Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-01-2025 14:26
Behavioral task
behavioral1
Sample
NOGHCV09800.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
NOGHCV09800.exe
Resource
win10v2004-20241007-en
General
-
Target
NOGHCV09800.exe
-
Size
1.4MB
-
MD5
52213367d8528d5da7e3ed356d80ddc3
-
SHA1
f99fa064f78f516f7b4e6a0167fc54a193cd642d
-
SHA256
17a545082a45c4c219bd09093349cb12cafef84e37a8dd989b6382a434b89544
-
SHA512
a1d4fadf5dbfb32bdc6939b12d0f11c09be991fb1a397d4bfe97db880baf0d8803103be5166993038b79b8ec3f03122c4e44703d7485a6b77bc97c17a777472e
-
SSDEEP
24576:CiUmSB/o5d1ubcvI9/0XhFXSQMJ/ZDfJvXnaPw9Qs287sKeXnusOag6hj3:C/mU/ohubcvIx0xFXtMr7JvXa4x28Knt
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs Milburr.exe -
Executes dropped EXE 64 IoCs
pid Process 2224 Milburr.exe 3044 Milburr.exe 3032 Milburr.exe 2860 Milburr.exe 2776 Milburr.exe 2596 Milburr.exe 2676 Milburr.exe 2924 Milburr.exe 2688 Milburr.exe 2452 Milburr.exe 1624 Milburr.exe 1708 Milburr.exe 2876 Milburr.exe 2888 Milburr.exe 3004 Milburr.exe 1228 Milburr.exe 1784 Milburr.exe 1440 Milburr.exe 2012 Milburr.exe 1172 Milburr.exe 584 Milburr.exe 3064 Milburr.exe 3060 Milburr.exe 2268 Milburr.exe 408 Milburr.exe 2260 Milburr.exe 1548 Milburr.exe 1928 Milburr.exe 1868 Milburr.exe 1352 Milburr.exe 2456 Milburr.exe 704 Milburr.exe 316 Milburr.exe 2528 Milburr.exe 1772 Milburr.exe 1724 Milburr.exe 1612 Milburr.exe 800 Milburr.exe 3024 Milburr.exe 1744 Milburr.exe 2444 Milburr.exe 2548 Milburr.exe 1600 Milburr.exe 1564 Milburr.exe 2732 Milburr.exe 2808 Milburr.exe 2800 Milburr.exe 2728 Milburr.exe 2764 Milburr.exe 2928 Milburr.exe 2740 Milburr.exe 2656 Milburr.exe 2716 Milburr.exe 2632 Milburr.exe 1996 Milburr.exe 2432 Milburr.exe 2956 Milburr.exe 560 Milburr.exe 2844 Milburr.exe 2788 Milburr.exe 2856 Milburr.exe 1984 Milburr.exe 1068 Milburr.exe 2960 Milburr.exe -
Loads dropped DLL 2 IoCs
pid Process 2784 NOGHCV09800.exe 2224 Milburr.exe -
AutoIT Executable 64 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2784-11-0x0000000001020000-0x0000000001307000-memory.dmp autoit_exe behavioral1/memory/2224-13-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2224-22-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/3044-31-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2860-38-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/3032-37-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2776-45-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2860-44-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2776-51-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2676-58-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2596-57-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2924-65-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2676-64-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2688-72-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2924-71-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2688-78-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1624-86-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2452-85-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1624-92-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2876-100-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1708-99-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2876-106-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/3004-113-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2888-112-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/3004-119-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1784-126-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1228-125-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1784-132-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2012-139-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1440-138-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1172-146-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2012-145-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/584-153-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1172-152-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/3064-160-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/584-159-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/3064-166-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/3060-172-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2268-173-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/408-180-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2268-179-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/408-186-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1548-193-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2260-192-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1548-199-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1928-205-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1352-212-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1868-211-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1352-218-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2456-219-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2456-222-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/704-225-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/316-228-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2528-231-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1772-234-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1724-237-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1612-240-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/800-243-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/3024-246-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1744-249-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2444-252-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/2548-255-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1600-258-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe behavioral1/memory/1564-261-0x0000000000290000-0x0000000000577000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/2784-0-0x0000000001020000-0x0000000001307000-memory.dmp