFFDC6E9BEA5312740EBA667437994F4D098BC6FBE
6656WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader.exe.2088.dmpbinary
MD5:65CA755EDEF594D7D98FED4838D17608
SHA256:BB4B7D5CECFB992691601462CFFE7381FC6E294772DBC6AC1FF6737EDFF2D3F3
5244WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\omsecor.exe.2904.dmpbinary
MD5:5B618A5F737B0226F3CB5DEA1A7DB9C7
SHA256:DC7CC88AC86F587DD5817FF2EACC422BDDD44BC525B347CC6953CF991304BAE2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
60
DNS requests
17
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5544
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/542/663.html
unknown
—
—
malicious
5544
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/3/731.html
unknown
—
—
malicious
2600
SIHClient.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5544
omsecor.exe
GET
403
75.2.18.233:80
http://mkkuei4kdsz.com/13/697.html
unknown
—
—
malicious
2600
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
2600
SIHClient.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
2600
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2600
SIHClient.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
2600
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
2600
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5544
omsecor.exe
193.166.255.171:80
lousta.net
Tieteen tietotekniikan keskus Oy
FI
malicious
2600
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2600
SIHClient.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5544
omsecor.exe
75.2.18.233:80
mkkuei4kdsz.com
AMAZON-02
US
malicious
2600
SIHClient.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
lousta.net
  • 193.166.255.171
malicious
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.28
  • 23.216.77.6
whitelisted
mkkuei4kdsz.com
  • 75.2.18.233
malicious
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
ow5dirasuek.com
  • 44.247.155.67
malicious

Threats

PID
Process
Class
Message
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
5544
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
4068
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
4068
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-15_4f50a5b20fdffeeb35fc1109235133f4_amadey_elex_rhadamanthys_smoke-loader