Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-01-2025 14:40
Behavioral task
behavioral1
Sample
c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe
Resource
win10v2004-20241007-en
General
-
Target
c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe
-
Size
900KB
-
MD5
be20dfffcba37064d6087aa714036873
-
SHA1
4f50f7f954ed27b8e3373a5d900905d98d1bb51e
-
SHA256
c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0
-
SHA512
955a14d104edf528cd3d1f140181e6222cc1f88c8f1fb0a6a60fa0d37962b34c535a29e45ba029cf8daa039df06d25b26689feb600fb8b499fe46de0b3bf4696
-
SSDEEP
24576:0rl6kD68JmlotQf1nQr8zKS7ifTcvt2S3Sc1YNTN:Cl328U2yfuo2hfwvtJCxT
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs Milburr.exe -
Executes dropped EXE 64 IoCs
pid Process 2160 Milburr.exe 2812 Milburr.exe 2912 Milburr.exe 2772 Milburr.exe 2676 Milburr.exe 1288 Milburr.exe 2904 Milburr.exe 2896 Milburr.exe 2856 Milburr.exe 1624 Milburr.exe 1324 Milburr.exe 2484 Milburr.exe 1552 Milburr.exe 2040 Milburr.exe 1332 Milburr.exe 288 Milburr.exe 1268 Milburr.exe 1964 Milburr.exe 1716 Milburr.exe 2316 Milburr.exe 2380 Milburr.exe 2836 Milburr.exe 2960 Milburr.exe 2620 Milburr.exe 2320 Milburr.exe 1920 Milburr.exe 600 Milburr.exe 2692 Milburr.exe 2704 Milburr.exe 2176 Milburr.exe 2372 Milburr.exe 408 Milburr.exe 628 Milburr.exe 2968 Milburr.exe 1540 Milburr.exe 1064 Milburr.exe 568 Milburr.exe 2564 Milburr.exe 1080 Milburr.exe 1736 Milburr.exe 1304 Milburr.exe 2824 Milburr.exe 2136 Milburr.exe 2652 Milburr.exe 1480 Milburr.exe 1860 Milburr.exe 1148 Milburr.exe 2920 Milburr.exe 236 Milburr.exe 1572 Milburr.exe 1244 Milburr.exe 972 Milburr.exe 1916 Milburr.exe 2460 Milburr.exe 2068 Milburr.exe 2468 Milburr.exe 2028 Milburr.exe 1720 Milburr.exe 1604 Milburr.exe 2324 Milburr.exe 2764 Milburr.exe 2640 Milburr.exe 2636 Milburr.exe 1804 Milburr.exe -
Loads dropped DLL 1 IoCs
pid Process 2520 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe -
AutoIT Executable 64 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2160-19-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2520-17-0x0000000001120000-0x000000000130E000-memory.dmp autoit_exe behavioral1/memory/2160-38-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2812-56-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2912-72-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2772-73-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2772-89-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2520-107-0x0000000001120000-0x000000000130E000-memory.dmp autoit_exe behavioral1/memory/2676-106-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1288-108-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1288-124-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2904-140-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2896-156-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2856-173-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1624-174-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1324-191-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1624-190-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1324-207-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2484-208-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2484-224-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1552-241-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2040-257-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1332-271-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/288-288-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1268-305-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1964-306-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1964-322-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1716-323-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1716-339-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2316-355-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2380-370-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2836-371-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2836-384-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2960-398-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2620-399-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2620-411-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2320-424-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1920-437-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/600-451-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2692-452-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2692-465-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2704-478-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2176-492-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2372-493-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2372-505-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/408-518-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/628-531-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2968-532-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2968-545-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1540-559-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1064-573-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/568-574-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/568-587-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2564-600-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1080-613-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1736-614-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1736-627-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1304-628-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1304-640-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2824-653-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2136-654-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2136-667-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/2652-680-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe behavioral1/memory/1480-681-0x0000000000050000-0x000000000023E000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/2520-0-0x0000000001120000-0x000000000130E000-memory.dmp