Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10venome otp...ip.dll
windows7-x64
1venome otp...ip.dll
windows10-2004-x64
1venome otp...ol.dll
windows7-x64
1venome otp...ol.dll
windows10-2004-x64
1venome otp...ET.dll
windows7-x64
1venome otp...ET.dll
windows10-2004-x64
1venome otp...on.dll
windows7-x64
1venome otp...on.dll
windows10-2004-x64
1venome otp...te.dll
windows7-x64
1venome otp...te.dll
windows10-2004-x64
1venome otp...on.dll
windows7-x64
3venome otp...on.dll
windows10-2004-x64
3venome otp...ds.dll
windows7-x64
1venome otp...ds.dll
windows10-2004-x64
1venome otp...OT.exe
windows7-x64
10venome otp...OT.exe
windows10-2004-x64
10venome otp...et.dll
windows7-x64
1venome otp...et.dll
windows10-2004-x64
1Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/01/2025, 15:58
Behavioral task
behavioral1
Sample
venome otp BOT/OTP BOT/DotNetZip.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
venome otp BOT/OTP BOT/DotNetZip.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
venome otp BOT/OTP BOT/HandyControl.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
venome otp BOT/OTP BOT/HandyControl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
venome otp BOT/OTP BOT/MailBee.NET.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
venome otp BOT/OTP BOT/MailBee.NET.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
venome otp BOT/OTP BOT/Newtonsoft.Json.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
venome otp BOT/OTP BOT/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
venome otp BOT/OTP BOT/System.Data.SQLite.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
venome otp BOT/OTP BOT/System.Data.SQLite.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
venome otp BOT/OTP BOT/System.Windows.Controls.Ribbon.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
venome otp BOT/OTP BOT/System.Windows.Controls.Ribbon.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
venome otp BOT/OTP BOT/ToolGood.Words.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
venome otp BOT/OTP BOT/ToolGood.Words.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
venome otp BOT/OTP BOT/venome OTP BOT.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
venome otp BOT/OTP BOT/venome OTP BOT.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
venome otp BOT/OTP BOT/xNet.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
venome otp BOT/OTP BOT/xNet.dll
Resource
win10v2004-20241007-en
General
-
Target
venome otp BOT/OTP BOT/System.Windows.Controls.Ribbon.dll
-
Size
717KB
-
MD5
c938bb2a9537df587d9a4ce01de447b9
-
SHA1
8aee2b2e1c7c6786817a5136d011f8427ac9b92e
-
SHA256
c3fd046e992f96a0f4b729a6864d07f2320dc2f87fb34033874429c1f03b6931
-
SHA512
70eb8ee86a99f25dc9a35bad85e1dcb82dd16babbea6f2a9e540687caa96de3ccbd1205117820802853b3aa922a302183df8ec9c2cd459a4d5c111958de34e3b
-
SSDEEP
12288:CDZDWzv+aVPZDpPBi87JBIgu7PO447irbrM+murmje0Prjk3rNr0kzqA7+pHlj99:OmUzpXlzEOIF6HX6
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3840 wrote to memory of 1060 3840 rundll32.exe 81 PID 3840 wrote to memory of 1060 3840 rundll32.exe 81 PID 3840 wrote to memory of 1060 3840 rundll32.exe 81 PID 1060 wrote to memory of 2784 1060 rundll32.exe 82 PID 1060 wrote to memory of 2784 1060 rundll32.exe 82 PID 1060 wrote to memory of 2784 1060 rundll32.exe 82 PID 2784 wrote to memory of 2008 2784 rundll32.exe 83 PID 2784 wrote to memory of 2008 2784 rundll32.exe 83 PID 2784 wrote to memory of 2008 2784 rundll32.exe 83 PID 2008 wrote to memory of 4068 2008 rundll32.exe 86 PID 2008 wrote to memory of 4068 2008 rundll32.exe 86 PID 2008 wrote to memory of 4068 2008 rundll32.exe 86 PID 4068 wrote to memory of 3492 4068 rundll32.exe 87 PID 4068 wrote to memory of 3492 4068 rundll32.exe 87 PID 4068 wrote to memory of 3492 4068 rundll32.exe 87 PID 3492 wrote to memory of 2716 3492 rundll32.exe 88 PID 3492 wrote to memory of 2716 3492 rundll32.exe 88 PID 3492 wrote to memory of 2716 3492 rundll32.exe 88 PID 2716 wrote to memory of 4012 2716 rundll32.exe 89 PID 2716 wrote to memory of 4012 2716 rundll32.exe 89 PID 2716 wrote to memory of 4012 2716 rundll32.exe 89 PID 4012 wrote to memory of 1896 4012 rundll32.exe 90 PID 4012 wrote to memory of 1896 4012 rundll32.exe 90 PID 4012 wrote to memory of 1896 4012 rundll32.exe 90 PID 1896 wrote to memory of 228 1896 rundll32.exe 91 PID 1896 wrote to memory of 228 1896 rundll32.exe 91 PID 1896 wrote to memory of 228 1896 rundll32.exe 91 PID 228 wrote to memory of 912 228 rundll32.exe 92 PID 228 wrote to memory of 912 228 rundll32.exe 92 PID 228 wrote to memory of 912 228 rundll32.exe 92 PID 912 wrote to memory of 4028 912 rundll32.exe 93 PID 912 wrote to memory of 4028 912 rundll32.exe 93 PID 912 wrote to memory of 4028 912 rundll32.exe 93 PID 4028 wrote to memory of 456 4028 rundll32.exe 94 PID 4028 wrote to memory of 456 4028 rundll32.exe 94 PID 4028 wrote to memory of 456 4028 rundll32.exe 94 PID 456 wrote to memory of 2840 456 rundll32.exe 95 PID 456 wrote to memory of 2840 456 rundll32.exe 95 PID 456 wrote to memory of 2840 456 rundll32.exe 95 PID 2840 wrote to memory of 1440 2840 rundll32.exe 96 PID 2840 wrote to memory of 1440 2840 rundll32.exe 96 PID 2840 wrote to memory of 1440 2840 rundll32.exe 96 PID 1440 wrote to memory of 2568 1440 rundll32.exe 97 PID 1440 wrote to memory of 2568 1440 rundll32.exe 97 PID 1440 wrote to memory of 2568 1440 rundll32.exe 97 PID 2568 wrote to memory of 1392 2568 rundll32.exe 98 PID 2568 wrote to memory of 1392 2568 rundll32.exe 98 PID 2568 wrote to memory of 1392 2568 rundll32.exe 98 PID 1392 wrote to memory of 3616 1392 rundll32.exe 99 PID 1392 wrote to memory of 3616 1392 rundll32.exe 99 PID 1392 wrote to memory of 3616 1392 rundll32.exe 99 PID 3616 wrote to memory of 2740 3616 rundll32.exe 100 PID 3616 wrote to memory of 2740 3616 rundll32.exe 100 PID 3616 wrote to memory of 2740 3616 rundll32.exe 100 PID 2740 wrote to memory of 2140 2740 rundll32.exe 101 PID 2740 wrote to memory of 2140 2740 rundll32.exe 101 PID 2740 wrote to memory of 2140 2740 rundll32.exe 101 PID 2140 wrote to memory of 1500 2140 rundll32.exe 102 PID 2140 wrote to memory of 1500 2140 rundll32.exe 102 PID 2140 wrote to memory of 1500 2140 rundll32.exe 102 PID 1500 wrote to memory of 4124 1500 rundll32.exe 103 PID 1500 wrote to memory of 4124 1500 rundll32.exe 103 PID 1500 wrote to memory of 4124 1500 rundll32.exe 103 PID 4124 wrote to memory of 2848 4124 rundll32.exe 104
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#12⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#13⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#14⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#15⤵
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#16⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#17⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#18⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#19⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#110⤵
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#111⤵
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#112⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#113⤵