upx behavioral1/files/0x0007000000016d4a-5.dat upx behavioral1/memory/2784-11-0x0000000001020000-0x0000000001307000-memory.dmp upx behavioral1/memory/2224-13-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/3044-23-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2224-22-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/3044-31-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/3032-30-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2860-38-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/3032-37-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2776-45-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2860-44-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2776-51-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2676-58-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2596-57-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2924-65-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2676-64-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2688-72-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2924-71-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2452-79-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2688-78-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1624-86-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2452-85-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1624-92-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1708-93-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2876-100-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1708-99-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2876-106-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/3004-113-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2888-112-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/3004-119-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1784-126-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1228-125-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1784-132-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2012-139-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1440-138-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1172-146-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2012-145-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/584-153-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1172-152-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/3064-160-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/584-159-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/3064-166-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/3060-172-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2268-173-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/408-180-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2268-179-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/408-186-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1548-193-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2260-192-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1548-199-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1928-205-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1352-212-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1868-211-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1352-218-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2456-219-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2456-222-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/704-225-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/316-228-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/2528-231-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1772-234-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1724-237-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/1612-240-0x0000000000290000-0x0000000000577000-memory.dmp upx behavioral1/memory/800-243-0x0000000000290000-0x0000000000577000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2784 NOGHCV09800.exe 2784 NOGHCV09800.exe 2224 Milburr.exe 2224 Milburr.exe 3044 Milburr.exe 3044 Milburr.exe 3032 Milburr.exe 3032 Milburr.exe 2860 Milburr.exe 2860 Milburr.exe 2776 Milburr.exe 2776 Milburr.exe 2596 Milburr.exe 2596 Milburr.exe 2676 Milburr.exe 2676 Milburr.exe 2924 Milburr.exe 2924 Milburr.exe 2688 Milburr.exe 2688 Milburr.exe 2452 Milburr.exe 2452 Milburr.exe 1624 Milburr.exe 1624 Milburr.exe 1708 Milburr.exe 1708 Milburr.exe 2876 Milburr.exe 2876 Milburr.exe 2888 Milburr.exe 2888 Milburr.exe 3004 Milburr.exe 3004 Milburr.exe 1228 Milburr.exe 1228 Milburr.exe 1784 Milburr.exe 1784 Milburr.exe 1440 Milburr.exe 1440 Milburr.exe 2012 Milburr.exe 2012 Milburr.exe 1172 Milburr.exe 1172 Milburr.exe 584 Milburr.exe 584 Milburr.exe 3064 Milburr.exe 3064 Milburr.exe 3060 Milburr.exe 3060 Milburr.exe 2268 Milburr.exe 2268 Milburr.exe 408 Milburr.exe 408 Milburr.exe 2260 Milburr.exe 2260 Milburr.exe 1548 Milburr.exe 1548 Milburr.exe 1928 Milburr.exe 1928 Milburr.exe 1868 Milburr.exe 1868 Milburr.exe 1352 Milburr.exe 1352 Milburr.exe 2456 Milburr.exe 2456 Milburr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2784 NOGHCV09800.exe 2784 NOGHCV09800.exe 2224 Milburr.exe 2224 Milburr.exe 3044 Milburr.exe 3044 Milburr.exe 3032 Milburr.exe 3032 Milburr.exe 2860 Milburr.exe 2860 Milburr.exe 2776 Milburr.exe 2776 Milburr.exe 2596 Milburr.exe 2596 Milburr.exe 2676 Milburr.exe 2676 Milburr.exe 2924 Milburr.exe 2924 Milburr.exe 2688 Milburr.exe 2688 Milburr.exe 2452 Milburr.exe 2452 Milburr.exe 1624 Milburr.exe 1624 Milburr.exe 1708 Milburr.exe 1708 Milburr.exe 2876 Milburr.exe 2876 Milburr.exe 2888 Milburr.exe 2888 Milburr.exe 3004 Milburr.exe 3004 Milburr.exe 1228 Milburr.exe 1228 Milburr.exe 1784 Milburr.exe 1784 Milburr.exe 1440 Milburr.exe 1440 Milburr.exe 2012 Milburr.exe 2012 Milburr.exe 1172 Milburr.exe 1172 Milburr.exe 584 Milburr.exe 584 Milburr.exe 3064 Milburr.exe 3064 Milburr.exe 3060 Milburr.exe 3060 Milburr.exe 2268 Milburr.exe 2268 Milburr.exe 408 Milburr.exe 408 Milburr.exe 2260 Milburr.exe 2260 Milburr.exe 1548 Milburr.exe 1548 Milburr.exe 1928 Milburr.exe 