Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
NursultanClient.exe1.exe

Overview

General Information

Sample name:NursultanClient.exe1.exe
Analysis ID:1638422
MD5:8b77a97c1565f0bcd30d78cee136f3a5
SHA1:34966691826f79c7d6fc534677e26f85a21f9cbb
SHA256:ded6b8977bb022452a8cb526243e12a57cef4baf52c8afa2ef56ea8c258bc300
Tags:exeuser-TornadoAV_dev
Infos:

Detection

Score:92
Range:0 - 100
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
.NET source code contains potential unpacker
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Contains functionality to register a low level keyboard hook
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Yara detected Costura Assembly Loader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Potential key logger detected (key state polling based)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • NursultanClient.exe1.exe (PID: 5148 cmdline: "C:\Users\user\Desktop\NursultanClient.exe1.exe" MD5: 8B77A97C1565F0BCD30D78CEE136F3A5)
    • cmd.exe (PID: 3120 cmdline: "cmd.exe" /c wmic diskdrive get model MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 5324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 5156 cmdline: wmic diskdrive get model MD5: E2DE6500DE1148C7F6027AD50AC8B891)
  • NursultanClient.exe1.exe (PID: 7080 cmdline: C:\Users\user\Desktop\NursultanClient.exe1.exe MD5: 8B77A97C1565F0BCD30D78CEE136F3A5)
    • cmd.exe (PID: 2688 cmdline: "cmd.exe" /c wmic diskdrive get model MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 4508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 7200 cmdline: wmic diskdrive get model MD5: E2DE6500DE1148C7F6027AD50AC8B891)
    • MpCmdRun.exe (PID: 2688 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)
      • conhost.exe (PID: 5444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • NursultanClient.exe1.exe (PID: 7848 cmdline: "C:\Users\user\Desktop\NursultanClient.exe1.exe" MD5: 8B77A97C1565F0BCD30D78CEE136F3A5)
    • cmd.exe (PID: 7904 cmdline: "cmd.exe" /c wmic diskdrive get model MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 7912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 7944 cmdline: wmic diskdrive get model MD5: E2DE6500DE1148C7F6027AD50AC8B891)
  • NursultanClient.exe1.exe (PID: 8060 cmdline: "C:\Users\user\Desktop\NursultanClient.exe1.exe" MD5: 8B77A97C1565F0BCD30D78CEE136F3A5)
    • cmd.exe (PID: 8120 cmdline: "cmd.exe" /c wmic diskdrive get model MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 8128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 8168 cmdline: wmic diskdrive get model MD5: E2DE6500DE1148C7F6027AD50AC8B891)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
NursultanClient.exe1.exeJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Windows\SysWOW64\NursultanClient.exe1.exeJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000013.00000002.2436169120.0000000003301000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
        0000000F.00000002.2435369964.0000000002BE1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
          00000000.00000002.2434858855.0000000002761000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
            00000000.00000000.1178855649.0000000000302000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
              00000000.00000002.2477623541.0000000007900000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                Click to see the 5 entries

                Unpacked PEs

                SourceRuleDescriptionAuthorStrings
                0.0.NursultanClient.exe1.exe.300000.0.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security

                  Sigma Signatures

                  Sigma detected: CurrentVersion Autorun Keys Modification
                  Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Desktop\NursultanClient.exe1.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\NursultanClient.exe1.exe, ProcessId: 5148, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NursultanClient.exe1

