Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
NursultanClient.exe1.exe

Overview

General Information

Sample name:NursultanClient.exe1.exe
Analysis ID:1638422
MD5:8b77a97c1565f0bcd30d78cee136f3a5
SHA1:34966691826f79c7d6fc534677e26f85a21f9cbb
SHA256:ded6b8977bb022452a8cb526243e12a57cef4baf52c8afa2ef56ea8c258bc300
Tags:exeuser-TornadoAV_dev
Infos:

Detection

Score:92
Range:0 - 100
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
.NET source code contains potential unpacker
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Contains functionality to register a low level keyboard hook
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Yara detected Costura Assembly Loader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Potential key logger detected (key state polling based)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • NursultanClient.exe1.exe (PID: 2248 cmdline: "C:\Users\user\Desktop\NursultanClient.exe1.exe" MD5: 8B77A97C1565F0BCD30D78CEE136F3A5)
    • cmd.exe (PID: 1332 cmdline: "cmd.exe" /c wmic diskdrive get model MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 5564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 60 cmdline: wmic diskdrive get model MD5: E2DE6500DE1148C7F6027AD50AC8B891)
  • NursultanClient.exe1.exe (PID: 2000 cmdline: C:\Users\user\Desktop\NursultanClient.exe1.exe MD5: 8B77A97C1565F0BCD30D78CEE136F3A5)
    • cmd.exe (PID: 504 cmdline: "cmd.exe" /c wmic diskdrive get model MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 5248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 7180 cmdline: wmic diskdrive get model MD5: E2DE6500DE1148C7F6027AD50AC8B891)
  • NursultanClient.exe1.exe (PID: 7752 cmdline: "C:\Users\user\Desktop\NursultanClient.exe1.exe" MD5: 8B77A97C1565F0BCD30D78CEE136F3A5)
    • cmd.exe (PID: 7816 cmdline: "cmd.exe" /c wmic diskdrive get model MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 7828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 7860 cmdline: wmic diskdrive get model MD5: E2DE6500DE1148C7F6027AD50AC8B891)
  • NursultanClient.exe1.exe (PID: 8052 cmdline: "C:\Users\user\Desktop\NursultanClient.exe1.exe" MD5: 8B77A97C1565F0BCD30D78CEE136F3A5)
    • cmd.exe (PID: 8108 cmdline: "cmd.exe" /c wmic diskdrive get model MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 8116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 8156 cmdline: wmic diskdrive get model MD5: E2DE6500DE1148C7F6027AD50AC8B891)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
NursultanClient.exe1.exeJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Windows\SysWOW64\NursultanClient.exe1.exeJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      0000000F.00000002.3056571017.00000000033C1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
        00000014.00000002.3056322219.0000000003351000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
          00000000.00000002.3055787808.0000000002A31000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
            00000006.00000002.3055698461.0000000002801000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
              00000000.00000000.1195526613.00000000005E2000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                Click to see the 4 entries

                Unpacked PEs

                SourceRuleDescriptionAuthorStrings
                0.0.NursultanClient.exe1.exe.5e0000.0.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security

                  Sigma Signatures

                  Sigma detected: CurrentVersion Autorun Keys Modification
                  Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Desktop\NursultanClient.exe1.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\NursultanClient.exe1.exe, ProcessId: 2248, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NursultanClient.exe1