1928 Milburr.exe 1868 Milburr.exe 1868 Milburr.exe 1352 Milburr.exe 1352 Milburr.exe 2456 Milburr.exe 2456 Milburr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2224 2784 NOGHCV09800.exe 30 PID 2784 wrote to memory of 2224 2784 NOGHCV09800.exe 30 PID 2784 wrote to memory of 2224 2784 NOGHCV09800.exe 30 PID 2784 wrote to memory of 2224 2784 NOGHCV09800.exe 30 PID 2224 wrote to memory of 3044 2224 Milburr.exe 31 PID 2224 wrote to memory of 3044 2224 Milburr.exe 31 PID 2224 wrote to memory of 3044 2224 Milburr.exe 31 PID 2224 wrote to memory of 3044 2224 Milburr.exe 31 PID 3044 wrote to memory of 3032 3044 Milburr.exe 32 PID 3044 wrote to memory of 3032 3044 Milburr.exe 32 PID 3044 wrote to memory of 3032 3044 Milburr.exe 32 PID 3044 wrote to memory of 3032 3044 Milburr.exe 32 PID 3032 wrote to memory of 2860 3032 Milburr.exe 33 PID 3032 wrote to memory of 2860 3032 Milburr.exe 33 PID 3032 wrote to memory of 2860 3032 Milburr.exe 33 PID 3032 wrote to memory of 2860 3032 Milburr.exe 33 PID 2860 wrote to memory of 2776 2860 Milburr.exe 34 PID 2860 wrote to memory of 2776 2860 Milburr.exe 34 PID 2860 wrote to memory of 2776 2860 Milburr.exe 34 PID 2860 wrote to memory of 2776 2860 Milburr.exe 34 PID 2776 wrote to memory of 2596 2776 Milburr.exe 35 PID 2776 wrote to memory of 2596 2776 Milburr.exe 35 PID 2776 wrote to memory of 2596 2776 Milburr.exe 35 PID 2776 wrote to memory of 2596 2776 Milburr.exe 35 PID 2596 wrote to memory of 2676 2596 Milburr.exe 36 PID 2596 wrote to memory of 2676 2596 Milburr.exe 36 PID 2596 wrote to memory of 2676 2596 Milburr.exe 36 PID 2596 wrote to memory of 2676 2596 Milburr.exe 36 PID 2676 wrote to memory of 2924 2676 Milburr.exe 37 PID 2676 wrote to memory of 2924 2676 Milburr.exe 37 PID 2676 wrote to memory of 2924 2676 Milburr.exe 37 PID 2676 wrote to memory of 2924 2676 Milburr.exe 37 PID 2924 wrote to memory of 2688 2924 Milburr.exe 38 PID 2924 wrote to memory of 2688 2924 Milburr.exe 38 PID 2924 wrote to memory of 2688 2924 Milburr.exe 38 PID 2924 wrote to memory of 2688 2924 Milburr.exe 38 PID 2688 wrote to memory of 2452 2688 Milburr.exe 39 PID 2688 wrote to memory of 2452 2688 Milburr.exe 39 PID 2688 wrote to memory of 2452 2688 Milburr.exe 39 PID 2688 wrote to memory of 2452 2688 Milburr.exe 39 PID 2452 wrote to memory of 1624 2452 Milburr.exe 40 PID 2452 wrote to memory of 1624 2452 Milburr.exe 40 PID 2452 wrote to memory of 1624 2452 Milburr.exe 40 PID 2452 wrote to memory of 1624 2452 Milburr.exe 40 PID 1624 wrote to memory of 1708 1624 Milburr.exe 41 PID 1624 wrote to memory of 1708 1624 Milburr.exe 41 PID 1624 wrote to memory of 1708 1624 Milburr.exe 41 PID 1624 wrote to memory of 1708 1624 Milburr.exe 41 PID 1708 wrote to memory of 2876 1708 Milburr.exe 42 PID 1708 wrote to memory of 2876 1708 Milburr.exe 42 PID 1708 wrote to memory of 2876 1708 Milburr.exe 42 PID 1708 wrote to memory of 2876 1708 Milburr.exe 42 PID 2876 wrote to memory of 2888 2876 Milburr.exe 43 PID 2876 wrote to memory of 2888 2876 Milburr.exe 43 PID 2876 wrote to memory of 2888 2876 Milburr.exe 43 PID 2876 wrote to memory of 2888 2876 Milburr.exe 43 PID 2888 wrote to memory of 3004 2888 Milburr.exe 44 PID 2888 wrote to memory of 3004 2888 Milburr.exe 44 PID 2888 wrote to memory of 3004 2888 Milburr.exe 44 PID 2888 wrote to memory of 3004 2888 Milburr.exe 44 PID 3004 wrote to memory of 1228 3004 Milburr.exe 45 PID 3004 wrote to memory of 1228 3004 Milburr.exe 45 PID 3004 wrote to memory of 1228 3004 Milburr.exe 45 PID 3004 wrote to memory of 1228 3004 Milburr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOGHCV09800.exe"C:\Users\Admin\AppData\Local\Temp\NOGHCV09800.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\Temp\NOGHCV09800.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"6⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"7⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"8⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"9⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"11⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"13⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"15⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"16⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1228 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"18⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1784 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"19⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1440 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"20⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2012 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"21⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1172 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"22⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:584 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"23⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3064 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"24⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3060 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2268 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:408 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"27⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2260 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"28⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1548 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"29⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1928 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"30⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1868 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"31⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1352 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"32⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2456 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"33⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:316 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"35⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"36⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"37⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"38⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"39⤵