                  Suricata Signatures

                  ⊘No Suricata rule has matched

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Multi AV Scanner detection for dropped file
                  Source: C:\Windows\SysWOW64\NursultanClient.exe1.exeReversingLabs: Detection: 26%
                  Multi AV Scanner detection for submitted file
                  Source: NursultanClient.exe1.exeVirustotal: Detection: 34%Perma Link
                  Source: NursultanClient.exe1.exeReversingLabs: Detection: 26%
                  Joe Sandbox ML detected suspicious sample
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                  Source: NursultanClient.exe1.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.4:49719 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.4:49724 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.4:49727 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.4:49731 version: TLS 1.2
                  Source: NursultanClient.exe1.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                  Source: Binary string: C:\Users\dahal\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdbSHA256TU2 source: NursultanClient.exe1.exe, 00000000.00000002.2452794909.0000000003876000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.2452794909.00000000038DF000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2454084617.00000000037F0000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2457213266.0000000003D62000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2457213266.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2474797378.000000000780E000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000013.00000002.2454492140.0000000004397000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000013.00000002.2454492140.000000000447F000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: NursultanClient.exe1.exe, 00000000.00000002.2428397514.00000000009FD000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: NursultanClient.exe1.exe, 00000000.00000002.2428397514.00000000009FD000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: costura.costura.pdb.compressed source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr
                  Source: Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressedUde.microsoft.win32.taskscheduler.resources source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr
                  Source: Binary string: st.pdb source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr
                  Source: Binary string: a.pdb.compressedUde.microsoft.win32.taskscheduler.resources source: NursultanClient.exe1.exe, 00000000.00000002.2477623541.0000000007900000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\dahal\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdb source: NursultanClient.exe1.exe, 00000000.00000002.2452794909.0000000003876000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.2452794909.00000000038DF000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2454084617.00000000037F0000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2457213266.0000000003D62000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2457213266.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2474797378.000000000780E000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000013.00000002.2454492140.0000000004397000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000013.00000002.2454492140.000000000447F000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: costura.costura.pdb.compressed|||Costura.pdb|806F4C19B2D7FD9E3B836269EC07647019A29E95|7960 source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: global trafficTCP traffic: 192.168.2.4:49718 -> 147.185.221.26:54480
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: Joe Sandbox ViewIP Address: 104.237.62.213 104.237.62.213
                  Source: Joe Sandbox ViewIP Address: 147.185.221.26 147.185.221.26
                  Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                  Source: unknownDNS query: name: api64.ipify.org
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: global trafficDNS traffic detected: DNS query: george-webcam.gl.at.ply.gg
                  Source: global trafficDNS traffic detected: DNS query: api64.ipify.org
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://james.newtonking.com/projects/json
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2434858855.0000000002787000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002671000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2435369964.0000000002C07000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000013.00000002.2436169120.0000000003327000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2465236157.0000000006892000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002671000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2435369964.0000000002C07000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000013.00000002.2436169120.0000000003327000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api64.ipify.org
                  Source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.drString found in binary or memory: https://api64.ipify.org/
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2452794909.0000000003876000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.2452794909.00000000038DF000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2454084617.00000000037F0000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2474757837.000000000740C000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2457213266.0000000003D62000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2457213266.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000013.00000002.2454492140.0000000004397000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000013.00000002.2454492140.000000000447F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dahall/taskscheduler
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.newtonsoft.com/json
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.newtonsoft.com/jsonschema
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.4:49719 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.4:49724 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.4:49727 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.4:49731 version: TLS 1.2