                  Suricata Signatures

                  ⊘No Suricata rule has matched

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Multi AV Scanner detection for dropped file
                  Source: C:\Windows\SysWOW64\NursultanClient.exe1.exeReversingLabs: Detection: 26%
                  Multi AV Scanner detection for submitted file
                  Source: NursultanClient.exe1.exeVirustotal: Detection: 34%Perma Link
                  Source: NursultanClient.exe1.exeReversingLabs: Detection: 26%
                  Joe Sandbox ML detected suspicious sample
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                  Source: NursultanClient.exe1.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.6:49693 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.6:49698 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.6:49702 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.6:49705 version: TLS 1.2
                  Source: NursultanClient.exe1.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                  Source: Binary string: C:\Users\dahal\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdbSHA256TU2 source: NursultanClient.exe1.exe, 00000000.00000002.3073231524.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.3073231524.0000000003BAF000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3088801361.00000000074A0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3069778022.0000000003981000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3069778022.0000000003869000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.3075683315.00000000044AD000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.3075683315.0000000004543000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3076941011.00000000043EF000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3076941011.00000000044D1000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: NursultanClient.exe1.exe, 00000006.00000002.3051703299.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016BE000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: NursultanClient.exe1.exe, 00000006.00000002.3051703299.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016BE000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: costura.costura.pdb.compressed source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr
                  Source: Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressedUde.microsoft.win32.taskscheduler.resources source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr
                  Source: Binary string: st.pdb source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr
                  Source: Binary string: C:\Users\dahal\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdb source: NursultanClient.exe1.exe, 00000000.00000002.3073231524.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.3073231524.0000000003BAF000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3088801361.00000000074A0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3069778022.0000000003981000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3069778022.0000000003869000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.3075683315.00000000044AD000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.3075683315.0000000004543000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3076941011.00000000043EF000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3076941011.00000000044D1000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: costura.costura.pdb.compressed|||Costura.pdb|806F4C19B2D7FD9E3B836269EC07647019A29E95|7960 source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
                  Source: global trafficTCP traffic: 192.168.2.6:49692 -> 147.185.221.26:54480
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: Joe Sandbox ViewIP Address: 104.237.62.213 104.237.62.213
                  Source: Joe Sandbox ViewIP Address: 147.185.221.26 147.185.221.26
                  Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                  Source: unknownDNS query: name: api64.ipify.org
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api64.ipify.orgConnection: Keep-Alive
                  Source: global trafficDNS traffic detected: DNS query: george-webcam.gl.at.ply.gg
                  Source: global trafficDNS traffic detected: DNS query: api64.ipify.org
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3051703299.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3051703299.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3051703299.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3051703299.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3051703299.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://james.newtonking.com/projects/json
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3051703299.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3051703299.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3055787808.0000000002A57000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3055698461.0000000002801000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.3056571017.00000000033E7000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3056322219.0000000003377000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3051703299.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
                  Source: NursultanClient.exe1.exe, 00000014.00000002.3095779753.0000000009060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3055698461.0000000002801000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3056322219.0000000003377000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api64.ipify.org
                  Source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.drString found in binary or memory: https://api64.ipify.org/
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3073231524.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.3073231524.0000000003BAF000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3088801361.00000000074A0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3069778022.0000000003981000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3069778022.0000000003869000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.3075683315.00000000044AD000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.3075683315.0000000004543000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3076941011.00000000043EF000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3076941011.00000000044D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dahall/taskscheduler
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3051703299.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.newtonsoft.com/json
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.newtonsoft.com/jsonschema
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3051703299.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49698 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49698
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49693
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49693 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.6:49693 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.6:49698 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.6:49702 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.6:49705 version: TLS 1.2

