Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-01-2025 05:10
Behavioral task
behavioral1
Sample
c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe
Resource
win10v2004-20241007-en
General
-
Target
c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe
-
Size
900KB
-
MD5
be20dfffcba37064d6087aa714036873
-
SHA1
4f50f7f954ed27b8e3373a5d900905d98d1bb51e
-
SHA256
c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0
-
SHA512
955a14d104edf528cd3d1f140181e6222cc1f88c8f1fb0a6a60fa0d37962b34c535a29e45ba029cf8daa039df06d25b26689feb600fb8b499fe46de0b3bf4696
-
SSDEEP
24576:0rl6kD68JmlotQf1nQr8zKS7ifTcvt2S3Sc1YNTN:Cl328U2yfuo2hfwvtJCxT
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs Milburr.exe -
Executes dropped EXE 64 IoCs
pid Process 2700 Milburr.exe 2580 Milburr.exe 2600 Milburr.exe 2804 Milburr.exe 3020 Milburr.exe 1904 Milburr.exe 2812 Milburr.exe 1844 Milburr.exe 3004 Milburr.exe 1792 Milburr.exe 2272 Milburr.exe 2132 Milburr.exe 1556 Milburr.exe 1244 Milburr.exe 1520 Milburr.exe 660 Milburr.exe 2464 Milburr.exe 1936 Milburr.exe 1588 Milburr.exe 2688 Milburr.exe 2824 Milburr.exe 2596 Milburr.exe 3036 Milburr.exe 2992 Milburr.exe 2428 Milburr.exe 1276 Milburr.exe 892 Milburr.exe 2008 Milburr.exe 1900 Milburr.exe 2316 Milburr.exe 2172 Milburr.exe 684 Milburr.exe 1484 Milburr.exe 2060 Milburr.exe 1960 Milburr.exe 1688 Milburr.exe 700 Milburr.exe 704 Milburr.exe 2684 Milburr.exe 2760 Milburr.exe 2660 Milburr.exe 2536 Milburr.exe 2396 Milburr.exe 612 Milburr.exe 2260 Milburr.exe 2872 Milburr.exe 2900 Milburr.exe 2912 Milburr.exe 1760 Milburr.exe 2460 Milburr.exe 316 Milburr.exe 1092 Milburr.exe 680 Milburr.exe 1704 Milburr.exe 2976 Milburr.exe 1460 Milburr.exe 1968 Milburr.exe 2924 Milburr.exe 2776 Milburr.exe 2012 Milburr.exe 2680 Milburr.exe 2936 Milburr.exe 332 Milburr.exe 2896 Milburr.exe -
Loads dropped DLL 1 IoCs
pid Process 2280 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe -
AutoIT Executable 64 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2280-18-0x00000000003F0000-0x00000000005DE000-memory.dmp autoit_exe behavioral1/memory/2700-39-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2580-54-0x0000000000700000-0x0000000000B00000-memory.dmp autoit_exe behavioral1/memory/2580-57-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2600-74-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2804-75-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2804-91-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1904-109-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/3020-108-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1904-125-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2812-142-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1844-144-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1844-160-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1792-178-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/3004-177-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1792-194-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2132-212-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2272-211-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2132-228-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1556-229-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1556-245-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1244-262-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/660-280-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1520-279-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/660-296-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2464-297-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1936-314-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2464-313-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1936-330-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1588-346-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2688-363-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2824-364-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2824-378-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2596-379-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2596-391-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/3036-405-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2992-419-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2428-420-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2428-433-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1276-434-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1276-447-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2008-461-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/892-460-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1900-475-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2008-474-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2316-489-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1900-488-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2316-502-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2596-516-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2172-515-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/684-528-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1484-542-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2060-543-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2060-556-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1960-569-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/1688-583-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/700-596-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/704-610-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2684-622-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2760-635-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2660-649-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2536-663-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/2396-676-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe behavioral1/memory/612-677-0x0000000001080000-0x000000000126E000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/2280-0-0x00000000003F0000-0x00000000005DE000-memory.dmp