                  Key, Mouse, Clipboard, Microphone and Screen Capturing

                  barindex
                  Contains functionality to capture screen (.Net source)
                  Source: NursultanClient.exe1.exe, Form1.cs.Net Code: CaptureScreenshotOptimized
                  Source: NursultanClient.exe1.exe.0.dr, Form1.cs.Net Code: CaptureScreenshotOptimized
                  Contains functionality to log keystrokes (.Net Source)
                  Source: NursultanClient.exe1.exe, KeyLogger.cs.Net Code: SetupKeyboardHook
                  Source: NursultanClient.exe1.exe.0.dr, KeyLogger.cs.Net Code: SetupKeyboardHook
                  Contains functionality to register a low level keyboard hook
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_07BE2E1C SetWindowsHookExW 0000000D,00000000,?,?0_2_07BE2E1C
                  Installs a global keyboard hook
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\NursultanClient.exe1.exeJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\NursultanClient.exe1.exeJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\NursultanClient.exe1.exe
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\NursultanClient.exe1.exe
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_08C85D3A GetKeyState,GetKeyState,GetKeyState,0_2_08C85D3A
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeFile created: C:\Windows\SysWOW64\NursultanClient.exe1.exeJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeFile created: C:\Windows\SysWOW64\NursultanClient.exe1.exe:Zone.Identifier:$DATAJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_06F685A00_2_06F685A0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_06F67CD00_2_06F67CD0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_06F679880_2_06F67988
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_07BED6D00_2_07BED6D0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_07BE7DE00_2_07BE7DE0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_09B5D3000_2_09B5D300
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_09B50FA80_2_09B50FA8
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_09B50F980_2_09B50F98
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_09B500060_2_09B50006
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC00405_2_04CC0040
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC63FF5_2_04CC63FF
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC09FF5_2_04CC09FF
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC0A005_2_04CC0A00
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_052D85A05_2_052D85A0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_052D7CD05_2_052D7CD0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_052D79885_2_052D7988
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_07C21F605_2_07C21F60
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_07C269505_2_07C26950
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_07C2A1585_2_07C2A158
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_07C2A1685_2_07C2A168
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_088669005_2_08866900
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_0516004015_2_05160040
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_051609F015_2_051609F0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_05160A0015_2_05160A00
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_073F85A015_2_073F85A0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_073F7CD015_2_073F7CD0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_073F798815_2_073F7988
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_0801638815_2_08016388
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_0801141815_2_08011418
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_08019BB815_2_08019BB8
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_08019BC815_2_08019BC8
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_08018C4915_2_08018C49
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_08B06A4015_2_08B06A40
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 19_2_086AF2D019_2_086AF2D0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 19_2_086A141819_2_086A1418
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 19_2_086A676819_2_086A6768
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 19_2_086A9FC819_2_086A9FC8
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 19_2_086A9FB819_2_086A9FB8
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 19_2_086A9F9219_2_086A9F92
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 19_2_0933ACF019_2_0933ACF0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 19_2_0933646019_2_09336460
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2452794909.0000000003876000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2434858855.0000000002787000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2474975386.0000000006E05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2452794909.00000000038DF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000000.00000000.1179011889.0000000000494000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamesvch> vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2425676143.000000000092E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2454084617.00000000037F0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002671000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.2435369964.0000000002C07000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.2427470445.0000000000CF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.2457213266.0000000003D62000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.2457213266.0000000003C4A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.2474797378.000000000780E000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000013.00000002.2454492140.0000000004397000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000013.00000002.2454492140.000000000447F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000013.00000002.2436169120.0000000003327000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exeBinary or memory string: OriginalFilenamesvch> vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe.0.drBinary or memory string: OriginalFilenamesvch> vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                  Source: NursultanClient.exe1.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: NursultanClient.exe1.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: 0.2.NursultanClient.exe1.exe.38df610.0.raw.unpack, ITaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask'
                  Source: 0.2.NursultanClient.exe1.exe.38df610.0.raw.unpack, TaskSchedulerSnapshot.csTask registration methods: 'InternalCreate', 'Create'
                  Source: 0.2.NursultanClient.exe1.exe.38df610.0.raw.unpack, TaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
                  Source: 0.2.NursultanClient.exe1.exe.38df610.0.raw.unpack, Task.csTask registration methods: 'RegisterChanges', 'CreateTask'
                  Source: 0.2.NursultanClient.exe1.exe.38df610.0.raw.unpack, TaskService.csTask registration methods: 'CreateFromToken'