                  Key, Mouse, Clipboard, Microphone and Screen Capturing

                  barindex
                  Contains functionality to capture screen (.Net source)
                  Source: NursultanClient.exe1.exe, Form1.cs.Net Code: CaptureScreenshotOptimized
                  Source: NursultanClient.exe1.exe.0.dr, Form1.cs.Net Code: CaptureScreenshotOptimized
                  Contains functionality to log keystrokes (.Net Source)
                  Source: NursultanClient.exe1.exe, KeyLogger.cs.Net Code: SetupKeyboardHook
                  Source: NursultanClient.exe1.exe.0.dr, KeyLogger.cs.Net Code: SetupKeyboardHook
                  Contains functionality to register a low level keyboard hook
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_07EC2DAC SetWindowsHookExW 0000000D,00000000,?,?0_2_07EC2DAC
                  Installs a global keyboard hook
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\NursultanClient.exe1.exeJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\NursultanClient.exe1.exeJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\NursultanClient.exe1.exe
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\NursultanClient.exe1.exe
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_08F85BE2 GetKeyState,GetKeyState,GetKeyState,0_2_08F85BE2
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_087EED90 GetKeyState,GetKeyState,GetKeyState,6_2_087EED90
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_087EED80 GetKeyState,GetKeyState,GetKeyState,6_2_087EED80
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeFile created: C:\Windows\SysWOW64\NursultanClient.exe1.exeJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeFile created: C:\Windows\SysWOW64\NursultanClient.exe1.exe:Zone.Identifier:$DATAJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_06F885A00_2_06F885A0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_06F87CD00_2_06F87CD0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_06F879880_2_06F87988
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_07ECD7F80_2_07ECD7F8
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_07EC87200_2_07EC8720
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_08F830C80_2_08F830C8
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_09E5D3080_2_09E5D308
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_09E50FA80_2_09E50FA8
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_06E685A06_2_06E685A0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_06E67CD06_2_06E67CD0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_06E679886_2_06E67988
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_079E64106_2_079E6410
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_079E20886_2_079E2088
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_079E9CA86_2_079E9CA8
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_079E9C706_2_079E9C70
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_087EE6F06_2_087EE6F0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_087E64606_2_087E6460
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_05EA85A015_2_05EA85A0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_05EA7CD015_2_05EA7CD0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_05EA798815_2_05EA7988
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_0885141815_2_08851418
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_0885675015_2_08856750
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_08859FB815_2_08859FB8
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_08859FC815_2_08859FC8
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_0932ACF015_2_0932ACF0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_093207E815_2_093207E8
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_0932646015_2_09326460
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 20_2_079785A020_2_079785A0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 20_2_07977CD020_2_07977CD0
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 20_2_0797798820_2_07977988
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 20_2_0879693820_2_08796938
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 20_2_0879F50020_2_0879F500
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 20_2_0879175820_2_08791758
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 20_2_0879A1F820_2_0879A1F8
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 20_2_0879A20820_2_0879A208
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 20_2_0928690820_2_09286908
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3073231524.0000000003A9B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3055787808.0000000002A57000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000000.00000000.1195673272.0000000000774000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamesvch> vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3073231524.0000000003BAF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3053635476.0000000000DEE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3051703299.0000000000A19000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3055698461.0000000002801000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3088801361.00000000074A0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3069778022.0000000003981000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3069778022.0000000003869000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.3075683315.00000000044AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.3056571017.00000000033E7000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.3075683315.0000000004543000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000014.00000002.3076941011.00000000043EF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000014.00000002.3076941011.00000000044D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe, 00000014.00000002.3056322219.0000000003377000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exeBinary or memory string: OriginalFilenamesvch> vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exe.0.drBinary or memory string: OriginalFilenamesvch> vs NursultanClient.exe1.exe
                  Source: NursultanClient.exe1.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                  Source: NursultanClient.exe1.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: NursultanClient.exe1.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: 0.2.NursultanClient.exe1.exe.3bafc98.1.raw.unpack, ITaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask'
                  Source: 0.2.NursultanClient.exe1.exe.3bafc98.1.raw.unpack, TaskSchedulerSnapshot.csTask registration methods: 'InternalCreate', 'Create'
                  Source: 0.2.NursultanClient.exe1.exe.3bafc98.1.raw.unpack, TaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
                  Source: 0.2.NursultanClient.exe1.exe.3bafc98.1.raw.unpack, Task.csTask registration methods: 'RegisterChanges', 'CreateTask'
                  Source: 0.2.NursultanClient.exe1.exe.3bafc98.1.raw.unpack, TaskService.csTask registration methods: 'CreateFromToken'
                  Source: 0.2.NursultanClient.exe1.exe.3b0fc78.2.raw.unpack, ITaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask'
                  Source: 6.2.NursultanClient.exe1.exe.39812a8.1.raw.unpack, TaskSecurity.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
                  Source: 6.2.NursultanClient.exe1.exe.39812a8.1.raw.unpack, TaskSecurity.csSecurity API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
                  Source: 0.2.NursultanClient.exe1.exe.3bafc98.1.raw.unpack, TaskFolder.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                  Source: 0.2.NursultanClient.exe1.exe.3b0fc78.2.raw.unpack, TaskPrincipal.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 0.2.NursultanClient.exe1.exe.3b0fc78.2.raw.unpack, User.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
                  Source: 0.2.NursultanClient.exe1.exe.3bafc98.1.raw.unpack, Task.csSecurity API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                  Source: 0.2.NursultanClient.exe1.exe.3b0fc78.2.raw.unpack, Task.csSecurity API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                  Source: 0.2.NursultanClient.exe1.exe.3b0fc78.2.raw.unpack, TaskFolder.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                  Source: 6.2.NursultanClient.exe1.exe.39812a8.1.raw.unpack, TaskFolder.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                  Source: 6.2.NursultanClient.exe1.exe.39812a8.1.raw.unpack, TaskPrincipal.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 0.2.NursultanClient.exe1.exe.3b0fc78.2.raw.unpack, TaskSecurity.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
                  Source: 0.2.NursultanClient.exe1.exe.3b0fc78.2.raw.unpack, TaskSecurity.csSecurity API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
                  Source: 0.2.NursultanClient.exe1.exe.3bafc98.1.raw.unpack, TaskPrincipal.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 0.2.NursultanClient.exe1.exe.3bafc98.1.raw.unpack, TaskSecurity.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
                  Source: 0.2.NursultanClient.exe1.exe.3bafc98.1.raw.unpack, TaskSecurity.csSecurity API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
                  Source: 6.2.NursultanClient.exe1.exe.39812a8.1.raw.unpack, User.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
                  Source: 6.2.NursultanClient.exe1.exe.39812a8.1.raw.unpack, Task.csSecurity API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                  Source: 0.2.NursultanClient.exe1.exe.3bafc98.1.raw.unpack, User.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
                  Source: classification engineClassification label: mal92.spyw.evad.winEXE@24/29@2/2
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMutant created: NULL
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7828:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8116:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5248:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5564:120:WilError_03