- Executes dropped EXE
PID:800 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"40⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"41⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"42⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2548 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"44⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1564 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"46⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"47⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"48⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"49⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"50⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"51⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"52⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"53⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2716 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1996 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:560 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2844 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2788 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"62⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1984 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1068 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"65⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"66⤵PID:680
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"67⤵PID:2984
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"68⤵PID:396
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"69⤵
- System Location Discovery: System Language Discovery
PID:1940 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"70⤵
- System Location Discovery: System Language Discovery
PID:1448 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"71⤵
- System Location Discovery: System Language Discovery
PID:1916 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"72⤵
- System Location Discovery: System Language Discovery
PID:592 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"73⤵PID:1480
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"74⤵
- System Location Discovery: System Language Discovery
PID:2296 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"75⤵PID:1244
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"76⤵PID:2476
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"77⤵PID:3048
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"78⤵PID:992
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"79⤵PID:1256
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"80⤵PID:2436
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"81⤵PID:2204
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"82⤵
- System Location Discovery: System Language Discovery
PID:1364 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"83⤵PID:2360
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"84⤵
- System Location Discovery: System Language Discovery
PID:1676 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"85⤵
- System Location Discovery: System Language Discovery
PID:1540 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"86⤵PID:1544
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"87⤵PID:836
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"88⤵PID:1632
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"89⤵PID:1712
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"90⤵PID:2356
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"91⤵
- System Location Discovery: System Language Discovery
PID:2440 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"92⤵PID:2080
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"93⤵PID:1668
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"94⤵PID:1644
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"95⤵PID:1728
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"96⤵PID:2088
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"97⤵PID:2748
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"98⤵PID:2200
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"99⤵PID:3036
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"100⤵PID:2944
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"101⤵PID:2640
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"102⤵PID:2604
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"103⤵
- System Location Discovery: System Language Discovery
PID:2332 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"104⤵
- System Location Discovery: System Language Discovery
PID:1808 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"105⤵PID:2252
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"106⤵PID:1496
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"107⤵
- System Location Discovery: System Language Discovery
PID:2104 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"108⤵PID:2092
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"109⤵PID:764
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"110⤵
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"111⤵
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"112⤵PID:2172
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"113⤵PID:492
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"114⤵PID:1764
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"115⤵PID:1156
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"116⤵PID:2512
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"117⤵PID:2460
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"118⤵PID:2580
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"119⤵
- System Location Discovery: System Language Discovery
PID:1416 -
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"120⤵PID:328
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"121⤵PID:1932
-
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"C:\Users\Admin\AppData\Local\tilthead\Milburr.exe"122⤵PID:988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-