                  Source: 5.2.NursultanClient.exe1.exe.37f0588.0.raw.unpack, ITaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask'
                  Source: 0.2.NursultanClient.exe1.exe.38df610.0.raw.unpack, TaskFolder.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                  Source: 0.2.NursultanClient.exe1.exe.38df610.0.raw.unpack, Task.csSecurity API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                  Source: 5.2.NursultanClient.exe1.exe.37f0588.0.raw.unpack, Task.csSecurity API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                  Source: 0.2.NursultanClient.exe1.exe.38df610.0.raw.unpack, TaskSecurity.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
                  Source: 0.2.NursultanClient.exe1.exe.38df610.0.raw.unpack, TaskSecurity.csSecurity API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
                  Source: 5.2.NursultanClient.exe1.exe.37f0588.0.raw.unpack, User.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
                  Source: 15.2.NursultanClient.exe1.exe.3cc29a8.0.raw.unpack, TaskSecurity.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
                  Source: 15.2.NursultanClient.exe1.exe.3cc29a8.0.raw.unpack, TaskSecurity.csSecurity API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
                  Source: 5.2.NursultanClient.exe1.exe.37f0588.0.raw.unpack, TaskFolder.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                  Source: 0.2.NursultanClient.exe1.exe.38df610.0.raw.unpack, User.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
                  Source: 5.2.NursultanClient.exe1.exe.37f0588.0.raw.unpack, TaskSecurity.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
                  Source: 5.2.NursultanClient.exe1.exe.37f0588.0.raw.unpack, TaskSecurity.csSecurity API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
                  Source: 15.2.NursultanClient.exe1.exe.3cc29a8.0.raw.unpack, TaskFolder.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                  Source: 15.2.NursultanClient.exe1.exe.3cc29a8.0.raw.unpack, Task.csSecurity API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                  Source: 0.2.NursultanClient.exe1.exe.38df610.0.raw.unpack, TaskPrincipal.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 15.2.NursultanClient.exe1.exe.3cc29a8.0.raw.unpack, User.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
                  Source: 5.2.NursultanClient.exe1.exe.37f0588.0.raw.unpack, TaskPrincipal.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 15.2.NursultanClient.exe1.exe.3cc29a8.0.raw.unpack, TaskPrincipal.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: classification engineClassification label: mal92.spyw.evad.winEXE@26/22@2/2
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMutant created: NULL
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8128:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5324:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5444:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4508:120:WilError_03
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeFile created: C:\Users\user\AppData\Local\Temp\HDNvtekAudioCacheJump to behavior
                  Source: NursultanClient.exe1.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: NursultanClient.exe1.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: NursultanClient.exe1.exeVirustotal: Detection: 34%
                  Source: NursultanClient.exe1.exeReversingLabs: Detection: 26%
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeFile read: C:\Users\user\Desktop\NursultanClient.exe1.exeJump to behavior
                  Source: unknownProcess created: C:\Users\user\Desktop\NursultanClient.exe1.exe "C:\Users\user\Desktop\NursultanClient.exe1.exe"
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: unknownProcess created: C:\Users\user\Desktop\NursultanClient.exe1.exe C:\Users\user\Desktop\NursultanClient.exe1.exe
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: unknownProcess created: C:\Users\user\Desktop\NursultanClient.exe1.exe "C:\Users\user\Desktop\NursultanClient.exe1.exe"
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: unknownProcess created: C:\Users\user\Desktop\NursultanClient.exe1.exe "C:\Users\user\Desktop\NursultanClient.exe1.exe"
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get modelJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get modelJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get modelJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dwrite.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: taskschd.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: xmllite.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windowscodecs.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dwrite.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: taskschd.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windowscodecs.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mscoree.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: version.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: vcruntime140_clr0400.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windows.storage.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wldp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: profapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptsp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rsaenh.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptbase.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dwrite.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: amsi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: userenv.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: msasn1.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: gpapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: iphlpapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dnsapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc6.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winnsi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wbemcomn.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: taskschd.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: sspicli.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mswsock.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasadhlp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: fwpuclnt.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasapi32.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasman.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rtutils.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winhttp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ondemandconnroutehelper.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: secur32.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: schannel.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mskeyprotect.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ntasn1.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncrypt.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncryptsslp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windowscodecs.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vbscript.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sxs.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mscoree.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: version.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: vcruntime140_clr0400.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windows.storage.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wldp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: profapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptsp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rsaenh.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptbase.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dwrite.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: amsi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: userenv.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: msasn1.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: gpapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: iphlpapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dnsapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc6.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winnsi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wbemcomn.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: taskschd.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: sspicli.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mswsock.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasadhlp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: fwpuclnt.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasapi32.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasman.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rtutils.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winhttp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ondemandconnroutehelper.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: secur32.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: schannel.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mskeyprotect.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ntasn1.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncrypt.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncryptsslp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windowscodecs.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vbscript.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sxs.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: mpclient.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: secur32.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: sspicli.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: version.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: msasn1.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: kernel.appcore.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: userenv.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: gpapi.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: wbemcomn.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: amsi.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: profapi.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: wscapi.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: urlmon.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: iertutil.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: srvcli.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: netutils.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: slc.dll
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: sppc.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                  Source: NursultanClient.exe1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                  Source: NursultanClient.exe1.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                  Source: NursultanClient.exe1.exeStatic file information: File size 1642496 > 1048576
                  Source: NursultanClient.exe1.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x190400
                  Source: NursultanClient.exe1.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                  Source: NursultanClient.exe1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                  Source: Binary string: C:\Users\dahal\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdbSHA256TU2 source: NursultanClient.exe1.exe, 00000000.00000002.2452794909.0000000003876000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.2452794909.00000000038DF000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2454084617.00000000037F0000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2457213266.0000000003D62000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2457213266.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2474797378.000000000780E000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000013.00000002.2454492140.0000000004397000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000013.00000002.2454492140.000000000447F000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: NursultanClient.exe1.exe, 00000000.00000002.2428397514.00000000009FD000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: NursultanClient.exe1.exe, 00000000.00000002.2428397514.00000000009FD000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2471391940.0000000006C2A000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2432333535.0000000000B0A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: costura.costura.pdb.compressed source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr
                  Source: Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressedUde.microsoft.win32.taskscheduler.resources source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr
                  Source: Binary string: st.pdb source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr
                  Source: Binary string: a.pdb.compressedUde.microsoft.win32.taskscheduler.resources source: NursultanClient.exe1.exe, 00000000.00000002.2477623541.0000000007900000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\dahal\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdb source: NursultanClient.exe1.exe, 00000000.00000002.2452794909.0000000003876000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.2452794909.00000000038DF000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2454084617.00000000037F0000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2457213266.0000000003D62000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2457213266.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2474797378.000000000780E000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000013.00000002.2454492140.0000000004397000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000013.00000002.2454492140.000000000447F000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: costura.costura.pdb.compressed|||Costura.pdb|806F4C19B2D7FD9E3B836269EC07647019A29E95|7960 source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr

                  Data Obfuscation

                  barindex
                  .NET source code contains potential unpacker
                  Source: NursultanClient.exe1.exe, AssemblyLoader.cs.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
                  Source: NursultanClient.exe1.exe.0.dr, AssemblyLoader.cs.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
                  Source: 0.2.NursultanClient.exe1.exe.38df610.0.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                  Source: 0.2.NursultanClient.exe1.exe.38df610.0.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                  Source: 0.2.NursultanClient.exe1.exe.38df610.0.raw.unpack, XmlSerializationHelper.cs.Net Code: ReadObjectProperties
                  Source: 5.2.NursultanClient.exe1.exe.37f0588.0.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                  Source: 5.2.NursultanClient.exe1.exe.37f0588.0.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                  Source: 5.2.NursultanClient.exe1.exe.37f0588.0.raw.unpack, XmlSerializationHelper.cs.Net Code: ReadObjectProperties
                  Source: 15.2.NursultanClient.exe1.exe.3cc29a8.0.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                  Source: 15.2.NursultanClient.exe1.exe.3cc29a8.0.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                  Source: 15.2.NursultanClient.exe1.exe.3cc29a8.0.raw.unpack, XmlSerializationHelper.cs.Net Code: ReadObjectProperties
                  Yara detected Costura Assembly Loader
                  Source: Yara matchFile source: NursultanClient.exe1.exe, type: SAMPLE
                  Source: Yara matchFile source: 0.0.NursultanClient.exe1.exe.300000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000013.00000002.2436169120.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000F.00000002.2435369964.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2434858855.0000000002761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000000.1178855649.0000000000302000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2477623541.0000000007900000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.2434452900.0000000002671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: NursultanClient.exe1.exe PID: 5148, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: NursultanClient.exe1.exe PID: 7080, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: NursultanClient.exe1.exe PID: 7848, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: NursultanClient.exe1.exe PID: 8060, type: MEMORYSTR
                  Source: Yara matchFile source: C:\Windows\SysWOW64\NursultanClient.exe1.exe, type: DROPPED
                  Source: NursultanClient.exe1.exeStatic PE information: 0x8429E54A [Fri Apr 6 15:16:26 2040 UTC]
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_07BE33F5 push edi; ret 0_2_07BE33F6
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_07BE3231 pushad ; retf 0_2_07BE3232
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_08C81D06 push FFFFFF8Bh; iretd 0_2_08C81D08
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_00A2CE20 push cs; ret 5_2_00A2CE2E
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_00A2CF08 push cs; ret 5_2_00A2CF16
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_00A2CF60 push cs; ret 5_2_00A2CF6E
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_00A2D08A push es; ret 5_2_00A2D096
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_00A2B566 push edi; ret 5_2_00A2B567
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC8C18 push eax; retf 0004h5_2_04CC8C1A
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CCEC23 push esp; iretd 5_2_04CCEC26
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC8DAF push eax; retf 0004h5_2_04CC8DB2
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC8DA8 push eax; retf 0004h5_2_04CC8DAA
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC8EE8 push ecx; retf 0004h5_2_04CC8EEA
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC949F push esp; retf 0004h5_2_04CC94A2
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC9410 push esp; retf 0004h5_2_04CC9412
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC9431 push esp; retf 0004h5_2_04CC9432
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC95B0 push ebp; retf 0004h5_2_04CC95B2
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC9541 push ebp; retf 0004h5_2_04CC9542
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC9741 push esi; retf 0004h5_2_04CC9742
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC9758 push esi; retf 0004h5_2_04CC975A
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC9019 push ecx; retf 0004h5_2_04CC901A
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC9118 push edx; retf 0004h5_2_04CC911A
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC92E1 push ebx; retf 0004h5_2_04CC92E2
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC7279 push cs; ret 5_2_04CC727E
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC93F0 push esp; retf 0004h5_2_04CC93F2
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC9351 push esp; retf 0004h5_2_04CC9352
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC9379 push esp; retf 0004h5_2_04CC937A
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC9330 push ebx; retf 0004h5_2_04CC9332
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC7C3B push cs; ret 5_2_04CC7C3E
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC788F push cs; ret 5_2_04CC78A7
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 5_2_04CC99F0 push edi; retf 0004h5_2_04CC99F2
                  Source: NursultanClient.exe1.exeStatic PE information: section name: .text entropy: 7.951730369753831
                  Source: NursultanClient.exe1.exe.0.drStatic PE information: section name: .text entropy: 7.951730369753831
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeFile created: C:\Windows\SysWOW64\NursultanClient.exe1.exeJump to dropped file
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeFile created: C:\Windows\SysWOW64\NursultanClient.exe1.exeJump to dropped file
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NursultanClient.exe1Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NursultanClient.exe1Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOX

                  Malware Analysis System Evasion

                  barindex
                  Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Camera&apos; OR PNPClass = &apos;Image&apos;)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Media&apos; OR Name LIKE &apos;%microphone%&apos;)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Camera&apos; OR PNPClass = &apos;Image&apos;)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Media&apos; OR Name LIKE &apos;%microphone%&apos;)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Camera&apos; OR PNPClass = &apos;Image&apos;)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Media&apos; OR Name LIKE &apos;%microphone%&apos;)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Camera&apos; OR PNPClass = &apos;Image&apos;)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Media&apos; OR Name LIKE &apos;%microphone%&apos;)
                  Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model FROM Win32_DiskDrive
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model FROM Win32_DiskDrive
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model FROM Win32_DiskDrive
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model FROM Win32_DiskDrive
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: CB0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 2760000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 4760000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: A20000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 2670000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 24A0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: F50000 memory reserve | memory write watch
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 2BE0000 memory reserve | memory write watch
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 29A0000 memory reserve | memory write watch
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 1760000 memory reserve | memory write watch
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 3300000 memory reserve | memory write watch
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 17F0000 memory reserve | memory write watch
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 4706Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 4981Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 4980Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 4670Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 6862
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 2429
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 8404
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 1101
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 6764Thread sleep time: -31359464925306218s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 5376Thread sleep count: 156 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7692Thread sleep count: 4980 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7696Thread sleep time: -27670116110564310s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7672Thread sleep count: 4670 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7696Thread sleep time: -99062s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7880Thread sleep count: 118 > 30
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 8020Thread sleep count: 6862 > 30
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 8024Thread sleep time: -26747778906878833s >= -30000s
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 8008Thread sleep count: 2429 > 30
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 8088Thread sleep count: 106 > 30
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 3740Thread sleep count: 8404 > 30
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7276Thread sleep count: 31 > 30
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7276Thread sleep time: -28592453314249787s >= -30000s
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 5652Thread sleep count: 1101 > 30
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 99062Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477
                  Source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.drBinary or memory string: CheckForQEMU
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2434858855.0000000002787000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002671000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2435369964.0000000002C07000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000013.00000002.2436169120.0000000003327000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qemu-ga
                  Source: NursultanClient.exe1.exe.0.drBinary or memory string: vmware
                  Source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.drBinary or memory string: qemuwmi
                  Source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.drBinary or memory string: QEMU HARDDISK
                  Source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.drBinary or memory string: qemu-ga5Error checking processes: KAny.Run sandbox environment detected!#Sandbox Detection9No Any.Run sandbox detected.
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2474975386.0000000006E2C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS'tc
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.2469046397.0000000006EEB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2466954813.0000000006B20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllOO
                  Source: NursultanClient.exe1.exe, 00000013.00000002.2468526244.00000000074D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll44
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information queried: ProcessInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: page read and write | page guardJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get modelJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get modelJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get modelJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: z.txt.0.drBinary or memory string: [06:54:55] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:54:52] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:54:57] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [00:39:29] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002C13000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002916000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002878000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager0
                  Source: z.txt.0.drBinary or memory string: [14:49:47] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [03:33:11] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2434858855.0000000002A09000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qM[23:42:17] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002C0E000.00000004.00000800.00020000.00000000.sdmp, z.txt.0.drBinary or memory string: [07:11:47] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [15:12:46] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [07:09:28] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002B26000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qM[07:11:26] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002D7B000.00000004.00000800.00020000.00000000.sdmp, z.txt.0.drBinary or memory string: [07:12:05] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [03:25:02] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2434858855.0000000002A09000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qK[23:42:17] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [22:14:19] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [15:56:22] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:54:32] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, z.txt.0.drBinary or memory string: [07:11:54] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:56:31] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [10:50:23] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [15:36:45] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:58:35] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002996000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qK[07:07:48] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:58:33] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [18:07:51] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2434858855.0000000002A09000.00000004.00000800.00020000.00000000.sdmp, z.txt.0.drBinary or memory string: [23:42:17] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:55:33] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:00:06] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:54:33] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [16:44:10] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002B26000.00000004.00000800.00020000.00000000.sdmp, z.txt.0.drBinary or memory string: [07:11:26] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2434858855.0000000002928000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.2434858855.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000005.00000002.2434452900.000000000299B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerlB
                  Source: z.txt.0.drBinary or memory string: [06:23:46] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002D7B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qM[07:12:05] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [07:07:21] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [07:32:12] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [11:29:00] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [10:20:53] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:56:39] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [07:49:31] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:59:53] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:57:03] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:56:01] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:55:38] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:55:02] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [23:16:41] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [12:10:14] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.2435369964.0000000002C07000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: [18:32:12] Window changed: 'Program Manager' (Process: explorer, PID: 3964)ekAudioCache\z.txt' because it is being used by another process.