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeFile created: C:\Users\user\AppData\Local\Temp\HDNvtekAudioCacheJump to behavior
                  Source: NursultanClient.exe1.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: NursultanClient.exe1.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: NursultanClient.exe1.exeVirustotal: Detection: 34%
                  Source: NursultanClient.exe1.exeReversingLabs: Detection: 26%
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeFile read: C:\Users\user\Desktop\NursultanClient.exe1.exeJump to behavior
                  Source: unknownProcess created: C:\Users\user\Desktop\NursultanClient.exe1.exe "C:\Users\user\Desktop\NursultanClient.exe1.exe"
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: unknownProcess created: C:\Users\user\Desktop\NursultanClient.exe1.exe C:\Users\user\Desktop\NursultanClient.exe1.exe
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: unknownProcess created: C:\Users\user\Desktop\NursultanClient.exe1.exe "C:\Users\user\Desktop\NursultanClient.exe1.exe"
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: unknownProcess created: C:\Users\user\Desktop\NursultanClient.exe1.exe "C:\Users\user\Desktop\NursultanClient.exe1.exe"
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get modelJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get modelJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get modelJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dwrite.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: taskschd.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: xmllite.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windowscodecs.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dwrite.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: taskschd.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windowscodecs.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mscoree.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: version.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: vcruntime140_clr0400.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windows.storage.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wldp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: profapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptsp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rsaenh.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptbase.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dwrite.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: amsi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: userenv.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: msasn1.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: gpapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: iphlpapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dnsapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc6.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winnsi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wbemcomn.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: taskschd.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: sspicli.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mswsock.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasadhlp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: fwpuclnt.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasapi32.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasman.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rtutils.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winhttp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ondemandconnroutehelper.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: secur32.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: schannel.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mskeyprotect.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ntasn1.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncrypt.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncryptsslp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windowscodecs.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vbscript.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sxs.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mscoree.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: version.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: vcruntime140_clr0400.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windows.storage.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wldp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: profapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptsp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rsaenh.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: cryptbase.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dwrite.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: amsi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: userenv.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: msasn1.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: gpapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: iphlpapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dnsapi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc6.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: dhcpcsvc.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winnsi.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: wbemcomn.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: taskschd.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: sspicli.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mswsock.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasadhlp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: fwpuclnt.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasapi32.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rasman.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: rtutils.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: winhttp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ondemandconnroutehelper.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: secur32.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: schannel.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: mskeyprotect.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ntasn1.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncrypt.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: ncryptsslp.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeSection loaded: windowscodecs.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vbscript.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sxs.dll
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                  Source: NursultanClient.exe1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                  Source: NursultanClient.exe1.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                  Source: NursultanClient.exe1.exeStatic file information: File size 1642496 > 1048576
                  Source: NursultanClient.exe1.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x190400
                  Source: NursultanClient.exe1.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                  Source: NursultanClient.exe1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                  Source: Binary string: C:\Users\dahal\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdbSHA256TU2 source: NursultanClient.exe1.exe, 00000000.00000002.3073231524.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.3073231524.0000000003BAF000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3088801361.00000000074A0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3069778022.0000000003981000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3069778022.0000000003869000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.3075683315.00000000044AD000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.3075683315.0000000004543000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3076941011.00000000043EF000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3076941011.00000000044D1000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: NursultanClient.exe1.exe, 00000006.00000002.3051703299.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016BE000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: NursultanClient.exe1.exe, 00000006.00000002.3051703299.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3083649444.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3054175188.00000000016BE000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: costura.costura.pdb.compressed source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr
                  Source: Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressedUde.microsoft.win32.taskscheduler.resources source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr
                  Source: Binary string: st.pdb source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr
                  Source: Binary string: C:\Users\dahal\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdb source: NursultanClient.exe1.exe, 00000000.00000002.3073231524.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.3073231524.0000000003BAF000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3088801361.00000000074A0000.00000004.08000000.00040000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3069778022.0000000003981000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3069778022.0000000003869000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.3075683315.00000000044AD000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.3075683315.0000000004543000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3076941011.00000000043EF000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3076941011.00000000044D1000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: costura.costura.pdb.compressed|||Costura.pdb|806F4C19B2D7FD9E3B836269EC07647019A29E95|7960 source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.dr