upx behavioral1/files/0x0008000000015e48-14.dat upx behavioral1/memory/2160-19-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2520-17-0x0000000001120000-0x000000000130E000-memory.dmp upx behavioral1/memory/2160-38-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2812-39-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2812-56-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2912-72-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2772-73-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2772-89-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2676-90-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2520-107-0x0000000001120000-0x000000000130E000-memory.dmp upx behavioral1/memory/2676-106-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1288-108-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1288-124-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2904-125-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2904-140-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2896-156-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2856-157-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2856-173-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1624-174-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1324-191-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1624-190-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1324-207-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2484-208-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2484-224-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1552-225-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1552-241-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2040-257-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1332-271-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1268-289-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/288-288-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1268-305-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1964-306-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1964-322-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1716-323-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1716-339-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2316-355-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2380-356-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2380-370-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2836-371-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2960-385-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2836-384-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2960-398-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2620-399-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2620-411-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2320-424-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/600-438-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1920-437-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/600-451-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2692-452-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2692-465-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2704-478-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2176-479-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2176-492-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2372-493-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2372-505-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/408-518-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/628-531-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2968-532-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1540-546-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/2968-545-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1540-559-0x0000000000050000-0x000000000023E000-memory.dmp upx behavioral1/memory/1064-560-0x0000000000050000-0x000000000023E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2520 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 2520 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 2160 Milburr.exe 2160 Milburr.exe 2812 Milburr.exe 2812 Milburr.exe 2912 Milburr.exe 2912 Milburr.exe 2772 Milburr.exe 2772 Milburr.exe 2676 Milburr.exe 2676 Milburr.exe 1288 Milburr.exe 1288 Milburr.exe 2904 Milburr.exe 2904 Milburr.exe 2896 Milburr.exe 2896 Milburr.exe 2856 Milburr.exe 2856 Milburr.exe 1624 Milburr.exe 1624 Milburr.exe 1324 Milburr.exe 1324 Milburr.exe 2484 Milburr.exe 2484 Milburr.exe 1552 Milburr.exe 1552 Milburr.exe 2040 Milburr.exe 2040 Milburr.exe 1332 Milburr.exe 1332 Milburr.exe 288 Milburr.exe 288 Milburr.exe 1268 Milburr.exe 1268 Milburr.exe 1964 Milburr.exe 1964 Milburr.exe 1716 Milburr.exe 1716 Milburr.exe 2316 Milburr.exe 2316 Milburr.exe 2380 Milburr.exe 2380 Milburr.exe 2836 Milburr.exe 2836 Milburr.exe 2960 Milburr.exe 2960 Milburr.exe 2620 Milburr.exe 2620 Milburr.exe 2320 Milburr.exe 2320 Milburr.exe 1920 Milburr.exe 1920 Milburr.exe 600 Milburr.exe 600 Milburr.exe 2692 Milburr.exe 2692 Milburr.exe 2704 Milburr.exe 2704 Milburr.exe 2176 Milburr.exe 2176 Milburr.exe 2372 Milburr.exe 2372 Milburr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2520 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 2520 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 2160 Milburr.exe 2160 Milburr.exe 2812 Milburr.exe 2812 Milburr.exe 2912 Milburr.exe 2912 Milburr.exe 2772 Milburr.exe 2772 Milburr.exe 2676 Milburr.exe 2676 Milburr.exe 1288 Milburr.exe 1288 Milburr.exe 2904 Milburr.exe 2904 Milburr.exe 2896 Milburr.exe 2896 Milburr.exe 2856 Milburr.exe 2856 Milburr.exe 1624 Milburr.exe 1624 Milburr.exe 1324 Milburr.exe 1324 Milburr.exe 2484 Milburr.exe 2484 Milburr.exe 1552 Milburr.exe 1552 Milburr.exe 2040 Milburr.exe 2040 Milburr.exe 1332 Milburr.exe 1332 Milburr.exe 288 Milburr.exe 288 Milburr.exe 1268 Milburr.exe 1268 Milburr.exe 1964 Milburr.exe 1964 Milburr.exe 1716 Milburr.exe 1716 Milburr.exe 2316 Milburr.exe 2316 Milburr.exe 2380 Milburr.exe 2380 Milburr.exe 2836 