upx behavioral1/files/0x0008000000016cfe-14.dat upx behavioral1/memory/2700-20-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2280-18-0x00000000003F0000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2580-40-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2700-39-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2580-57-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2600-58-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2600-74-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2804-75-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2804-91-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/3020-92-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1904-109-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/3020-108-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1904-125-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2812-126-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2812-142-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1844-144-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1844-160-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/3004-161-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1792-178-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/3004-177-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2272-195-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1792-194-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2132-212-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2272-211-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2132-228-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1556-229-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1244-246-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1556-245-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1244-262-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1520-263-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/660-280-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1520-279-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/660-296-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2464-297-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1936-314-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2464-313-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1936-330-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1588-331-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1588-346-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2688-347-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2688-363-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2824-364-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2824-378-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2596-379-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/3036-392-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2596-391-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2992-406-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/3036-405-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2992-419-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2428-420-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2428-433-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1276-434-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1276-447-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2008-461-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/892-460-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1900-475-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2008-474-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2316-489-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/1900-488-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2316-502-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2596-516-0x0000000001080000-0x000000000126E000-memory.dmp upx behavioral1/memory/2172-515-0x0000000001080000-0x000000000126E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milburr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2280 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 2280 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 2700 Milburr.exe 2700 Milburr.exe 2580 Milburr.exe 2580 Milburr.exe 2600 Milburr.exe 2600 Milburr.exe 2804 Milburr.exe 2804 Milburr.exe 3020 Milburr.exe 3020 Milburr.exe 1904 Milburr.exe 1904 Milburr.exe 2812 Milburr.exe 2812 Milburr.exe 1844 Milburr.exe 1844 Milburr.exe 3004 Milburr.exe 3004 Milburr.exe 1792 Milburr.exe 1792 Milburr.exe 2272 Milburr.exe 2272 Milburr.exe 2132 Milburr.exe 2132 Milburr.exe 1556 Milburr.exe 1556 Milburr.exe 1244 Milburr.exe 1244 Milburr.exe 1520 Milburr.exe 1520 Milburr.exe 660 Milburr.exe 660 Milburr.exe 2464 Milburr.exe 2464 Milburr.exe 1936 Milburr.exe 1936 Milburr.exe 1588 Milburr.exe 1588 Milburr.exe 2688 Milburr.exe 2688 Milburr.exe 2824 Milburr.exe 2824 Milburr.exe 2596 Milburr.exe 2596 Milburr.exe 3036 Milburr.exe 3036 Milburr.exe 2992 Milburr.exe 2992 Milburr.exe 2428 Milburr.exe 2428 Milburr.exe 1276 Milburr.exe 1276 Milburr.exe 892 Milburr.exe 892 Milburr.exe 2008 Milburr.exe 2008 Milburr.exe 1900 Milburr.exe 1900 Milburr.exe 2316 Milburr.exe 2316 Milburr.exe 2172 Milburr.exe 2172 Milburr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2280 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 2280 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 2700 Milburr.exe 2700 Milburr.exe 2580 Milburr.exe 2580 Milburr.exe 2600 Milburr.exe 2600 Milburr.exe 2804 Milburr.exe 2804 Milburr.exe 3020 Milburr.exe 3020 Milburr.exe 1904 Milburr.exe 1904 Milburr.exe 2812 Milburr.exe 2812 Milburr.exe 1844 Milburr.exe 1844 Milburr.exe 3004 Milburr.exe 3004 Milburr.exe 1792 Milburr.exe 1792 Milburr.exe 2272 Milburr.exe 2272 Milburr.exe 2132 Milburr.exe 2132 Milburr.exe 1556 Milburr.exe 1556 Milburr.exe 1244 Milburr.exe 1244 Milburr.exe 1520 Milburr.exe 1520 Milburr.exe 660 Milburr.exe 660 Milburr.exe 2464 Milburr.exe 2464 Milburr.exe 1936 Milburr.exe 1936 Milburr.exe 1588 Milburr.exe 1588 Milburr.exe 2688 Milburr.exe 