                  Data Obfuscation

                  barindex
                  .NET source code contains potential unpacker
                  Source: NursultanClient.exe1.exe, AssemblyLoader.cs.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
                  Source: NursultanClient.exe1.exe.0.dr, AssemblyLoader.cs.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
                  Source: 0.2.NursultanClient.exe1.exe.3bafc98.1.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                  Source: 0.2.NursultanClient.exe1.exe.3bafc98.1.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                  Source: 0.2.NursultanClient.exe1.exe.3bafc98.1.raw.unpack, XmlSerializationHelper.cs.Net Code: ReadObjectProperties
                  Source: 0.2.NursultanClient.exe1.exe.3b0fc78.2.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                  Source: 0.2.NursultanClient.exe1.exe.3b0fc78.2.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                  Source: 0.2.NursultanClient.exe1.exe.3b0fc78.2.raw.unpack, XmlSerializationHelper.cs.Net Code: ReadObjectProperties
                  Source: 6.2.NursultanClient.exe1.exe.39812a8.1.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                  Source: 6.2.NursultanClient.exe1.exe.39812a8.1.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                  Source: 6.2.NursultanClient.exe1.exe.39812a8.1.raw.unpack, XmlSerializationHelper.cs.Net Code: ReadObjectProperties
                  Source: 6.2.NursultanClient.exe1.exe.6bf0000.4.raw.unpack, DynamicUtils.cs.Net Code: CreateSharpArgumentInfoArray
                  Source: 6.2.NursultanClient.exe1.exe.6bf0000.4.raw.unpack, LateBoundReflectionDelegateFactory.cs.Net Code: CreateDefaultConstructor
                  Yara detected Costura Assembly Loader
                  Source: Yara matchFile source: NursultanClient.exe1.exe, type: SAMPLE
                  Source: Yara matchFile source: 0.0.NursultanClient.exe1.exe.5e0000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0000000F.00000002.3056571017.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000014.00000002.3056322219.0000000003351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.3055787808.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000006.00000002.3055698461.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000000.1195526613.00000000005E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: NursultanClient.exe1.exe PID: 2248, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: NursultanClient.exe1.exe PID: 2000, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: NursultanClient.exe1.exe PID: 7752, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: NursultanClient.exe1.exe PID: 8052, type: MEMORYSTR
                  Source: Yara matchFile source: C:\Windows\SysWOW64\NursultanClient.exe1.exe, type: DROPPED
                  Source: NursultanClient.exe1.exeStatic PE information: 0x8429E54A [Fri Apr 6 15:16:26 2040 UTC]
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_07EC33F5 push edi; ret 0_2_07EC33F6
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_09E57A62 push E801005Eh; ret 0_2_09E57A69
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_09E5CC58 push ds; ret 0_2_09E5CC6F
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_09E59F20 push E801005Eh; retf 0_2_09E59F61
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 0_2_09E5E15D push E8000000h; ret 0_2_09E5E169
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_06E6D059 push ss; retf 6_2_06E6D066
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_079E30C8 push ss; retf 6_2_079E30D6
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_087EA950 pushfd ; ret 6_2_087EA95D
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_087E3B40 push eax; ret 6_2_087E3B4D
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 6_2_087E6D30 push FFFFFFC3h; ret 6_2_087E6D4A
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_0885C528 push 8BD08B6Ah; iretd 15_2_0885C52F
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_0932A950 pushfd ; ret 15_2_0932A95D
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 15_2_09323B40 push eax; ret 15_2_09323B4D
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 20_2_07974D8D push FFFFFFE9h; iretd 20_2_07974DE9
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 20_2_0928D74C pushad ; retf 20_2_0928D751
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeCode function: 20_2_0928D753 push edx; iretd 20_2_0928D779
                  Source: NursultanClient.exe1.exeStatic PE information: section name: .text entropy: 7.951730369753831
                  Source: NursultanClient.exe1.exe.0.drStatic PE information: section name: .text entropy: 7.951730369753831
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeFile created: C:\Windows\SysWOW64\NursultanClient.exe1.exeJump to dropped file
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeFile created: C:\Windows\SysWOW64\NursultanClient.exe1.exeJump to dropped file
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NursultanClient.exe1Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NursultanClient.exe1Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX

                  Malware Analysis System Evasion

                  barindex
                  Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Camera&apos; OR PNPClass = &apos;Image&apos;)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Media&apos; OR Name LIKE &apos;%microphone%&apos;)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Camera&apos; OR PNPClass = &apos;Image&apos;)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Media&apos; OR Name LIKE &apos;%microphone%&apos;)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Camera&apos; OR PNPClass = &apos;Image&apos;)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Media&apos; OR Name LIKE &apos;%microphone%&apos;)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Camera&apos; OR PNPClass = &apos;Image&apos;)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Media&apos; OR Name LIKE &apos;%microphone%&apos;)
                  Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model FROM Win32_DiskDrive
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model FROM Win32_DiskDrive
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model FROM Win32_DiskDrive
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model FROM Win32_DiskDrive
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: DA0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 2A30000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 4A30000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: E90000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 2800000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 4800000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 17D0000 memory reserve | memory write watch
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 33C0000 memory reserve | memory write watch
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 53C0000 memory reserve | memory write watch
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 15E0000 memory reserve | memory write watch
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 3350000 memory reserve | memory write watch
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: 1960000 memory reserve | memory write watch
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 4087Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 5559Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 833Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 1888Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 6961Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 2637
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 6979
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 1870
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWindow / User API: threadDelayed 7732
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 6156Thread sleep time: -30437127721620741s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 1440Thread sleep count: 833 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7412Thread sleep count: 1888 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7412Thread sleep count: 6961 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7428Thread sleep time: -21213755684765971s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7428Thread sleep time: -98453s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7788Thread sleep count: 155 > 30
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7984Thread sleep count: 2637 > 30
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7992Thread sleep count: 33 > 30
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7992Thread sleep time: -30437127721620741s >= -30000s
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 7980Thread sleep count: 6979 > 30
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 8080Thread sleep count: 180 > 30
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 6564Thread sleep count: 1870 > 30
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 6684Thread sleep count: 31 > 30
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 6684Thread sleep time: -28592453314249787s >= -30000s
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 6640Thread sleep count: 7732 > 30
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exe TID: 6684Thread sleep time: -99094s >= -30000s
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 98453Jump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeThread delayed: delay time: 99094
                  Source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.drBinary or memory string: CheckForQEMU
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3055787808.0000000002A57000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3055698461.0000000002801000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.3056571017.00000000033E7000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3056322219.0000000003377000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qemu-ga
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3082329886.0000000006A5E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZ
                  Source: NursultanClient.exe1.exe.0.drBinary or memory string: vmware
                  Source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.drBinary or memory string: qemuwmi
                  Source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.drBinary or memory string: QEMU HARDDISK
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3088248902.000000000786E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlls
                  Source: NursultanClient.exe1.exe, NursultanClient.exe1.exe.0.drBinary or memory string: qemu-ga5Error checking processes: KAny.Run sandbox environment detected!#Sandbox Detection9No Any.Run sandbox detected.
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.3086763104.000000000767C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: NursultanClient.exe1.exe, 00000014.00000002.3087679114.0000000007592000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllrr
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess information queried: ProcessInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeMemory allocated: page read and write | page guardJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get modelJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get modelJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get modelJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c wmic diskdrive get model
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive get model
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.3056571017.0000000003AE0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qL[07:06:48] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000014.00000002.3056322219.00000000036F5000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000014.00000002.3056322219.0000000003377000.00000004.00000800.00020000.00000000.sdmp, z.txt.0.drBinary or memory string: [07:06:53] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:33] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:43] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:20] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:30] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:03] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:51] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.3056571017.00000000033E7000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: [07:06:52] Window changed: 'Program Manager' (Process: explorer, PID: 496)DNvtekAudioCache\z.txt' because it is being used by another process.