Milburr.exe 2836 Milburr.exe 2960 Milburr.exe 2960 Milburr.exe 2620 Milburr.exe 2620 Milburr.exe 2320 Milburr.exe 2320 Milburr.exe 1920 Milburr.exe 1920 Milburr.exe 600 Milburr.exe 600 Milburr.exe 2692 Milburr.exe 2692 Milburr.exe 2704 Milburr.exe 2704 Milburr.exe 2176 Milburr.exe 2176 Milburr.exe 2372 Milburr.exe 2372 Milburr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2160 2520 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 30 PID 2520 wrote to memory of 2160 2520 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 30 PID 2520 wrote to memory of 2160 2520 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 30 PID 2520 wrote to memory of 2160 2520 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 30 PID 2160 wrote to memory of 2812 2160 Milburr.exe 31 PID 2160 wrote to memory of 2812 2160 Milburr.exe 31 PID 2160 wrote to memory of 2812 2160 Milburr.exe 31 PID 2160 wrote to memory of 2812 2160 Milburr.exe 31 PID 2812 wrote to memory of 2912 2812 Milburr.exe 32 PID 2812 wrote to memory of 2912 2812 Milburr.exe 32 PID 2812 wrote to memory of 2912 2812 Milburr.exe 32 PID 2812 wrote to memory of 2912 2812 Milburr.exe 32 PID 2912 wrote to memory of 2772 2912 Milburr.exe 33 PID 2912 wrote to memory of 2772 2912 Milburr.exe 33 PID 2912 wrote to memory of 2772 2912 Milburr.exe 33 PID 2912 wrote to memory of 2772 2912 Milburr.exe 33 PID 2772 wrote to memory of 2676 2772 Milburr.exe 34 PID 2772 wrote to memory of 2676 2772 Milburr.exe 34 PID 2772 wrote to memory of 2676 2772 Milburr.exe 34 PID 2772 wrote to memory of 2676 2772 Milburr.exe 34 PID 2676 wrote to memory of 1288 2676 Milburr.exe 35 PID 2676 wrote to memory of 1288 2676 Milburr.exe 35 PID 2676 wrote to memory of 1288 2676 Milburr.exe 35 PID 2676 wrote to memory of 1288 2676 Milburr.exe 35 PID 1288 wrote to memory of 2904 1288 Milburr.exe 36 PID 1288 wrote to memory of 2904 1288 Milburr.exe 36 PID 1288 wrote to memory of 2904 1288 Milburr.exe 36 PID 1288 wrote to memory of 2904 1288 Milburr.exe 36 PID 2904 wrote to memory of 2896 2904 Milburr.exe 37 PID 2904 wrote to memory of 2896 2904 Milburr.exe 37 PID 2904 wrote to memory of 2896 2904 Milburr.exe 37 PID 2904 wrote to memory of 2896 2904 Milburr.exe 37 PID 2896 wrote to memory of 2856 2896 Milburr.exe 38 PID 2896 wrote to memory of 2856 2896 Milburr.exe 38 PID 2896 wrote to memory of 2856 2896 Milburr.exe 38 PID 2896 wrote to memory of 2856 2896 Milburr.exe 38 PID 2856 wrote to memory of 1624 2856 Milburr.exe 39 PID 2856 wrote to memory of 1624 2856 Milburr.exe 39 PID 2856 wrote to memory of 1624 2856 Milburr.exe 39 PID 2856 wrote to memory of 1624 2856 Milburr.exe 39 PID 1624 wrote to memory of 1324 1624 Milburr.exe 40 PID 1624 wrote to memory of 1324 1624 Milburr.exe 40 PID 1624 wrote to memory of 1324 1624 Milburr.exe 40 PID 1624 wrote to memory of 1324 1624 Milburr.exe 40 PID 1324 wrote to memory of 2484 1324 Milburr.exe 41 PID 1324 wrote to memory of 2484 1324 Milburr.exe 41 PID 1324 wrote to memory of 2484 1324 Milburr.exe 41 PID 1324 wrote to memory of 2484 1324 Milburr.exe 41 PID 2484 wrote to memory of 1552 2484 Milburr.exe 42 PID 2484 wrote to memory of 1552 2484 Milburr.exe 42 PID 2484 wrote to memory of 1552 2484 Milburr.exe 42 PID 2484 wrote to memory of 1552 2484 Milburr.exe 42 PID 1552 wrote to memory of 2040 1552 Milburr.exe 43 PID 1552 wrote to memory of 2040 1552 Milburr.exe 43 PID 1552 wrote to memory of 2040 1552 Milburr.exe 43 PID 1552 wrote to memory of 2040 1552 Milburr.exe 43 PID 2040 wrote to memory of 1332 2040 Milburr.exe 45 PID 2040 wrote to memory of 1332 2040 Milburr.exe 45 PID 2040 wrote to memory of 1332 2040 Milburr.exe 45 PID 2040 wrote to memory of 1332 2040 Milburr.exe 45 PID 1332 wrote to memory of 288 1332 Milburr.exe 46 PID 1332 wrote to memory of 288 1332 Milburr.exe 46 PID 1332 wrote to memory of 288 1332 Milburr.exe 46 PID 1332 wrote to memory of 288 1332 Milburr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe"C:\Users\Admin\AppData\Local\Temp\c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\Temp\c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"6⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"8⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"9⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"10⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"11⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"13⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"15⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"16⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"17⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:288 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"18⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1268 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1964 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"20⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1716 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"21⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2316 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"22⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2380 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2836 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2960 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"25⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2620 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"26⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2320 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1920 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"28⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:600 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"29⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2692 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"30⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2704 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2176 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"32⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2372 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:408 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"34⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2968 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"36⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"37⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"38⤵