2688 Milburr.exe 2824 Milburr.exe 2824 Milburr.exe 2596 Milburr.exe 2596 Milburr.exe 3036 Milburr.exe 3036 Milburr.exe 2992 Milburr.exe 2992 Milburr.exe 2428 Milburr.exe 2428 Milburr.exe 1276 Milburr.exe 1276 Milburr.exe 892 Milburr.exe 892 Milburr.exe 2008 Milburr.exe 2008 Milburr.exe 1900 Milburr.exe 1900 Milburr.exe 2316 Milburr.exe 2316 Milburr.exe 2172 Milburr.exe 2172 Milburr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2700 2280 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 30 PID 2280 wrote to memory of 2700 2280 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 30 PID 2280 wrote to memory of 2700 2280 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 30 PID 2280 wrote to memory of 2700 2280 c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe 30 PID 2700 wrote to memory of 2580 2700 Milburr.exe 31 PID 2700 wrote to memory of 2580 2700 Milburr.exe 31 PID 2700 wrote to memory of 2580 2700 Milburr.exe 31 PID 2700 wrote to memory of 2580 2700 Milburr.exe 31 PID 2580 wrote to memory of 2600 2580 Milburr.exe 32 PID 2580 wrote to memory of 2600 2580 Milburr.exe 32 PID 2580 wrote to memory of 2600 2580 Milburr.exe 32 PID 2580 wrote to memory of 2600 2580 Milburr.exe 32 PID 2600 wrote to memory of 2804 2600 Milburr.exe 33 PID 2600 wrote to memory of 2804 2600 Milburr.exe 33 PID 2600 wrote to memory of 2804 2600 Milburr.exe 33 PID 2600 wrote to memory of 2804 2600 Milburr.exe 33 PID 2804 wrote to memory of 3020 2804 Milburr.exe 34 PID 2804 wrote to memory of 3020 2804 Milburr.exe 34 PID 2804 wrote to memory of 3020 2804 Milburr.exe 34 PID 2804 wrote to memory of 3020 2804 Milburr.exe 34 PID 3020 wrote to memory of 1904 3020 Milburr.exe 35 PID 3020 wrote to memory of 1904 3020 Milburr.exe 35 PID 3020 wrote to memory of 1904 3020 Milburr.exe 35 PID 3020 wrote to memory of 1904 3020 Milburr.exe 35 PID 1904 wrote to memory of 2812 1904 Milburr.exe 36 PID 1904 wrote to memory of 2812 1904 Milburr.exe 36 PID 1904 wrote to memory of 2812 1904 Milburr.exe 36 PID 1904 wrote to memory of 2812 1904 Milburr.exe 36 PID 2812 wrote to memory of 1844 2812 Milburr.exe 37 PID 2812 wrote to memory of 1844 2812 Milburr.exe 37 PID 2812 wrote to memory of 1844 2812 Milburr.exe 37 PID 2812 wrote to memory of 1844 2812 Milburr.exe 37 PID 1844 wrote to memory of 3004 1844 Milburr.exe 38 PID 1844 wrote to memory of 3004 1844 Milburr.exe 38 PID 1844 wrote to memory of 3004 1844 Milburr.exe 38 PID 1844 wrote to memory of 3004 1844 Milburr.exe 38 PID 3004 wrote to memory of 1792 3004 Milburr.exe 39 PID 3004 wrote to memory of 1792 3004 Milburr.exe 39 PID 3004 wrote to memory of 1792 3004 Milburr.exe 39 PID 3004 wrote to memory of 1792 3004 Milburr.exe 39 PID 1792 wrote to memory of 2272 1792 Milburr.exe 40 PID 1792 wrote to memory of 2272 1792 Milburr.exe 40 PID 1792 wrote to memory of 2272 1792 Milburr.exe 40 PID 1792 wrote to memory of 2272 1792 Milburr.exe 40 PID 2272 wrote to memory of 2132 2272 Milburr.exe 41 PID 2272 wrote to memory of 2132 2272 Milburr.exe 41 PID 2272 wrote to memory of 2132 2272 Milburr.exe 41 PID 2272 wrote to memory of 2132 2272 Milburr.exe 41 PID 2132 wrote to memory of 1556 2132 Milburr.exe 42 PID 2132 wrote to memory of 1556 2132 Milburr.exe 42 PID 2132 wrote to memory of 1556 2132 Milburr.exe 42 PID 2132 wrote to memory of 1556 2132 Milburr.exe 42 PID 1556 wrote to memory of 1244 1556 Milburr.exe 43 PID 1556 wrote to memory of 1244 1556 Milburr.exe 43 PID 1556 wrote to memory of 1244 1556 Milburr.exe 43 PID 1556 wrote to memory of 1244 1556 Milburr.exe 43 PID 1244 wrote to memory of 1520 1244 Milburr.exe 44 PID 1244 wrote to memory of 1520 1244 Milburr.exe 44 PID 1244 wrote to memory of 1520 1244 Milburr.exe 44 PID 1244 wrote to memory of 1520 1244 Milburr.exe 44 PID 1520 wrote to memory of 660 1520 Milburr.exe 45 PID 1520 wrote to memory of 660 1520 Milburr.exe 45 PID 1520 wrote to memory of 660 1520 Milburr.exe 45 PID 1520 wrote to memory of 660 1520 Milburr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe"C:\Users\Admin\AppData\Local\Temp\c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\Temp\c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"7⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"8⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"9⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"11⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"12⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"14⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"16⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"17⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:660 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"18⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2464 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"19⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1936 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"20⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1588 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2688 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2824 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"23⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2596 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3036 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"25⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2992 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"26⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2428 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"27⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1276 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"28⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:892 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"29⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2008 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1900 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"31⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2316 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2172 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"33⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"34⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2060 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"37⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"38⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:704 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"40⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2760 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"42⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"43⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"44⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"45⤵