                  Source: z.txt.0.drBinary or memory string: [07:06:13] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:00] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3055787808.00000000031D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qL[07:06:37] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:03:59] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:42] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:12] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:22] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3055787808.0000000003041000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qJ[07:06:55] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:02] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:42] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:52] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.3056571017.0000000003AE0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qJ[07:06:48] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:01] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:11] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:21] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.3056571017.00000000038B4000.00000004.00000800.00020000.00000000.sdmp, z.txt.0.drBinary or memory string: [07:06:52] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:32] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3055787808.0000000003041000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qL[07:06:55] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3055787808.00000000031D6000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.3055787808.0000000002D5D000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.3055787808.0000000003186000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerlB
                  Source: z.txt.0.drBinary or memory string: [07:06:44] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000014.00000002.3056322219.00000000036F5000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qJ[07:06:53] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:40] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:50] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:34] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:24] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:14] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3055787808.0000000003046000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.3055787808.00000000031D6000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000000.00000002.3055787808.0000000002D5D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager
                  Source: z.txt.0.drBinary or memory string: [07:04:49] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:54] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:51] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:07] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:31] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:14] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:47] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.3056571017.00000000038BA000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.3056571017.0000000003AE5000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.3056571017.0000000003421000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerX
                  Source: z.txt.0.drBinary or memory string: [07:04:48] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:46] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:28] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3055698461.0000000002E7E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qJ[07:06:51] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3055698461.0000000002E7E000.00000004.00000800.00020000.00000000.sdmp, z.txt.0.drBinary or memory string: [07:06:51] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:43] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:03] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:26] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:09] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:23] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:37] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:17] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:06] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3055787808.0000000003041000.00000004.00000800.00020000.00000000.sdmp, z.txt.0.drBinary or memory string: [07:06:55] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:57] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:46] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3055698461.0000000002E83000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 00000006.00000002.3055698461.00000000028D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager8
                  Source: z.txt.0.drBinary or memory string: [07:05:49] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3055698461.00000000028D0000.00000004.00000800.00020000.00000000.sdmp, NursultanClient.exe1.exe, 0000000F.00000002.3056571017.0000000003421000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager4
                  Source: NursultanClient.exe1.exe, 00000006.00000002.3055698461.0000000002E7E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qL[07:06:51] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:11] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:22] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:03:53] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3055787808.00000000031D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qJ[07:06:37] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:42] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:38] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3055787808.0000000002D58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qL[07:06:50] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:28] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:35] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:09] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:58] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:45] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:27] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:07] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:05] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:14] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:54] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:37] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:57] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:47] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.3056571017.00000000038B4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qL[07:06:52] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:39] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3055787808.0000000002D58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qJ[07:06:50] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:29] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:19] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:03] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:13] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:23] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:43] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:53] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:18] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3055787808.0000000002A57000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: [07:06:55] Window changed: 'Program Manager' (Process: explorer, PID: 496)DNvtekAudioCache\z.txt' because it is being used by another process.