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#114⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#115⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#116⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#117⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#118⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#119⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#120⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#121⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#122⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#123⤵PID:2848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#124⤵PID:4776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#125⤵
- System Location Discovery: System Language Discovery
PID:4464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#126⤵PID:2288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#127⤵PID:4724
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#128⤵PID:2492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#129⤵PID:4528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#130⤵PID:2876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#131⤵PID:4280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#132⤵PID:4088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#133⤵PID:1824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#134⤵PID:1080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#135⤵PID:2884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#136⤵PID:4192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#137⤵
- System Location Discovery: System Language Discovery
PID:3240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#138⤵PID:2540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#139⤵PID:1520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#140⤵PID:3528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#141⤵
- System Location Discovery: System Language Discovery
PID:2272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#142⤵PID:628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#143⤵PID:1880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#144⤵PID:2700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#145⤵PID:4968
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#146⤵PID:4008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#147⤵
- System Location Discovery: System Language Discovery
PID:1432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#148⤵
- System Location Discovery: System Language Discovery
PID:2800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#149⤵
- System Location Discovery: System Language Discovery
PID:1248 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#150⤵PID:2956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#151⤵PID:904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#152⤵PID:1148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#153⤵PID:3760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#154⤵PID:872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#155⤵PID:1768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#156⤵PID:1016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#157⤵PID:2656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#158⤵PID:3136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#159⤵PID:4868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#160⤵PID:2236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#161⤵PID:2004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#162⤵PID:3508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#163⤵PID:336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#164⤵PID:400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#165⤵PID:1236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#166⤵PID:1744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#167⤵
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#168⤵PID:1604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#169⤵PID:4380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#170⤵PID:880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#171⤵PID:4360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#172⤵PID:1132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#173⤵PID:4516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#174⤵PID:2024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#175⤵PID:5092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#176⤵PID:1976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#177⤵PID:4540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#178⤵PID:2164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#179⤵
- System Location Discovery: System Language Discovery
PID:2952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#180⤵PID:432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#181⤵PID:2340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#182⤵PID:3408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#183⤵PID:3220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#184⤵PID:4396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#185⤵PID:3304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#186⤵PID:2112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#187⤵PID:3140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#188⤵PID:5000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#189⤵PID:3012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#190⤵PID:5056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#191⤵PID:1224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#192⤵PID:808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#193⤵PID:3852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#194⤵
- System Location Discovery: System Language Discovery
PID:2844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#195⤵PID:4644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#196⤵PID:1268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#197⤵PID:4904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#198⤵PID:4648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#199⤵PID:3236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1100⤵PID:612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1101⤵PID:3404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1102⤵PID:3704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1103⤵PID:4576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1104⤵PID:1860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1105⤵PID:3648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1106⤵PID:3880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1107⤵PID:2684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1108⤵PID:1608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1109⤵PID:1668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1110⤵PID:2208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1111⤵PID:2124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1112⤵PID:3112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1113⤵PID:1708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1114⤵PID:2472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1115⤵
- System Location Discovery: System Language Discovery
PID:3196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1116⤵PID:4352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1117⤵PID:2696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1118⤵PID:4944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1119⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1120⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1121⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\venome otp BOT\OTP BOT\System.Windows.Controls.Ribbon.dll",#1122⤵PID:5176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-