- Executes dropped EXE
PID:568 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"39⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"40⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"41⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"42⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"43⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"44⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"45⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1480 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"47⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"48⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"49⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"50⤵
- Executes dropped EXE
PID:236 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"51⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1244 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"53⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"54⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"55⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"56⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2468 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2028 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1720 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"60⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"61⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"62⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2640 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2636 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"65⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"66⤵PID:768
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"67⤵PID:1108
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"68⤵PID:604
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"69⤵PID:1444
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"70⤵
- System Location Discovery: System Language Discovery
PID:2196 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"71⤵PID:2436
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"72⤵PID:1036
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"73⤵
- System Location Discovery: System Language Discovery
PID:988 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"74⤵PID:1924
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"75⤵
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"76⤵PID:1988
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"77⤵PID:2432
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"78⤵PID:2476
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"79⤵PID:3020
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"80⤵PID:2740
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"81⤵PID:2600
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"82⤵PID:2668
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"83⤵PID:1760
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"84⤵PID:1088
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"85⤵PID:484
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"86⤵PID:2916
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"87⤵
- System Location Discovery: System Language Discovery
PID:2288 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"88⤵PID:1548
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"89⤵PID:1380
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"90⤵PID:912
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"91⤵PID:2524
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"92⤵PID:1504
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"93⤵PID:2244
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"94⤵PID:2612
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"95⤵PID:2800
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"96⤵
- System Location Discovery: System Language Discovery
PID:2728 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"97⤵PID:2180
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"98⤵
- System Location Discovery: System Language Discovery
PID:1648 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"99⤵PID:904
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"100⤵
- System Location Discovery: System Language Discovery
PID:352 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"101⤵PID:2336
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"102⤵PID:2984
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"103⤵PID:1620
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"104⤵PID:2128
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"105⤵PID:2116
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"106⤵PID:708
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"107⤵PID:2396
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"108⤵
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"109⤵
- System Location Discovery: System Language Discovery
PID:2780 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"110⤵PID:876
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"111⤵PID:584
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"112⤵
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"113⤵PID:1796
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"114⤵PID:2588
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"115⤵PID:1672
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"116⤵PID:2672
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"117⤵PID:2356
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"118⤵PID:2332
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"119⤵PID:1912
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"120⤵PID:1292
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"121⤵
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"122⤵PID:640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-