                  Source: z.txt.0.drBinary or memory string: [07:05:55] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:26] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:05] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:15] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:36] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:56] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:45] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:46] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:25] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:35] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:17] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:39] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.3056571017.00000000038B4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qJ[07:06:52] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:30] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3055787808.0000000002D58000.00000004.00000800.00020000.00000000.sdmp, z.txt.0.drBinary or memory string: [07:06:50] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:24] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000000.00000002.3055787808.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, z.txt.0.drBinary or memory string: [07:06:37] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 00000014.00000002.3056322219.00000000036F5000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qL[07:06:53] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:53] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:40] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:33] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:41] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:16] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:58] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:03:58] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:16] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:05] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:36] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:25] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:28] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:19] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:08] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:39] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:52] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:41] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:21] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:06:10] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:04:32] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:01] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: NursultanClient.exe1.exe, 0000000F.00000002.3056571017.0000000003AE0000.00000004.00000800.00020000.00000000.sdmp, z.txt.0.drBinary or memory string: [07:06:48] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: z.txt.0.drBinary or memory string: [07:05:59] Window changed: 'Program Manager' (Process: explorer, PID: 496)
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Users\user\Desktop\NursultanClient.exe1.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Users\user\Desktop\NursultanClient.exe1.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Users\user\Desktop\NursultanClient.exe1.exe VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Users\user\Desktop\NursultanClient.exe1.exe VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NursultanClient.exe1.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity InformationAcquire InfrastructureValid Accounts121
                  Windows Management Instrumentation                  		11
                  Scheduled Task/Job                  		12
                  Process Injection                  		2
                  Masquerading                  		311
                  Input Capture                  		321
                  Security Software Discovery                  		Remote Services1
                  Screen Capture                  		11
                  Encrypted Channel                  		Exfiltration Over Other Network MediumAbuse Accessibility Features
                  CredentialsDomainsDefault Accounts11
                  Scheduled Task/Job                  		1
                  Registry Run Keys / Startup Folder                  		11
                  Scheduled Task/Job                  		1
                  Disable or Modify Tools                  		LSASS Memory2
                  Process Discovery                  		Remote Desktop Protocol311
                  Input Capture                  		1
                  Non-Standard Port                  		Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain AccountsAt1
                  DLL Side-Loading                  		1
                  Registry Run Keys / Startup Folder                  		251
                  Virtualization/Sandbox Evasion                  		Security Account Manager251
                  Virtualization/Sandbox Evasion                  		SMB/Windows Admin Shares1
                  Archive Collected Data                  		1
                  Ingress Tool Transfer                  		Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
                  DLL Side-Loading                  		12
                  Process Injection                  		NTDS1
                  Application Window Discovery                  		Distributed Component Object ModelInput Capture2
                  Non-Application Layer Protocol                  		Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
                  Obfuscated Files or Information                  		LSA Secrets1
                  System Network Configuration Discovery                  		SSHKeylogging3
                  Application Layer Protocol                  		Scheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts12
                  Software Packing                  		Cached Domain Credentials223
                  System Information Discovery                  		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                  Timestomp                  		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                  DLL Side-Loading                  		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1638422 Sample: NursultanClient.exe1.exe Startdate: 14/03/2025 Architecture: WINDOWS Score: 92 48 george-webcam.gl.at.ply.gg 2->48 50 api64.ipify.org 2->50 56 Multi AV Scanner detection for dropped file 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 .NET source code contains potential unpacker 2->60 62 4 other signatures 2->62 8 NursultanClient.exe1.exe 16 14 2->8         started        13 NursultanClient.exe1.exe 6 2->13         started        15 NursultanClient.exe1.exe 2->15         started        17 NursultanClient.exe1.exe 2->17         started        signatures3 process4 dnsIp5 52 api64.ipify.org 104.237.62.213, 443, 49693, 49698 WEBNXUS United States 8->52 54 george-webcam.gl.at.ply.gg 147.185.221.26, 49692, 49697, 49701 SALSGIVERUS United States 8->54 44 C:\Windows\...44ursultanClient.exe1.exe, PE32 8->44 dropped 46 NursultanClient.exe1.exe:Zone.Identifier, ASCII 8->46 dropped 64 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 8->64 66 Contains functionality to register a low level keyboard hook 8->66 68 Installs a global keyboard hook 8->68 19 cmd.exe 1 8->19         started        21 cmd.exe 13->21         started        23 cmd.exe 15->23         started        25 cmd.exe 17->25         started        file6 signatures7 process8 process9 27 WMIC.exe 1 19->27         started        30 conhost.exe 19->30         started        32 WMIC.exe 1 21->32         started        34 conhost.exe 21->34         started        36 conhost.exe 23->36         started        38 WMIC.exe 23->38         started        40 conhost.exe 25->40         started        42 WMIC.exe 25->42         started        signatures10 70 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 27->70

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.