                  Source: z.txt.0.drBinary or memory string: [03:56:33] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2434858855.0000000002761000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.2434858855.00000000027C2000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.2434858855.0000000002A11000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager
                  Source: z.txt.0.drBinary or memory string: [07:06:10] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002C0E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qK[07:11:47] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002CCB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qM[07:11:54] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002996000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qM[07:07:48] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.00000000029FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qM[07:08:00] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.00000000029FE000.00000004.00000800.00020000.00000000.sdmp, z.txt.0.drBinary or memory string: [07:08:00] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:54:24] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [18:32:12] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [11:52:02] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:56:26] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002CCB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qK[07:11:54] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.00000000029FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qK[07:08:00] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:56:17] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002878000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qK[07:12:12] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002D7B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qK[07:12:05] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:56:22] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [14:55:31] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [01:45:53] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [15:18:51] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [14:45:21] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [12:06:21] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000013.00000002.2436169120.0000000003762000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qK[08:04:03] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [07:07:32] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.2435369964.0000000002CAE000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000013.00000002.2436169120.00000000033D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerP
                  Source: z.txt.0.drBinary or memory string: [06:55:27] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:54:42] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002996000.00000004.00000800.00020000.00000000.sdmp, z.txt.0.drBinary or memory string: [07:07:48] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000013.00000002.2436169120.00000000033D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager0xU
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002738000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.2435369964.0000000002CAE000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000013.00000002.2436169120.00000000033D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager4
                  Source: z.txt.0.drBinary or memory string: [06:54:47] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002B26000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qK[07:11:26] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000005.00000002.2434452900.0000000002C0E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qM[07:11:47] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [11:09:09] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.2434858855.0000000002787000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: [23:42:17] Window changed: 'Program Manager' (Process: explorer, PID: 3964)ekAudioCache\z.txt' because it is being used by another process.
                  Source: z.txt.0.drBinary or memory string: [22:48:45] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:54:45] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [06:57:45] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: z.txt.0.drBinary or memory string: [07:02:12] Window changed: 'Program Manager' (Process: explorer, PID: 3964)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Users\user\Desktop\NursultanClient.exe1.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Users\user\Desktop\NursultanClient.exe1.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Users\user\Desktop\NursultanClient.exe1.exe VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Users\user\Desktop\NursultanClient.exe1.exe VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
                  Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity InformationAcquire InfrastructureValid Accounts131
                  Windows Management Instrumentation                  		11
                  Scheduled Task/Job                  		12
                  Process Injection                  		2
                  Masquerading                  		311
                  Input Capture                  		331
                  Security Software Discovery                  		Remote Services1
                  Screen Capture                  		11
                  Encrypted Channel                  		Exfiltration Over Other Network MediumAbuse Accessibility Features
                  CredentialsDomainsDefault Accounts11
                  Scheduled Task/Job                  		1
                  Registry Run Keys / Startup Folder                  		11
                  Scheduled Task/Job                  		1
                  Disable or Modify Tools                  		LSASS Memory2
                  Process Discovery                  		Remote Desktop Protocol311
                  Input Capture                  		1
                  Non-Standard Port                  		Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain AccountsAt1
                  DLL Side-Loading                  		1
                  Registry Run Keys / Startup Folder                  		251
                  Virtualization/Sandbox Evasion                  		Security Account Manager251
                  Virtualization/Sandbox Evasion                  		SMB/Windows Admin Shares1
                  Archive Collected Data                  		1
                  Ingress Tool Transfer                  		Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
                  DLL Side-Loading                  		12
                  Process Injection                  		NTDS1
                  Application Window Discovery                  		Distributed Component Object ModelInput Capture2
                  Non-Application Layer Protocol                  		Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
                  Obfuscated Files or Information                  		LSA Secrets1
                  System Network Configuration Discovery                  		SSHKeylogging3
                  Application Layer Protocol                  		Scheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts12
                  Software Packing                  		Cached Domain Credentials223
                  System Information Discovery                  		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                  Timestomp                  		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                  DLL Side-Loading                  		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1638422 Sample: NursultanClient.exe1.exe Startdate: 14/03/2025 Architecture: WINDOWS Score: 92 52 george-webcam.gl.at.ply.gg 2->52 54 api64.ipify.org 2->54 60 Multi AV Scanner detection for dropped file 2->60 62 Multi AV Scanner detection for submitted file 2->62 64 .NET source code contains potential unpacker 2->64 66 4 other signatures 2->66 8 NursultanClient.exe1.exe 16 12 2->8         started        13 NursultanClient.exe1.exe 5 2->13         started        15 NursultanClient.exe1.exe 2->15         started        17 NursultanClient.exe1.exe 2->17         started        signatures3 process4 dnsIp5 56 api64.ipify.org 104.237.62.213, 443, 49719, 49724 WEBNXUS United States 8->56 58 george-webcam.gl.at.ply.gg 147.185.221.26, 49718, 49723, 49726 SALSGIVERUS United States 8->58 48 C:\Windows\...48ursultanClient.exe1.exe, PE32 8->48 dropped 50 NursultanClient.exe1.exe:Zone.Identifier, ASCII 8->50 dropped 68 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 8->68 70 Contains functionality to register a low level keyboard hook 8->70 72 Installs a global keyboard hook 8->72 19 cmd.exe 1 8->19         started        21 cmd.exe 13->21         started        23 MpCmdRun.exe 13->23         started        25 cmd.exe 15->25         started        27 cmd.exe 17->27         started        file6 signatures7 process8 process9 29 WMIC.exe 1 19->29         started        32 conhost.exe 19->32         started        34 WMIC.exe 1 21->34         started        36 conhost.exe 21->36         started        38 conhost.exe 23->38         started        40 conhost.exe 25->40         started        42 WMIC.exe 25->42         started        44 conhost.exe 27->44         started        46 WMIC.exe 27->46         started        signatures10 74 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 29->74

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.