- Executes dropped EXE
PID:612 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"46⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"47⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"49⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"50⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"51⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"52⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"53⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"54⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1704 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"56⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1460 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"58⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"59⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"60⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"61⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"62⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"63⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:332 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"65⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"66⤵PID:2884
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"67⤵PID:1940
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"68⤵PID:3016
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"69⤵PID:2088
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"70⤵PID:668
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"71⤵PID:2244
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"72⤵PID:2404
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"73⤵PID:2176
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"74⤵PID:1956
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"75⤵PID:1648
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"76⤵PID:2336
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"77⤵PID:2648
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"78⤵PID:2756
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"79⤵PID:2716
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"80⤵PID:476
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"81⤵PID:1776
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"82⤵PID:2612
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"83⤵PID:2792
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"84⤵
- System Location Discovery: System Language Discovery
PID:1112 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"85⤵PID:2188
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"86⤵PID:1660
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"87⤵
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"88⤵PID:2952
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"89⤵PID:1352
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"90⤵PID:2256
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"91⤵PID:2996
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"92⤵PID:1728
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"93⤵PID:1692
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"94⤵PID:2544
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"95⤵
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"96⤵PID:1136
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"97⤵PID:820
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"98⤵PID:1424
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"99⤵PID:1772
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"100⤵PID:1544
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"101⤵
- System Location Discovery: System Language Discovery
PID:2020 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"102⤵PID:408
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"103⤵
- System Location Discovery: System Language Discovery
PID:1236 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"104⤵PID:1596
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"105⤵PID:1912
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"106⤵PID:2672
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"107⤵PID:2572
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"108⤵PID:2552
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"109⤵
- System Location Discovery: System Language Discovery
PID:2092 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"110⤵PID:3064
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"111⤵
- System Location Discovery: System Language Discovery
PID:2856 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"112⤵PID:2956
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"113⤵PID:2524
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"114⤵PID:940
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"115⤵
- System Location Discovery: System Language Discovery
PID:1532 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"116⤵PID:2520
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"117⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"118⤵
- System Location Discovery: System Language Discovery
PID:2556 -
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"119⤵PID:1468
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"120⤵PID:1248
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"121⤵PID:2372
-
C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\Admin\AppData\Local\obtenebrate\Milburr.exe"122⤵
- System Location Discovery: System Language Discovery
PID:2860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-